From a7c82483b986703175a815d38d7a92132277e5b8 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 14 Oct 2026 14:33:46 +0000
Subject: [PATCH] Sync Sigma detections from security_content_sigma PR #42

Convert added and modified rules into ESCU detections.
---
 ..._cross_region_possible_inference_abuse.yml |   8 +-
 ...bedrock_claude_excessive_use_of_tokens.yml |   6 +-
 ...sk_filesystem_and_exec_tool_invocation.yml |   6 +-
 ...edrock_claude_hostile_prompt_sentiment.yml |   8 +-
 ...drock_claude_possible_prompt_injection.yml |   8 +-
 ...drock_claude_sensitive_data_in_prompts.yml |   8 +-
 ...bedrock_claude_unusually_large_prompts.yml |   8 +-
 ...se_security_alerts_by_application_name.yml |   4 +-
 .../cisco_asa___aaa_policy_tampering.yml      |  49 +++----
 ..._asa___core_syslog_message_volume_drop.yml |  17 +--
 .../cisco_asa___device_file_copy_activity.yml |  49 ++-----
 ...___device_file_copy_to_remote_location.yml |  69 +++------
 .../cisco_asa___logging_disabled_via_cli.yml  |  52 +++----
 ...ogging_filters_configuration_tampering.yml |  61 +++-----
 ...isco_asa___logging_message_suppression.yml |  46 +++---
 ...o_asa___new_local_user_account_created.yml |  41 +++---
 .../cisco_asa___packet_capture_activity.yml   |  42 ++----
 ..._asa___reconnaissance_command_activity.yml |  28 ++--
 ...er_account_deleted_from_local_database.yml |  41 +++---
 ...ser_account_lockout_threshold_exceeded.yml |  24 ++--
 ...isco_asa___user_privilege_level_change.yml |  40 +++---
 .../cisco_duo_admin_login_unusual_browser.yml |   4 +-
 .../cisco_duo_admin_login_unusual_country.yml |   4 +-
 .../cisco_duo_admin_login_unusual_os.yml      |   4 +-
 .../cisco_duo_bulk_policy_deletion.yml        |   5 +-
 .../cisco_duo_bypass_code_generation.yml      |  27 ++--
 ...licy_allow_devices_without_screen_lock.yml |  16 ++-
 ...co_duo_policy_allow_network_bypass_2fa.yml |  16 ++-
 .../cisco_duo_policy_allow_old_flash.yml      |   4 +-
 .../cisco_duo_policy_allow_old_java.yml       |  17 ++-
 ...isco_duo_policy_allow_tampered_devices.yml |  16 ++-
 .../cisco_duo_policy_bypass_2fa.yml           |   4 +-
 .../cisco_duo_policy_deny_access.yml          |   4 +-
 ...uo_policy_skip_2fa_for_other_countries.yml |  21 ++-
 ...isco_duo_set_user_status_to_bypass_2fa.yml |  16 ++-
 ...s_xe_guestshell_activation_and_destroy.yml |  19 ++-
 ...equence_with_optional_loopback_removal.yml |  19 ++-
 ...ios_xe_reconnaissance_command_activity.yml |  21 +--
 ...cisco_ios_xe_remote_access_probe_burst.yml |  16 +--
 ...latform_package_describe_shell_pattern.yml |  29 +---
 ..._ios_xe_tunnel_interface_configuration.yml |  13 +-
 ...isco_ios_xe_vty_access_class_tampering.yml |  13 +-
 ...os_xe_webui_login_from_iosd_local_port.yml |  19 ++-
 ...os_xe_webui_programmatic_configuration.yml |  16 +--
 ...ce_ip_vmanage_admin_ssh_authentication.yml |  15 +-
 ...sh_key_authentication_from_same_source.yml |  15 +-
 ...rushftp_server_side_template_injection.yml |   7 +-
 ...ct_distributed_password_spray_attempts.yml |  36 +----
 .../detect_html_help_spawn_child_process.yml  |  18 +--
 .../detect_new_login_attempts_to_routers.yml  |   2 +-
 .../detect_password_spray_attempts.yml        |   6 +-
 .../email_attachments_with_lots_of_spaces.yml |   8 +-
 ...itten_outside_of_the_outlook_directory.yml |  47 ++----
 ...s_sending_high_volume_traffic_to_hosts.yml |   2 +-
 .../application/esxi_account_modified.yml     |   5 +-
 .../application/esxi_audit_tampering.yml      |  13 +-
 .../application/esxi_bulk_vm_termination.yml  |  10 +-
 .../application/esxi_download_errors.yml      |   6 +-
 .../esxi_encryption_settings_modified.yml     |  11 +-
 .../esxi_external_root_login_activity.yml     |   6 +-
 .../application/esxi_firewall_disabled.yml    |   6 +-
 .../esxi_lockdown_mode_disabled.yml           |   6 +-
 .../esxi_loghost_config_tampering.yml         |   6 +-
 .../esxi_malicious_vib_forced_install.yml     |   5 +-
 .../esxi_reverse_shell_patterns.yml           |   6 +-
 .../esxi_sensitive_files_accessed.yml         |   6 +-
 .../esxi_shared_or_stolen_root_account.yml    |   5 +-
 .../application/esxi_shell_access_enabled.yml |   6 +-
 .../application/esxi_ssh_brute_force.yml      |   6 +-
 detections/application/esxi_ssh_enabled.yml   |   6 +-
 .../application/esxi_syslog_config_change.yml |   6 +-
 .../esxi_system_clock_manipulation.yml        |   6 +-
 .../esxi_system_information_discovery.yml     |   6 +-
 .../esxi_user_granted_admin_role.yml          |   6 +-
 .../esxi_vib_acceptance_level_tampering.yml   |   6 +-
 detections/application/esxi_vm_discovery.yml  |   6 +-
 .../esxi_vm_exported_via_remote_tool.yml      |   6 +-
 .../ivanti_vtm_new_account_creation.yml       |  14 +-
 .../m365_copilot_agentic_jailbreak_attack.yml |  24 +---
 ...ot_application_usage_pattern_anomalies.yml |  30 +---
 ...copilot_failed_authentication_patterns.yml |  16 +--
 ...copilot_impersonation_jailbreak_attack.yml |  14 +-
 ...nformation_extraction_jailbreak_attack.yml |  55 +------
 .../m365_copilot_jailbreak_attempts.yml       |  27 +---
 ...mpliant_devices_accessing_m365_copilot.yml |  18 +--
 .../m365_copilot_session_origin_anomalies.yml |  18 +--
 ...stem_server_suspicious_extension_write.yml |   2 +-
 .../mcp_github_suspicious_operation.yml       |  31 +---
 .../mcp_postgres_suspicious_query.yml         |  21 +--
 .../application/mcp_prompt_injection.yml      |   4 +-
 .../mcp_sensitive_system_file_search.yml      |  21 +--
 .../monitor_email_for_brand_abuse.yml         |   2 +-
 .../no_windows_updates_in_a_time_frame.yml    |   2 +-
 ...entication_failed_during_mfa_challenge.yml |   4 +-
 .../okta_idp_lifecycle_modifications.yml      |   4 +-
 .../application/okta_mfa_exhaustion_hunt.yml  |  17 +--
 ...e_and_response_for_verify_push_request.yml |   4 +-
 ...a_multi_factor_authentication_disabled.yml |  15 +-
 .../okta_multiple_accounts_locked_out.yml     |  19 +--
 ..._multiple_failed_mfa_requests_for_user.yml |   4 +-
 ...failed_requests_to_access_applications.yml |   3 +-
 ..._users_failing_to_authenticate_from_ip.yml |   4 +-
 .../okta_new_api_token_created.yml            |  17 +--
 .../okta_new_device_enrolled_on_account.yml   |  15 +-
 ...g_detection_with_fastpass_origin_check.yml |  10 +-
 .../okta_risk_threshold_exceeded.yml          |  11 +-
 ...uccessful_single_factor_authentication.yml |  13 +-
 .../okta_suspicious_activity_reported.yml     |   4 +-
 ...kta_suspicious_use_of_a_session_cookie.yml |  10 +-
 .../okta_threatinsight_threat_detected.yml    |   4 +-
 ...kta_unauthorized_access_to_application.yml |   4 +-
 .../okta_user_logins_from_multiple_cities.yml |   4 +-
 .../ollama_abnormal_network_connectivity.yml  |  30 ++--
 .../ollama_excessive_api_requests.yml         |  27 ++--
 ...ollama_long_running_inference_requests.yml |  33 ++---
 ...sible_api_endpoint_scan_reconnaissance.yml |  32 ++---
 ...sible_memory_exhaustion_resource_abuse.yml |  30 ++--
 .../ollama_repeated_application_errors.yml    |  30 ++--
 ..._auth_source_and_verification_response.yml |   5 +-
 ..._multiple_failed_mfa_requests_for_user.yml |   5 +-
 ..._new_mfa_method_after_credential_reset.yml |  15 +-
 ...gid_new_mfa_method_registered_for_user.yml |   5 +-
 ...tc_windchill_gateway_command_execution.yml |  24 ++--
 .../ptc_windchill_gw_ready_ok_probe.yml       |  21 +--
 ..._appdynamics_secure_application_alerts.yml |  42 ++----
 ...entication_token_exposure_in_debug_log.yml |  12 +-
 ...rary_file_write_to_windows_system_root.yml |  12 +-
 .../application/splunk_rce_via_user_xslt.yml  |   3 +-
 ...pplication_alerts_for_runtime_security.yml |  30 ++--
 ...n_disclosure_in_debug_logging_channels.yml |  12 +-
 .../splunk_user_enumeration_attempt.yml       |   3 +-
 ...scalation_via_custom_urls_in_dashboard.yml |   5 +-
 ...suspicious_email_attachment_extensions.yml |  14 +-
 .../application/suspicious_java_classes.yml   |  21 +--
 .../application/zoom_high_video_latency.yml   |   6 +-
 .../application/zoom_rare_audio_devices.yml   |   3 +-
 .../application/zoom_rare_input_devices.yml   |   3 +-
 .../application/zoom_rare_video_devices.yml   |   3 +-
 ..._eks_kubernetes_cluster_scan_detection.yml |   2 +-
 ...azon_eks_kubernetes_pod_scan_detection.yml |   2 +-
 ...concurrent_sessions_from_different_ips.yml |   6 +-
 .../cloud/asl_aws_create_access_key.yml       |  15 +-
 ..._policy_version_to_allow_all_resources.yml |   6 +-
 ..._aws_credential_access_getpassworddata.yml |   6 +-
 ...s_credential_access_rds_password_reset.yml |   6 +-
 ..._aws_defense_evasion_delete_cloudtrail.yml |  17 +--
 ...se_evasion_delete_cloudwatch_log_group.yml |  15 +-
 ...fense_evasion_impair_security_services.yml |  15 +-
 ...aws_defense_evasion_putbucketlifecycle.yml |   4 +-
 ...efense_evasion_stop_logging_cloudtrail.yml |  17 +--
 ..._aws_defense_evasion_update_cloudtrail.yml |  17 +--
 ...g_keys_with_encrypt_policy_without_mfa.yml |   6 +-
 .../asl_aws_disable_bucket_versioning.yml     |   6 +-
 ...asl_aws_ec2_snapshot_shared_externally.yml |   6 +-
 ...ontainer_upload_outside_business_hours.yml |  20 +--
 ..._aws_ecr_container_upload_unknown_user.yml |  45 ++----
 ..._aws_iam_accessdenied_discovery_events.yml |   6 +-
 ...aws_iam_assume_role_policy_brute_force.yml |   6 +-
 .../cloud/asl_aws_iam_delete_policy.yml       |  15 +-
 .../asl_aws_iam_failure_group_deletion.yml    |  17 +--
 .../asl_aws_iam_successful_group_deletion.yml |  15 +-
 ...s_multi_factor_authentication_disabled.yml |  17 +--
 ...ntrol_list_created_with_all_open_ports.yml |   6 +-
 ...ws_network_access_control_list_deleted.yml |   6 +-
 ...aws_new_mfa_method_registered_for_user.yml |  17 +--
 .../asl_aws_saml_update_identity_provider.yml |  17 +--
 .../cloud/asl_aws_updateloginprofile.yml      |  17 +--
 ...ttribute_modification_for_exfiltration.yml |   6 +-
 .../cloud/aws_bedrock_delete_guardrails.yml   |  13 +-
 .../aws_bedrock_delete_knowledge_base.yml     |  13 +-
 ...model_invocation_logging_configuration.yml |  13 +-
 ..._number_list_foundation_model_failures.yml |  13 +-
 ...aws_bedrock_invoke_model_access_denied.yml |  13 +-
 ...concurrent_sessions_from_different_ips.yml |   6 +-
 ...sole_login_failed_during_mfa_challenge.yml |  17 +--
 ..._policy_version_to_allow_all_resources.yml |   6 +-
 detections/cloud/aws_createaccesskey.yml      |  16 +--
 detections/cloud/aws_createloginprofile.yml   |   6 +-
 .../aws_credential_access_failed_login.yml    |  14 +-
 .../aws_credential_access_getpassworddata.yml |   4 +-
 ...s_credential_access_rds_password_reset.yml |   4 +-
 .../aws_defense_evasion_delete_cloudtrail.yml |  16 +--
 ...se_evasion_delete_cloudwatch_log_group.yml |  14 +-
 ...fense_evasion_impair_security_services.yml |  12 +-
 ...aws_defense_evasion_putbucketlifecycle.yml |   4 +-
 ...efense_evasion_stop_logging_cloudtrail.yml |  16 +--
 .../aws_defense_evasion_update_cloudtrail.yml |  14 +-
 ...g_keys_with_encrypt_policy_without_mfa.yml |   6 +-
 ...with_kms_keys_performing_encryption_s3.yml |   6 +-
 .../cloud/aws_disable_bucket_versioning.yml   |   6 +-
 .../aws_ec2_snapshot_shared_externally.yml    |  20 +--
 ...s_ecr_container_scanning_findings_high.yml |   6 +-
 ...ing_findings_low_informational_unknown.yml |   6 +-
 ...ecr_container_scanning_findings_medium.yml |   6 +-
 ...ontainer_upload_outside_business_hours.yml |  18 +--
 .../aws_ecr_container_upload_unknown_user.yml |  18 +--
 .../cloud/aws_excessive_security_scanning.yml |  16 +--
 ...n_via_anomalous_getobject_api_activity.yml |   6 +-
 .../aws_exfiltration_via_batch_service.yml    |   6 +-
 ...ws_exfiltration_via_bucket_replication.yml |  16 +--
 .../aws_exfiltration_via_datasync_task.yml    |  18 +--
 .../aws_exfiltration_via_ec2_snapshot.yml     |   6 +-
 ...ber_of_failed_authentications_for_user.yml |   6 +-
 ...mber_of_failed_authentications_from_ip.yml |   4 +-
 .../aws_iam_accessdenied_discovery_events.yml |   6 +-
 ...aws_iam_assume_role_policy_brute_force.yml |  17 +--
 detections/cloud/aws_iam_delete_policy.yml    |  14 +-
 .../cloud/aws_iam_failure_group_deletion.yml  |  16 +--
 .../aws_iam_successful_group_deletion.yml     |  14 +-
 .../cloud/aws_lambda_updatefunctioncode.yml   |  14 +-
 ...s_multi_factor_authentication_disabled.yml |  16 +--
 ..._multiple_failed_mfa_requests_for_user.yml |   6 +-
 ..._users_failing_to_authenticate_from_ip.yml |   4 +-
 ...ntrol_list_created_with_all_open_ports.yml |   6 +-
 ...ws_network_access_control_list_deleted.yml |  17 +--
 ...aws_new_mfa_method_registered_for_user.yml |   6 +-
 .../cloud/aws_password_policy_changes.yml     |  14 +-
 ...ws_s3_exfiltration_behavior_identified.yml |   6 +-
 .../aws_saml_update_identity_provider.yml     |   6 +-
 .../cloud/aws_setdefaultpolicyversion.yml     |  16 +--
 ...nsole_authentication_from_multiple_ips.yml |   6 +-
 ...uccessful_single_factor_authentication.yml |   6 +-
 ...mber_of_failed_authentications_from_ip.yml |   4 +-
 detections/cloud/aws_updateloginprofile.yml   |  18 +--
 ...ure_active_directory_high_risk_sign_in.yml |  13 +-
 ..._consent_bypassed_by_service_principal.yml |   5 +-
 ...pplication_administrator_role_assigned.yml |   4 +-
 ...entication_failed_during_mfa_challenge.yml |   9 +-
 ...azure_ad_azurehound_useragent_detected.yml |  18 +--
 ...k_user_consent_for_risky_apps_disabled.yml |   5 +-
 ...concurrent_sessions_from_different_ips.yml |   4 +-
 .../azure_ad_device_code_authentication.yml   |   4 +-
 .../azure_ad_external_guest_user_invited.yml  |   4 +-
 ...ad_fullaccessasapp_permission_assigned.yml |   5 +-
 ..._ad_global_administrator_role_assigned.yml |   4 +-
 ...ber_of_failed_authentications_for_user.yml |   2 +-
 ...mber_of_failed_authentications_from_ip.yml |   2 +-
 ...d_multi_factor_authentication_disabled.yml |  18 +--
 ...ti_source_failed_authentications_spike.yml |   2 +-
 ...ds_and_useragents_authentication_spike.yml |   4 +-
 ..._multiple_denied_mfa_requests_for_user.yml |   4 +-
 ..._multiple_failed_mfa_requests_for_user.yml |   4 +-
 ...tiple_service_principals_created_by_sp.yml |   4 +-
 ...ple_service_principals_created_by_user.yml |   4 +-
 ..._users_failing_to_authenticate_from_ip.yml |   4 +-
 .../azure_ad_new_custom_domain_added.yml      |  17 +--
 .../azure_ad_new_federated_domain_added.yml   |   4 +-
 .../azure_ad_new_mfa_method_registered.yml    |   5 +-
 ..._ad_new_mfa_method_registered_for_user.yml |  18 +--
 ...th_application_consent_granted_by_user.yml |  20 +--
 .../cloud/azure_ad_pim_role_assigned.yml      |  14 +-
 ...azure_ad_pim_role_assignment_activated.yml |  16 +--
 ...entication_administrator_role_assigned.yml |   4 +-
 ...ivileged_graph_api_permission_assigned.yml |   5 +-
 .../azure_ad_privileged_role_assigned.yml     |   4 +-
 ...ged_role_assigned_to_service_principal.yml |   4 +-
 ...re_ad_service_principal_authentication.yml |  15 +-
 .../azure_ad_service_principal_created.yml    |  17 +--
 ...azure_ad_service_principal_enumeration.yml |  14 +-
 ...rvice_principal_new_client_credentials.yml |  16 +--
 ...azure_ad_service_principal_owner_added.yml |   4 +-
 ...service_principal_privilege_escalation.yml |  21 +--
 ...sful_authentication_from_different_ips.yml |   4 +-
 ...d_successful_powershell_authentication.yml |   4 +-
 ...uccessful_single_factor_authentication.yml |   4 +-
 ...e_ad_tenant_wide_admin_consent_granted.yml |   5 +-
 ...mber_of_failed_authentications_from_ip.yml |   4 +-
 ..._consent_blocked_for_risky_application.yml |  18 +--
 ...r_consent_denied_for_oauth_application.yml |  15 +-
 ...ure_ad_user_enabled_and_password_reset.yml |   4 +-
 ..._ad_user_immutableid_attribute_updated.yml |   4 +-
 .../azure_automation_account_created.yml      |  15 +-
 .../azure_automation_runbook_created.yml      |  15 +-
 .../cloud/azure_runbook_webhook_created.yml   |  15 +-
 ...alls_from_previously_unseen_user_roles.yml |   6 +-
 ...ance_created_by_previously_unseen_user.yml |   6 +-
 ...ce_created_in_previously_unused_region.yml |   6 +-
 ...e_created_with_previously_unseen_image.yml |   6 +-
 ...d_with_previously_unseen_instance_type.yml |  22 +--
 ...nce_modified_by_previously_unseen_user.yml |   6 +-
 ...g_activity_from_previously_unseen_city.yml |  10 +-
 ...ctivity_from_previously_unseen_country.yml |  10 +-
 ...vity_from_previously_unseen_ip_address.yml |  10 +-
 ...activity_from_previously_unseen_region.yml |  10 +-
 ..._security_groups_modifications_by_user.yml |   6 +-
 .../detect_aws_console_login_by_new_user.yml  |   4 +-
 ...ws_console_login_by_user_from_new_city.yml |   4 +-
 ...console_login_by_user_from_new_country.yml |   4 +-
 ..._console_login_by_user_from_new_region.yml |   4 +-
 ...etect_gcp_storage_access_from_a_new_ip.yml |   2 +-
 .../detect_new_open_gcp_storage_buckets.yml   |   7 +-
 .../cloud/detect_new_open_s3_buckets.yml      |   6 +-
 ...etect_new_open_s3_buckets_over_aws_cli.yml |  85 ++---------
 .../cloud/detect_s3_access_from_a_new_ip.yml  |   5 +-
 ...s_security_hub_alerts_for_ec2_instance.yml |   6 +-
 ...ke_in_aws_security_hub_alerts_for_user.yml |   2 +-
 ...blocked_outbound_traffic_from_your_aws.yml |   2 +-
 .../detect_spike_in_s3_bucket_deletion.yml    |   2 +-
 ...entication_failed_during_mfa_challenge.yml |   4 +-
 .../cloud/gcp_detect_gcploit_framework.yml    |   2 +-
 ..._kubernetes_cluster_pod_scan_detection.yml |   2 +-
 ...p_multi_factor_authentication_disabled.yml |  13 +-
 ..._multiple_failed_mfa_requests_for_user.yml |   4 +-
 ..._users_failing_to_authenticate_from_ip.yml |   4 +-
 ...uccessful_single_factor_authentication.yml |   4 +-
 ...mber_of_failed_authentications_from_ip.yml |   4 +-
 .../cloud/gdrive_suspicious_file_sharing.yml  |   2 +-
 .../cloud/geographic_improbable_location.yml  |   6 +-
 ...ithub_enterprise_delete_branch_ruleset.yml |  17 +--
 ...hub_enterprise_disable_2fa_requirement.yml |  15 +-
 ...erprise_disable_audit_log_event_stream.yml |  15 +-
 ...disable_classic_branch_protection_rule.yml |  17 +--
 .../github_enterprise_disable_dependabot.yml  |  16 +--
 ...ithub_enterprise_disable_ip_allow_list.yml |  15 +-
 ...terprise_modify_audit_log_event_stream.yml |  15 +-
 ...nterprise_pause_audit_log_event_stream.yml |  16 +--
 ...enterprise_register_self_hosted_runner.yml |  15 +-
 .../github_enterprise_remove_organization.yml |  16 +--
 .../github_enterprise_repository_archived.yml |  17 +--
 .../github_enterprise_repository_deleted.yml  |  17 +--
 ...ub_organizations_delete_branch_ruleset.yml |  17 +--
 ..._organizations_disable_2fa_requirement.yml |  16 +--
 ...disable_classic_branch_protection_rule.yml |  17 +--
 ...ithub_organizations_disable_dependabot.yml |  16 +--
 ...thub_organizations_repository_archived.yml |  17 +--
 ...ithub_organizations_repository_deleted.yml |  17 +--
 .../gsuite_drive_share_in_external_email.yml  |   4 +-
 .../gsuite_email_suspicious_attachment.yml    |   4 +-
 ...ail_suspicious_subject_with_attachment.yml |   4 +-
 ...mail_with_known_abuse_web_service_link.yml |   4 +-
 ...ail_with_attachment_to_external_domain.yml |   2 +-
 .../gsuite_suspicious_calendar_invite.yml     |   2 +-
 .../gsuite_suspicious_shared_file_name.yml    |   6 +-
 ...of_login_failures_from_a_single_source.yml |   4 +-
 ...es_abuse_of_secret_by_unusual_location.yml |   6 +-
 ..._abuse_of_secret_by_unusual_user_agent.yml |  18 +--
 ..._abuse_of_secret_by_unusual_user_group.yml |   6 +-
 ...s_abuse_of_secret_by_unusual_user_name.yml |  18 +--
 .../cloud/kubernetes_access_scanning.yml      |   6 +-
 ..._inbound_network_activity_from_process.yml |   3 +-
 ..._anomalous_inbound_outbound_network_io.yml |   3 +-
 ...s_inbound_to_outbound_network_io_ratio.yml |   3 +-
 ...outbound_network_activity_from_process.yml |   3 +-
 ...etes_anomalous_traffic_on_network_edge.yml |   3 +-
 ...es_aws_detect_suspicious_kubectl_calls.yml |   2 +-
 ...rnetes_create_or_update_privileged_pod.yml |   6 +-
 .../cloud/kubernetes_cron_job_creation.yml    |   6 +-
 .../cloud/kubernetes_daemonset_deployed.yml   |   6 +-
 .../cloud/kubernetes_falco_shell_spawned.yml  |   6 +-
 .../cloud/kubernetes_newly_seen_tcp_edge.yml  |   2 +-
 .../cloud/kubernetes_newly_seen_udp_edge.yml  |   2 +-
 .../cloud/kubernetes_nginx_ingress_lfi.yml    |   7 +-
 .../cloud/kubernetes_nginx_ingress_rfi.yml    |   7 +-
 .../cloud/kubernetes_node_port_creation.yml   |   6 +-
 ...netes_pod_created_in_default_namespace.yml |  17 +--
 ...netes_pod_with_host_network_attachment.yml |   6 +-
 ...previously_unseen_container_image_name.yml |   2 +-
 .../kubernetes_previously_unseen_process.yml  |   2 +-
 ...bernetes_process_running_from_new_path.yml |   2 +-
 ...ss_with_anomalous_resource_utilisation.yml |   3 +-
 ..._process_with_resource_ratio_anomalies.yml |   3 +-
 .../kubernetes_scanner_image_pulling.yml      |   6 +-
 ...scanning_by_unauthenticated_ip_address.yml |   6 +-
 ...ubernetes_shell_running_on_worker_node.yml |   2 +-
 ...nning_on_worker_node_with_cpu_activity.yml |   2 +-
 .../kubernetes_suspicious_image_pulling.yml   |  18 +--
 .../cloud/kubernetes_unauthorized_access.yml  |  17 +--
 .../cloud/microsoft_intune_bulk_wipe.yml      |  42 ++----
 ...microsoft_intune_device_health_scripts.yml |  19 +--
 ..._devicemanagementconfigurationpolicies.yml |  32 +----
 ...rosoft_intune_manual_device_management.yml |  21 +--
 .../cloud/microsoft_intune_mobile_apps.yml    |  13 +-
 ...365_add_app_role_assignment_grant_user.yml |  15 +-
 .../cloud/o365_added_service_principal.yml    |  15 +-
 ..._consent_bypassed_by_service_principal.yml |   5 +-
 .../cloud/o365_advanced_audit_disabled.yml    |   5 +-
 ...application_available_to_other_tenants.yml |   7 +-
 ...5_application_registration_owner_added.yml |   5 +-
 ...applicationimpersonation_role_assigned.yml |  14 +-
 .../o365_bec_email_hiding_rule_created.yml    |   8 +-
 ...k_user_consent_for_risky_apps_disabled.yml |   5 +-
 .../cloud/o365_bypass_mfa_via_trusted_ip.yml  |   7 +-
 ...365_compliance_content_search_exported.yml |   6 +-
 ...o365_compliance_content_search_started.yml |   6 +-
 ...concurrent_sessions_from_different_ips.yml |  16 +--
 .../cloud/o365_cross_tenant_access_change.yml |   7 +-
 detections/cloud/o365_disable_mfa.yml         |   6 +-
 detections/cloud/o365_dlp_rule_triggered.yml  |   7 +-
 ...5_elevated_mailbox_permission_assigned.yml |  15 +-
 ...email_access_by_security_administrator.yml |  17 +--
 ...365_email_hard_delete_excessive_volume.yml |   4 +-
 .../o365_email_new_inbox_rule_created.yml     |   4 +-
 ...ssword_and_payroll_compromise_behavior.yml |  16 +--
 ...eive_and_hard_delete_takeover_behavior.yml |  16 +--
 ...mail_reported_by_admin_found_malicious.yml |  19 +--
 ...email_reported_by_user_found_malicious.yml |   6 +-
 .../o365_email_security_feature_changed.yml   |  17 +--
 ..._and_hard_delete_exfiltration_behavior.yml |  17 ++-
 ...nd_and_hard_delete_suspicious_behavior.yml |  15 +-
 ...mail_send_attachments_excessive_volume.yml |  18 +--
 .../o365_email_suspicious_behavior_alert.yml  |   6 +-
 .../o365_email_suspicious_search_behavior.yml |   4 +-
 .../o365_email_transport_rule_changed.yml     |  12 +-
 ...xcessive_authentication_failures_alert.yml |   6 +-
 .../cloud/o365_excessive_sso_logon_errors.yml |  15 +-
 .../o365_exfiltration_via_file_access.yml     |   4 +-
 .../o365_exfiltration_via_file_download.yml   |  13 +-
 ...65_exfiltration_via_file_sync_download.yml |  14 +-
 .../o365_external_guest_user_invited.yml      |   7 +-
 .../o365_external_identity_policy_changed.yml |   7 +-
 ...ed_application_consent_granted_by_user.yml |   5 +-
 ...65_fullaccessasapp_permission_assigned.yml |   5 +-
 ...ber_of_failed_authentications_for_user.yml |   4 +-
 .../o365_high_privilege_role_granted.yml      |   5 +-
 ...ed_application_consent_granted_by_user.yml |   5 +-
 .../o365_mailbox_email_forwarding_enabled.yml |   7 +-
 ...ailbox_folder_read_permission_assigned.yml |   5 +-
 ...mailbox_folder_read_permission_granted.yml |  18 +--
 ...box_inbox_folder_shared_with_all_users.yml |   5 +-
 ...box_read_access_granted_to_application.yml |   5 +-
 ...ti_source_failed_authentications_spike.yml |   2 +-
 ...ds_and_useragents_authentication_spike.yml |   4 +-
 ..._multiple_failed_mfa_requests_for_user.yml |   4 +-
 ...65_multiple_mailboxes_accessed_via_api.yml |   4 +-
 ...le_os_vendors_authenticating_from_user.yml |   4 +-
 ...tiple_service_principals_created_by_sp.yml |   5 +-
 ...ple_service_principals_created_by_user.yml |   5 +-
 ..._users_failing_to_authenticate_from_ip.yml |   4 +-
 ...o365_new_email_forwarding_rule_created.yml |   7 +-
 ...o365_new_email_forwarding_rule_enabled.yml |   7 +-
 .../cloud/o365_new_federated_domain_added.yml |  17 +--
 ...5_new_forwarding_mailflow_rule_created.yml |   7 +-
 .../cloud/o365_new_mfa_method_registered.yml  |   4 +-
 .../o365_oauth_app_mailbox_access_via_ews.yml |   6 +-
 ...oauth_app_mailbox_access_via_graph_api.yml |  16 +--
 ...ivileged_graph_api_permission_assigned.yml |   7 +-
 .../cloud/o365_privileged_role_assigned.yml   |   7 +-
 ...ged_role_assigned_to_service_principal.yml |   7 +-
 detections/cloud/o365_pst_export_alert.yml    |  17 +--
 .../cloud/o365_safe_links_detection.yml       |   6 +-
 ...ecurity_and_compliance_alert_triggered.yml |   6 +-
 ...rvice_principal_new_client_credentials.yml |  16 +--
 ...service_principal_privilege_escalation.yml |  19 +--
 ...repoint_allowed_domains_policy_changed.yml |   7 +-
 .../o365_sharepoint_malware_detection.yml     |  15 +-
 ..._sharepoint_suspicious_search_behavior.yml |   4 +-
 ...o365_tenant_wide_admin_consent_granted.yml |   5 +-
 ...ntelligence_suspicious_email_delivered.yml |  14 +-
 ..._intelligence_suspicious_file_detected.yml |  17 +--
 ..._consent_blocked_for_risky_application.yml |   5 +-
 ...r_consent_denied_for_oauth_application.yml |  14 +-
 .../cloud/o365_zap_activity_detection.yml     |   6 +-
 .../cloud/okta_non_standard_vpn_usage.yml     |   6 +-
 ...isk_rule_for_dev_sec_ops_by_repository.yml |   4 +-
 .../child_processes_of_spoolsv_exe.yml        |  24 +---
 .../circle_ci_disable_security_job.yml        |  14 +-
 .../circle_ci_disable_security_step.yml       |  14 +-
 .../deprecated/detect_html_help_renamed.yml   |  28 +---
 .../deprecated/detect_large_icmp_traffic.yml  |  29 ++--
 .../deprecated/detect_mshta_renamed.yml       |  28 +---
 .../deprecated/detect_renamed_7_zip.yml       |  30 +---
 .../deprecated/detect_renamed_psexec.yml      |  31 +---
 .../deprecated/detect_renamed_rclone.yml      |  30 +---
 .../deprecated/detect_renamed_winrar.yml      |  28 +---
 ...ect_wmi_event_subscription_persistence.yml |  24 ++--
 .../detection_of_tools_built_by_nirsoft.yml   |  20 +--
 .../macos___re_opened_applications.yml        |  11 +-
 ...rmal_service_crash_availability_attack.yml |  21 +--
 ...ssible_model_exfiltration_data_leakage.yml |  17 +--
 .../ollama_possible_rce_via_model_loading.yml |  15 +-
 ..._suspicious_prompt_injection_jailbreak.yml |  17 +--
 .../possible_browser_pass_view_parameter.yml  |  13 +-
 ...ous_microsoft_workflow_compiler_rename.yml |  28 +---
 .../deprecated/suspicious_msbuild_rename.yml  |  28 +---
 ...indows_lolbas_executed_as_renamed_file.yml |  15 +-
 .../windows_nirsoft_advancedrun.yml           |  33 ++---
 ...windows_process_injection_into_notepad.yml |  15 +-
 .../windows_regsvr32_renamed_binary.yml       |  30 ++--
 .../windows_renamed_powershell_execution.yml  |  13 +-
 .../wmi_temporary_event_subscription.yml      |  11 +-
 detections/deprecated/xmrig_driver_loaded.yml |  17 +--
 .../7zip_commandline_to_smb_share_path.yml    |   3 +-
 .../access_lsass_memory_for_dump_creation.yml |  20 +--
 ..._directory_lateral_movement_identified.yml |   4 +-
 ...ectory_privilege_escalation_identified.yml |   4 +-
 .../active_setup_registry_autostart.yml       |   5 +-
 ...d_defaultuser_and_password_in_registry.yml |   5 +-
 .../add_or_set_windows_defender_exclusion.yml |  52 +++----
 .../adsisearcher_account_discovery.yml        |  16 +--
 .../advanced_ip_or_port_scanner_execution.yml |  51 +++----
 ..._file_and_printing_sharing_in_firewall.yml |  21 +--
 ...ound_traffic_by_firewall_rule_registry.yml |   5 +-
 ...allow_inbound_traffic_in_firewall_rule.yml |  16 +--
 .../allow_network_discovery_in_firewall.yml   |  18 +--
 .../allow_operation_with_consent_admin.yml    |   5 +-
 .../endpoint/anomalous_usage_of_7zip.yml      |  18 +--
 .../endpoint/attacker_tools_on_endpoint.yml   |  11 +-
 .../auto_admin_logon_registry_entry.yml       |   5 +-
 .../endpoint/batch_file_write_to_system32.yml |  49 ++-----
 ...dedit_command_back_to_normal_mode_boot.yml |  18 +--
 .../bcdedit_failure_recovery_modification.yml |  18 +--
 detections/endpoint/bits_job_persistence.yml  |  18 +--
 .../endpoint/bitsadmin_download_file.yml      |  18 +--
 .../certutil_exe_certificate_extraction.yml   |  44 ++----
 .../certutil_with_decode_argument.yml         |  18 +--
 ...hange_to_safe_mode_with_network_config.yml |  18 +--
 .../check_elevated_cmd_using_whoami.yml       |  18 +--
 ...ent___access_to_cloud_metadata_service.yml |  13 +-
 .../cisco_isovalent___cron_job_creation.yml   |  13 +-
 ...t___curl_execution_with_insecure_flags.yml |   2 +-
 .../cisco_isovalent___kprobe_spike.yml        |  23 +--
 ...sco_isovalent___late_process_execution.yml |  21 +--
 ..._isovalent___non_allowlisted_image_use.yml |  29 ++--
 ...lent___nsenter_usage_in_kubernetes_pod.yml |  20 +--
 ...ovalent___pods_running_offensive_tools.yml |   2 +-
 ...o_isovalent___potential_escape_to_host.yml |  21 +--
 .../cisco_isovalent___shell_execution.yml     |   5 +-
 ...ed_unix_shell_with_external_connection.yml |  68 ++-------
 ...m___curl_execution_with_insecure_flags.yml |  28 ++--
 ...llation_of_typosquatted_python_package.yml |  23 +--
 ...a_network_execution_without_url_in_cli.yml |  60 +++-----
 ...twork_binary_making_network_connection.yml |  61 +++-----
 ...network_connection_for_a_long_duration.yml |  23 +--
 ...outbound_connection_to_suspicious_port.yml |  27 ++--
 ...rclone_execution_with_network_activity.yml |  62 +++-----
 ...use_of_mshtml_dll_for_payload_download.yml |  49 +++----
 ...om_archive_triggering_network_activity.yml |  53 +++----
 ...ous_download_from_file_sharing_website.yml |  71 +++------
 ...ous_file_download_via_headless_browser.yml |  27 ++--
 ...k_connection_from_process_with_no_args.yml |  63 +++-----
 ...network_connection_initiated_via_msxsl.yml |  57 +++-----
 ...rk_connection_to_ip_lookup_service_api.yml |  66 +++------
 ...ver_download_from_file_sharing_website.yml |  60 +++-----
 ...ar_unallocated_sector_using_cipher_app.yml |  18 +--
 .../endpoint/clop_common_exec_parameter.yml   |  20 +--
 .../clop_ransomware_known_service_name.yml    |  13 +-
 ...cmd_carry_out_string_command_parameter.yml |  18 +--
 .../endpoint/cmd_echo_pipe___escalation.yml   |  22 +--
 .../endpoint/cmlua_or_cmstplua_uac_bypass.yml |   5 +-
 .../endpoint/common_ransomware_extensions.yml |   9 +-
 .../endpoint/common_ransomware_notes.yml      |  17 ++-
 ...nnectwise_screenconnect_path_traversal.yml |   5 +-
 ...eenconnect_path_traversal_windows_sacl.yml |   7 +-
 .../endpoint/conti_common_exec_parameter.yml  |  18 +--
 ..._loading_from_world_writable_directory.yml |   5 +-
 ...or_delete_windows_shares_using_net_exe.yml |  19 +--
 ...ate_remote_thread_in_shell_application.yml |  32 ++---
 .../create_remote_thread_into_lsass.yml       |  28 ++--
 .../creation_of_lsass_dump_with_taskmgr.yml   |  27 +---
 .../endpoint/creation_of_shadow_copy.yml      |  21 +--
 ...f_shadow_copy_with_wmic_and_powershell.yml |  20 +--
 ...ping_via_copy_command_from_shadow_copy.yml |   5 +-
 ...ial_dumping_via_symlink_to_shadow_copy.yml |  18 +--
 ...crowdstrike_admin_weak_password_policy.yml |   6 +-
 ...wdstrike_admin_with_duplicate_password.yml |   6 +-
 .../crowdstrike_falcon_stream_alerts.yml      |   4 +-
 ...rowdstrike_high_identity_risk_severity.yml |   6 +-
 ...wdstrike_medium_identity_risk_severity.yml |   6 +-
 .../crowdstrike_medium_severity_alert.yml     |   6 +-
 ...owdstrike_multiple_low_severity_alerts.yml |   6 +-
 ...rivilege_escalation_for_non_admin_user.yml |   6 +-
 .../crowdstrike_user_weak_password_policy.yml |   6 +-
 ...owdstrike_user_with_duplicate_password.yml |   6 +-
 .../csc_net_on_the_fly_compilation.yml        |  21 +--
 ...url_execution_with_percent_encoded_url.yml |  29 ++--
 .../delete_shadowcopy_with_powershell.yml     |  16 +--
 .../endpoint/deleting_shadow_copies.yml       |  23 +--
 ...tect_azurehound_command_line_arguments.yml |  18 +--
 .../detect_azurehound_file_modifications.yml  |  16 +--
 .../detect_baron_samedit_cve_2021_3156.yml    |   2 +-
 ...t_baron_samedit_cve_2021_3156_segfault.yml |   2 +-
 ...aron_samedit_cve_2021_3156_via_osquery.yml |   3 +-
 .../detect_certify_command_line_arguments.yml |  22 +--
 ...y_with_powershell_script_block_logging.yml |   4 +-
 .../detect_certipy_file_modifications.yml     |  16 +--
 ...omputer_changed_with_anonymous_account.yml |  29 ++--
 ...f_shadowcopy_with_script_block_logging.yml |   5 +-
 ...redential_dumping_through_lsass_access.yml |  10 +-
 ...e_with_powershell_script_block_logging.yml |  16 +--
 ...cessive_account_lockouts_from_endpoint.yml |   4 +-
 ...detect_excessive_user_account_lockouts.yml |   4 +-
 .../endpoint/detect_exchange_web_shell.yml    |   5 +-
 .../detect_html_help_url_in_command_line.yml  |  18 +--
 ...l_help_using_infotech_storage_handlers.yml |  18 +--
 ...z_with_powershell_script_block_logging.yml |  16 +--
 .../detect_mshta_inline_hta_execution.yml     |  21 +--
 .../detect_mshta_url_in_command_line.yml      |  20 +--
 .../detect_new_local_admin_account.yml        |   2 +-
 .../detect_outlook_exe_writing_a_zip_file.yml |  18 ++-
 ...word_spray_attack_behavior_from_source.yml |   4 +-
 ...password_spray_attack_behavior_on_user.yml |   4 +-
 ...nterception_by_creation_of_program_exe.yml |   5 +-
 .../detect_psexec_with_accepteula_flag.yml    |  23 +--
 .../endpoint/detect_rare_executables.yml      |  51 ++-----
 .../detect_rclone_command_line_usage.yml      |  37 ++---
 .../detect_regasm_spawning_a_process.yml      |  18 +--
 .../detect_regasm_with_network_connection.yml |  20 +--
 ..._regasm_with_no_command_line_arguments.yml |  16 +--
 .../detect_regsvcs_spawning_a_process.yml     |  18 +--
 ...detect_regsvcs_with_network_connection.yml |  20 +--
 ...regsvcs_with_no_command_line_arguments.yml |  16 +--
 ...ct_regsvr32_application_control_bypass.yml |  18 +--
 ...tect_remote_access_software_usage_file.yml |  13 +-
 ..._remote_access_software_usage_fileinfo.yml |   4 +-
 ...t_remote_access_software_usage_process.yml |   2 +-
 ..._remote_access_software_usage_registry.yml |   5 +-
 .../endpoint/detect_rtlo_in_file_name.yml     |  25 ++--
 .../endpoint/detect_rtlo_in_process.yml       |   5 +-
 .../detect_rundll32_inline_hta_execution.yml  |  20 +--
 ...tect_sharphound_command_line_arguments.yml |  18 +--
 .../detect_sharphound_file_modifications.yml  |  16 +--
 .../endpoint/detect_sharphound_usage.yml      |  22 +--
 ..._cmd_exe_to_launch_script_interpreters.yml |  50 ++-----
 .../disable_amsi_through_registry.yml         |   5 +-
 .../disable_defender_antivirus_registry.yml   |  15 +-
 ...able_defender_blockatfirstseen_feature.yml |   5 +-
 ...disable_defender_enhanced_notification.yml |   5 +-
 .../disable_defender_mpengine_registry.yml    |   5 +-
 .../disable_defender_spynet_reporting.yml     |   5 +-
 ...efender_submit_samples_consent_feature.yml |  15 +-
 .../endpoint/disable_etw_through_registry.yml |   5 +-
 .../endpoint/disable_logs_using_wevtutil.yml  |  22 +--
 detections/endpoint/disable_registry_tool.yml |   5 +-
 detections/endpoint/disable_schedule_task.yml |  18 +--
 ...le_security_logs_using_minint_registry.yml |   5 +-
 .../endpoint/disable_show_hidden_files.yml    |   5 +-
 .../disable_uac_remote_restriction.yml        |   5 +-
 .../endpoint/disable_windows_app_hotkeys.yml  |   5 +-
 .../disable_windows_behavior_monitoring.yml   |  20 +--
 ...disable_windows_smartscreen_protection.yml |  12 +-
 ...thentication_discovery_with_get_aduser.yml |  16 +--
 ...uthentication_discovery_with_powerview.yml |  16 +--
 .../endpoint/disabling_cmd_application.yml    |   5 +-
 .../endpoint/disabling_controlpanel.yml       |   5 +-
 .../endpoint/disabling_defender_services.yml  |   5 +-
 .../disabling_firewall_with_netsh.yml         |  20 +--
 ...isabling_folderoptions_windows_feature.yml |   5 +-
 .../endpoint/disabling_norun_windows_app.yml  |   5 +-
 .../disabling_remote_user_account_control.yml |   5 +-
 .../disabling_systemrestore_in_registry.yml   |   5 +-
 .../endpoint/disabling_task_manager.yml       |   5 +-
 ...curity_authority_defences_via_registry.yml |   5 +-
 ...no_command_line_arguments_with_network.yml |  33 +++--
 .../dns_exfiltration_using_nslookup_app.yml   |  26 +---
 .../domain_account_discovery_with_dsquery.yml |  20 +--
 .../domain_account_discovery_with_wmic.yml    |   5 +-
 ...omain_controller_discovery_with_nltest.yml |  23 +--
 .../domain_controller_discovery_with_wmic.yml |  19 +--
 ...main_group_discovery_with_adsisearcher.yml |  16 +--
 .../domain_group_discovery_with_dsquery.yml   |  21 +--
 .../domain_group_discovery_with_wmic.yml      |   3 +-
 .../download_files_using_telegram.yml         |  16 +--
 .../endpoint/drop_icedid_license_dat.yml      |   3 +-
 .../endpoint/dsquery_domain_discovery.yml     |  18 +--
 .../endpoint/dump_lsass_via_comsvcs_dll.yml   |  18 +--
 .../endpoint/dump_lsass_via_procdump.yml      |  65 +++------
 ...levated_group_discovery_with_powerview.yml |  14 +-
 .../elevated_group_discovery_with_wmic.yml    |   5 +-
 .../enable_rdp_in_other_port_number.yml       |   5 +-
 ...le_wdigest_uselogoncredential_registry.yml |   5 +-
 ...erate_users_local_group_using_telegram.yml |   5 +-
 detections/endpoint/esentutl_sam_copy.yml     |  15 +-
 detections/endpoint/etw_registry_disabled.yml |   5 +-
 detections/endpoint/eventvwr_uac_bypass.yml   |   5 +-
 .../excessive_attempt_to_disable_services.yml |  18 +--
 ...e_distinct_processes_from_windows_temp.yml |   5 +-
 ...ve_file_deletion_in_windefender_folder.yml |   5 +-
 ...r_of_service_control_start_as_disabled.yml |  17 +--
 ...excessive_number_of_taskhost_processes.yml |  22 +--
 .../endpoint/excessive_usage_of_cacls_app.yml |  58 +++-----
 .../excessive_usage_of_nslookup_app.yml       |   4 +-
 .../excessive_usage_of_sc_service_utility.yml |   4 +-
 .../endpoint/excessive_usage_of_taskkill.yml  |  14 +-
 .../exchange_powershell_abuse_via_ssrf.yml    |   2 +-
 .../exchange_powershell_module_usage.yml      |  16 +--
 ...le_written_in_administrative_smb_share.yml |  45 ++----
 ..._or_script_creation_in_suspicious_path.yml |  45 +-----
 ...tables_or_script_creation_in_temp_path.yml |  48 +------
 ...cute_javascript_with_jscript_com_clsid.yml |  18 +--
 ...ution_of_file_with_multiple_extensions.yml |  18 +--
 ...ile_download_or_read_to_pipe_execution.yml |  26 ++--
 .../endpoint/file_with_samsam_extension.yml   |  14 +-
 .../firewall_allowed_program_enable.yml       |  18 +--
 .../first_time_seen_child_process_of_zoom.yml |   2 +-
 ...irst_time_seen_running_windows_service.yml |   2 +-
 detections/endpoint/fodhelper_uac_bypass.yml  |  18 +--
 detections/endpoint/fsutil_zeroing_file.yml   |  18 +--
 ...ltdomainpasswordpolicy_with_powershell.yml |  40 ++----
 ...ordpolicy_with_powershell_script_block.yml |  14 +-
 .../endpoint/get_aduser_with_powershell.yml   |  21 +--
 ...et_aduser_with_powershell_script_block.yml |  14 +-
 ...esultantpasswordpolicy_with_powershell.yml |  23 +--
 ...ordpolicy_with_powershell_script_block.yml |  16 +--
 .../get_domainpolicy_with_powershell.yml      |  23 +--
 ...ainpolicy_with_powershell_script_block.yml |  16 +--
 .../get_domaintrust_with_powershell.yml       |  18 +--
 ...maintrust_with_powershell_script_block.yml |  16 +--
 .../get_domainuser_with_powershell.yml        |  23 +--
 ...omainuser_with_powershell_script_block.yml |  16 +--
 .../get_foresttrust_with_powershell.yml       |  20 +--
 ...resttrust_with_powershell_script_block.yml |  16 +--
 .../get_wmiobject_group_discovery.yml         |  21 +--
 ...up_discovery_with_script_block_logging.yml |  14 +-
 .../getadcomputer_with_powershell.yml         |  19 +--
 ...dcomputer_with_powershell_script_block.yml |  13 +-
 .../endpoint/getadgroup_with_powershell.yml   |  19 +--
 ...etadgroup_with_powershell_script_block.yml |  14 +-
 .../getcurrent_user_with_powershell.yml       |   2 +-
 ...rent_user_with_powershell_script_block.yml |  14 +-
 .../getdomaincomputer_with_powershell.yml     |  21 +--
 ...ncomputer_with_powershell_script_block.yml |  16 +--
 .../getdomaincontroller_with_powershell.yml   |  19 +--
 ...ontroller_with_powershell_script_block.yml |  15 +-
 .../getdomaingroup_with_powershell.yml        |  21 +--
 ...maingroup_with_powershell_script_block.yml |  16 +--
 .../endpoint/getlocaluser_with_powershell.yml |  19 +--
 ...localuser_with_powershell_script_block.yml |  14 +-
 .../getnettcpconnection_with_powershell.yml   |  19 +--
 ...onnection_with_powershell_script_block.yml |  14 +-
 ...twmiobject_ds_computer_with_powershell.yml |  51 ++-----
 ..._computer_with_powershell_script_block.yml |   5 +-
 .../getwmiobject_ds_group_with_powershell.yml |  51 ++-----
 ..._ds_group_with_powershell_script_block.yml |   5 +-
 .../getwmiobject_ds_user_with_powershell.yml  |  50 ++-----
 ...t_ds_user_with_powershell_script_block.yml |   5 +-
 ...wmiobject_user_account_with_powershell.yml |  19 +--
 ...r_account_with_powershell_script_block.yml |  14 +-
 ...workflow_file_creation_or_modification.yml |  44 +++---
 ...no_command_line_arguments_with_network.yml |   4 +-
 ...dless_browser_mockbin_or_mocky_request.yml |  26 +---
 .../endpoint/headless_browser_usage.yml       |   7 +-
 .../hide_user_account_from_sign_in_screen.yml |   5 +-
 ..._files_and_directories_with_attrib_exe.yml |  18 +--
 ...equency_copy_of_files_in_network_share.yml |  18 +--
 .../high_process_termination_frequency.yml    |   4 +-
 .../hunting_3cxdesktopapp_software.yml        |  18 +--
 detections/endpoint/icacls_deny_command.yml   |  52 +++----
 detections/endpoint/icacls_grant_command.yml  |  41 +++---
 ...did_exfiltrated_archived_file_creation.yml |   3 +-
 ...ateral_movement_commandline_parameters.yml |   5 +-
 ...ovement_smbexec_commandline_parameters.yml |   5 +-
 ...ovement_wmiexec_commandline_parameters.yml |   5 +-
 ...ion_on_remote_endpoint_with_powershell.yml |  16 +--
 detections/endpoint/java_writing_jsp_file.yml |   4 +-
 .../jscript_execution_using_cscript_app.yml   |  53 ++-----
 ...asting_spn_request_with_rc4_encryption.yml |  13 +-
 ...on_flag_disabled_in_useraccountcontrol.yml |  10 +-
 ...tication_flag_disabled_with_powershell.yml |  16 +--
 ...ce_ticket_request_using_rc4_encryption.yml |  12 +-
 ...beros_tgt_request_using_rc4_encryption.yml |  11 +-
 .../endpoint/kerberos_user_enumeration.yml    |   4 +-
 ...nt_manipulation_of_ssh_config_and_keys.yml |  18 +--
 ...add_files_in_known_crontab_directories.yml |  16 +--
 .../endpoint/linux_add_user_account.yml       |  18 +--
 .../linux_apparmor_bypass_via_aaexec.yml      |  21 +--
 .../linux_apt_privilege_escalation.yml        |   5 +-
 .../linux_at_allow_config_file_creation.yml   |  16 +--
 .../linux_at_application_execution.yml        |  20 +--
 .../linux_auditd_add_user_account.yml         |  12 +-
 .../linux_auditd_add_user_account_type.yml    |   4 +-
 ...d_ai_cli_permission_override_activated.yml |  20 ++-
 .../linux_auditd_at_application_execution.yml |  14 +-
 .../linux_auditd_auditd_daemon_abort.yml      |   4 +-
 .../linux_auditd_auditd_daemon_shutdown.yml   |   4 +-
 .../linux_auditd_auditd_daemon_start.yml      |   4 +-
 .../linux_auditd_auditd_service_stop.yml      |  13 +-
 .../linux_auditd_base64_decode_files.yml      |  14 +-
 ...linux_auditd_change_file_owner_to_root.yml |  12 +-
 .../linux_auditd_clipboard_data_copy.yml      |  14 +-
 ..._auditd_copy_fail_privilege_escalation.yml |  88 ++----------
 .../linux_auditd_data_destruction_command.yml |  14 +-
 ...td_data_transfer_size_limits_via_split.yml |  14 +-
 ...transfer_size_limits_via_split_syscall.yml |  14 +-
 ..._database_file_and_directory_discovery.yml |  14 +-
 .../linux_auditd_dd_file_overwrite.yml        |  12 +-
 ...ditd_disable_or_modify_system_firewall.yml |  13 +-
 .../linux_auditd_doas_conf_file_creation.yml  |  29 ++--
 .../linux_auditd_doas_tool_execution.yml      |  14 +-
 ...linux_auditd_edit_cron_table_parameter.yml |  14 +-
 ...ux_auditd_file_and_directory_discovery.yml |  14 +-
 ...file_permission_modification_via_chmod.yml |   5 +-
 ...le_permissions_modification_via_chattr.yml |  12 +-
 ...ind_credentials_from_password_managers.yml |  14 +-
 ..._find_credentials_from_password_stores.yml |  14 +-
 .../linux_auditd_find_ssh_private_keys.yml    |  14 +-
 ...linux_auditd_hardware_addition_swapoff.yml |  12 +-
 ..._hidden_files_and_directories_creation.yml |  14 +-
 ...ert_kernel_module_using_insmod_utility.yml |  14 +-
 ...l_kernel_module_using_modprobe_utility.yml |  14 +-
 ...linux_auditd_kernel_module_enumeration.yml |  14 +-
 ...ditd_kernel_module_using_rmmod_utility.yml |  14 +-
 ..._auditd_nopasswd_entry_in_sudoers_file.yml |  12 +-
 .../linux_auditd_osquery_service_stop.yml     |  13 +-
 ...ss_or_modification_of_sshd_config_file.yml |  30 ++--
 ...td_possible_access_to_credential_files.yml |   3 +-
 ...auditd_possible_access_to_sudoers_file.yml |  30 ++--
 ...cronjob_entry_on_existing_cronjob_file.yml |  28 ++--
 ..._auditd_possible_setuid_execve_privesc.yml |  29 +---
 ...ux_auditd_preload_hijack_library_calls.yml |  14 +-
 ...auditd_preload_hijack_via_preload_file.yml |  29 ++--
 ...ivate_keys_and_certificate_enumeration.yml |  14 +-
 .../linux_auditd_service_restarted.yml        |  12 +-
 .../endpoint/linux_auditd_service_started.yml |  12 +-
 ...inux_auditd_setuid_using_chmod_utility.yml |  12 +-
 ...nux_auditd_setuid_using_setcap_utility.yml |  14 +-
 .../linux_auditd_shred_overwrite_command.yml  |  12 +-
 .../endpoint/linux_auditd_stop_services.yml   |   4 +-
 .../linux_auditd_sudo_or_su_execution.yml     |  12 +-
 .../linux_auditd_sysmon_service_stop.yml      |  13 +-
 ...system_network_configuration_discovery.yml |   4 +-
 ..._unix_shell_configuration_modification.yml |  30 ++--
 ...inux_auditd_unload_module_via_modprobe.yml |  14 +-
 ...tual_disk_file_and_directory_discovery.yml |  14 +-
 .../linux_auditd_whoami_user_discovery.yml    |  14 +-
 .../linux_awk_privilege_escalation.yml        |  22 +--
 ..._executed_from_shared_memory_directory.yml |  38 +----
 ...binary_launched_process_with_null_argv.yml |   5 +-
 .../linux_busybox_privilege_escalation.yml    |  22 +--
 .../linux_c89_privilege_escalation.yml        |  22 +--
 .../linux_c99_privilege_escalation.yml        |  22 +--
 .../linux_change_file_owner_to_root.yml       |  23 +--
 .../endpoint/linux_clipboard_data_copy.yml    |  18 +--
 ...x_common_process_for_elevation_control.yml |  18 +--
 .../linux_composer_privilege_escalation.yml   |  22 +--
 .../linux_cpulimit_privilege_escalation.yml   |  24 +---
 .../endpoint/linux_crontab_enumeration.yml    |  37 ++---
 .../linux_csvtool_privilege_escalation.yml    |  22 +--
 .../endpoint/linux_curl_upload_file.yml       |   4 +-
 .../linux_data_destruction_command.yml        |  45 +++---
 .../endpoint/linux_dd_file_overwrite.yml      |  20 +--
 .../endpoint/linux_decode_base64_to_shell.yml |   4 +-
 ...ng_critical_directory_using_rm_command.yml |  22 +--
 .../endpoint/linux_deletion_of_cron_jobs.yml  |  16 +--
 .../linux_deletion_of_init_daemon_script.yml  |  16 +--
 .../endpoint/linux_deletion_of_services.yml   |  16 +--
 .../linux_deletion_of_ssl_certificate.yml     |  16 +--
 ...dirty_frag_kernel_privilege_escalation.yml |  42 ++++--
 .../endpoint/linux_disable_services.yml       |  18 +--
 .../linux_doas_conf_file_creation.yml         |  16 +--
 .../endpoint/linux_doas_tool_execution.yml    |  18 +--
 .../linux_docker_root_directory_mount.yml     |  37 ++---
 .../endpoint/linux_docker_shell_execution.yml |  61 +++-----
 .../linux_edit_cron_table_parameter.yml       |  16 +--
 .../linux_efi_bootloader_file_deletion.yml    |  31 +---
 .../linux_emacs_privilege_escalation.yml      |  22 +--
 ...ile_created_in_kernel_driver_directory.yml |  16 +--
 ...x_file_creation_in_init_boot_directory.yml |  41 ++----
 ...nux_file_creation_in_profile_directory.yml |  16 +--
 ...creation_in_system_generator_directory.yml |  34 ++---
 .../linux_find_privilege_escalation.yml       |  22 +--
 .../linux_gdb_privilege_escalation.yml        |  24 +---
 .../endpoint/linux_gdrive_binary_activity.yml |  20 +--
 .../linux_gem_privilege_escalation.yml        |  22 +--
 .../linux_ghostscript_exploitation.yml        |  43 ++----
 .../linux_gnu_awk_privilege_escalation.yml    |  21 +--
 .../linux_hardware_addition_swapoff.yml       |  17 +--
 ...quency_of_file_deletion_in_boot_folder.yml |  14 +-
 ...equency_of_file_deletion_in_etc_folder.yml |  14 +-
 .../linux_impair_defenses_process_kill.yml    |  15 +-
 .../linux_indicator_removal_clear_cache.yml   |  21 +--
 ...ndicator_removal_service_file_deletion.yml |  21 +--
 .../linux_ingress_tool_transfer_hunting.yml   |  20 +--
 .../linux_ingress_tool_transfer_with_curl.yml |  25 +---
 ...ert_kernel_module_using_insmod_utility.yml |  20 +--
 ...l_kernel_module_using_modprobe_utility.yml |  20 +--
 .../linux_iptables_firewall_modification.yml  |   4 +-
 .../linux_kernel_module_enumeration.yml       |  18 +--
 ...orker_process_in_writable_process_path.yml |  16 +--
 .../endpoint/linux_magic_sysrq_key_abuse.yml  |  25 ++--
 .../linux_make_privilege_escalation.yml       |  22 +--
 .../endpoint/linux_malformed_auth_entry.yml   |  15 +-
 detections/endpoint/linux_medusa_rootkit.yml  |  16 +--
 .../endpoint/linux_motd_script_added.yml      |  36 ++---
 .../linux_mysql_privilege_escalation.yml      |  22 +--
 .../linux_netcat_outbound_connection.yml      |  19 +--
 .../linux_ngrok_reverse_proxy_usage.yml       |  18 +--
 .../linux_node_privilege_escalation.yml       |  24 +---
 .../linux_nopasswd_entry_in_sudoers_file.yml  |  18 +--
 ...ted_files_or_information_base64_decode.yml |  18 +--
 .../linux_octave_privilege_escalation.yml     |  24 +---
 .../linux_openvpn_privilege_escalation.yml    |  26 +---
 .../linux_pedit_offset_out_of_bounds.yml      |  11 +-
 ...and_privilege_escalation_risk_behavior.yml |   4 +-
 ...lg_registration_outside_of_boot_window.yml |   8 +-
 .../linux_php_privilege_escalation.yml        |  22 +--
 .../linux_pkexec_privilege_escalation.yml     |   4 +-
 ...ss_or_modification_of_sshd_config_file.yml |  20 +--
 ...ux_possible_access_to_credential_files.yml |  20 +--
 .../linux_possible_access_to_sudoers_file.yml |  20 +--
 ...append_command_to_at_allow_config_file.yml |  20 +--
 ..._append_command_to_profile_config_file.yml |  55 ++-----
 ...cronjob_entry_on_existing_cronjob_file.yml |  18 +--
 ...linux_possible_bootloader_modification.yml |  53 ++-----
 ...sible_cronjob_modification_with_editor.yml |  21 +--
 ...inux_possible_gsm_privilege_escalation.yml |  39 +----
 ...ossible_nimbuspwn_privilege_escalation.yml |  32 +----
 ...le_privilege_escalation_via_pythonpath.yml |  41 ++----
 .../linux_possible_ssh_key_file_creation.yml  |  16 +--
 .../linux_possible_system_binary_backdoor.yml |  41 ++----
 .../linux_preload_hijack_library_calls.yml    |  18 +--
 .../endpoint/linux_proxy_socks_curl.yml       |  41 ++----
 .../linux_puppet_privilege_escalation.yml     |  26 +---
 .../endpoint/linux_root_execution_of_id.yml   |  39 ++---
 .../linux_rpm_privilege_escalation.yml        |  22 +--
 .../linux_ruby_privilege_escalation.yml       |  22 +--
 ...vice_file_created_in_systemd_directory.yml |  16 +--
 .../endpoint/linux_service_restarted.yml      |  23 +--
 .../linux_service_started_or_enabled.yml      |  23 +--
 .../linux_setuid_using_chmod_utility.yml      |  23 +--
 .../linux_setuid_using_setcap_utility.yml     |  23 +--
 ...istory_access_via_command_line_utility.yml |  58 ++------
 ...inux_shell_pseudo_device_reverse_shell.yml |  47 ++----
 .../linux_shred_overwrite_command.yml         |  20 +--
 .../linux_sqlite3_privilege_escalation.yml    |  22 +--
 ...linux_ssh_authorized_keys_modification.yml |  18 +--
 ...nux_ssh_remote_services_script_execute.yml |  20 +--
 ...ux_stdout_redirection_to_dev_null_file.yml |  18 +--
 detections/endpoint/linux_stop_services.yml   |  18 +--
 .../endpoint/linux_sudo_or_su_execution.yml   |  18 +--
 .../linux_sudoers_tmp_file_creation.yml       |  16 +--
 ...suspicious_child_process_of_postgresql.yml |  53 ++-----
 ...picious_docker_build_command_execution.yml |  44 ++----
 ...invocation_building_init_shared_object.yml |  42 +-----
 .../linux_suspicious_namespace_creation.yml   |   5 +-
 ...picious_privileged_container_execution.yml |  38 ++---
 ...picious_react_or_next_js_child_process.yml | 114 +++------------
 .../linux_suspicious_redis_activity.yml       |  48 +------
 ...ious_staging_of_alternate_system_files.yml |  46 ++----
 .../linux_suspicious_xdg_autostart.yml        |  39 ++---
 .../linux_system_network_discovery.yml        |  65 ++-------
 ...x_system_reboot_via_system_request_key.yml |  17 +--
 .../linux_telnet_authentication_bypass.yml    |  18 +--
 .../endpoint/linux_udev_rule_created.yml      |  34 +----
 ..._unix_shell_enable_all_sysrq_functions.yml |  17 +--
 .../endpoint/linux_usermod_root_uid_set.yml   |  20 +--
 .../linux_visudo_utility_execution.yml        |  18 +--
 .../living_off_the_land_detection.yml         |   4 +-
 .../endpoint/llm_model_file_creation.yml      |  61 ++------
 .../endpoint/loading_of_dynwrapx_module.yml   |   5 +-
 .../local_account_discovery_with_wmic.yml     |  16 +--
 .../local_llm_framework_dns_query.yml         |  77 +---------
 .../log4shell_cve_2021_44228_exploitation.yml |   4 +-
 .../logon_script_event_trigger_execution.yml  |   5 +-
 ...as_network_connection_on_uncommon_port.yml |  22 +--
 .../lolbas_rare_network_connection.yml        |  25 ++--
 detections/endpoint/macos_account_created.yml |  20 +--
 ...ealer___virtual_machine_check_activity.yml |  41 +-----
 ...script_shell_execution_and_compilation.yml |  23 +--
 detections/endpoint/macos_data_chunking.yml   |  20 +--
 .../endpoint/macos_gatekeeper_bypass.yml      |  19 ++-
 .../macos_hidden_files_and_directories.yml    |  20 +--
 detections/endpoint/macos_kextload_usage.yml  |  19 ++-
 .../endpoint/macos_keychains_dumped.yml       |  21 +--
 .../endpoint/macos_list_firewall_rules.yml    |  17 +--
 detections/endpoint/macos_log_removal.yml     |  19 ++-
 .../endpoint/macos_loginhook_persistence.yml  |  19 ++-
 detections/endpoint/macos_lolbin.yml          |   3 +-
 .../macos_network_share_discovery.yml         |  16 +--
 ...ript_displaying_suspicious_user_prompt.yml |  20 +--
 ..._osascript_executing_interactive_shell.yml |  23 +--
 ...pt_executing_javascript_code_with_objc.yml |  21 +--
 detections/endpoint/macos_plutil.yml          |   3 +-
 .../endpoint/mailsniper_invoke_functions.yml  |  16 +--
 .../malicious_inprocserver32_modification.yml |   5 +-
 ...cious_powershell_executed_as_a_service.yml |   4 +-
 ...s_powershell_process___encoded_command.yml |  40 ++----
 ...hell_process___execution_policy_bypass.yml |  20 +--
 ...ll_process_with_obfuscation_techniques.yml |   5 +-
 .../microsoft_defender_atp_alerts.yml         |   3 +-
 .../microsoft_defender_incident_alerts.yml    |   3 +-
 ...z_passtheticket_commandline_parameters.yml |  22 +--
 .../mmc_lolbas_execution_process_spawn.yml    |  25 +---
 .../endpoint/modification_of_wallpaper.yml    |   5 +-
 ...dify_acl_permission_to_files_or_folder.yml |  34 ++---
 ...nitor_registry_keys_for_print_monitors.yml |   5 +-
 ...oveit_certificate_store_access_failure.yml |   4 +-
 ...key_fingerprint_authentication_attempt.yml |   4 +-
 ...on_service_writing_active_server_pages.yml |   3 +-
 ..._scripting_process_loading_ldap_module.yml |   5 +-
 ...s_scripting_process_loading_wmi_module.yml |   5 +-
 ...d_suspicious_spawned_by_script_process.yml |  20 +--
 ..._spawning_rundll32_or_regsvr32_process.yml |  20 +--
 ...msi_module_loaded_by_non_system_binary.yml |   3 +-
 .../msmpeng_application_dll_side_loading.yml  |   5 +-
 .../endpoint/net_profiler_uac_bypass.yml      |   5 +-
 .../network_connection_discovery_with_arp.yml |  35 +----
 ...work_connection_discovery_with_netstat.yml |  19 +--
 ...work_discovery_using_route_windows_app.yml |  13 +-
 ...etwork_share_discovery_via_dir_command.yml |  18 +--
 ...active_directory_web_services_protocol.yml |   2 +-
 .../endpoint/nishang_powershelltcponeline.yml |  20 +--
 .../nltest_domain_trust_discovery.yml         |  23 +--
 ...e_process_accessing_chrome_default_dir.yml |   5 +-
 ...fox_process_access_firefox_profile_dir.yml |   5 +-
 ...notepad_with_no_command_line_arguments.yml |   4 +-
 detections/endpoint/ntdsutil_export_ntds.yml  |  20 +--
 ...nnection_from_java_using_default_ports.yml |  20 +--
 .../overwriting_accessibility_binaries.yml    |   5 +-
 ...ercut_ng_suspicious_behavior_debug_log.yml |   2 +-
 ...mission_modification_using_takeown_app.yml |  18 +--
 ...etitpotam_network_share_access_request.yml |  12 +-
 ...tpotam_suspicious_kerberos_tgt_request.yml |  26 +---
 .../endpoint/ping_sleep_batch_command.yml     |  82 +++--------
 ...ible_lateral_movement_powershell_spawn.yml |  18 +--
 .../potential_password_in_username.yml        |   2 +-
 ...twork_configuration_discovery_activity.yml |   2 +-
 ...l_telegram_api_request_via_commandline.yml |  18 +--
 .../endpoint/powershell_4104_hunting.yml      | 116 ++-------------
 ..._hijacking_inprocserver32_modification.yml |   5 +-
 .../powershell_creating_thread_mutex.yml      |  16 +--
 ...l_defender_threat_actions_set_to_allow.yml |  30 +---
 ...powershell_disable_security_monitoring.yml |  86 +++--------
 .../powershell_domain_enumeration.yml         |  33 ++---
 .../powershell_enable_powershell_remoting.yml |  16 +--
 ...powershell_enable_smb1protocol_feature.yml |  16 +--
 ...ershell_environment_variable_execution.yml |  10 +-
 .../powershell_execute_com_object.yml         |  16 +--
 ...s_process_injection_via_getprocaddress.yml |  16 +--
 ...script_contains_base64_encoded_content.yml |   3 +-
 .../powershell_get_localgroup_discovery.yml   |  21 +--
 ...up_discovery_with_script_block_logging.yml |  14 +-
 ...powershell_invoke_cimmethod_cimsession.yml |  16 +--
 .../powershell_invoke_wmiexec_usage.yml       |  16 +--
 .../powershell_load_module_in_meterpreter.yml |  16 +--
 ...ding_dotnet_into_memory_via_reflection.yml |  34 +----
 ...ll_pinvoke_process_injection_api_chain.yml |  75 ++--------
 .../powershell_processing_stream_of_data.yml  |  31 ++--
 ...rshell_remote_services_add_trustedhost.yml |   5 +-
 ...remote_thread_to_known_windows_process.yml |  44 ++----
 ...hell_remove_windows_defender_directory.yml |  27 ++--
 ...powershell_script_block_with_url_chain.yml |   5 +-
 .../powershell_start_bitstransfer.yml         |  18 +--
 .../powershell_start_or_stop_service.yml      |  16 +--
 ...wershell_using_memory_as_backing_store.yml |  16 +--
 ...ershell_webrequest_using_memory_stream.yml |  16 +--
 ...ll_windows_defender_exclusion_commands.yml |  31 ++--
 ...nt_automatic_repair_mode_using_bcdedit.yml |  18 +--
 .../print_processor_registry_autostart.yml    |   5 +-
 .../print_spooler_adding_a_printer_driver.yml |  12 +-
 ...print_spooler_failed_to_load_a_plug_in.yml |   5 +-
 ...eating_lnk_file_in_suspicious_location.yml |  58 ++------
 ...process_deleting_its_process_file_path.yml |   5 +-
 .../endpoint/process_execution_via_wmi.yml    |   5 +-
 .../process_kill_base_on_file_path.yml        |  24 +---
 .../process_writing_dynamicwrapperx.yml       |  14 +-
 .../processes_tapping_keyboard_events.yml     |   2 +-
 ...n_network_traffic_during_package_build.yml |  25 ++--
 ...e_creation_during_package_installation.yml |  26 ++--
 ...dification_during_package_installation.yml |  26 ++--
 ...s_creation_during_package_installation.yml |  29 ++--
 ...randomly_generated_scheduled_task_name.yml |   2 +-
 ...andomly_generated_windows_service_name.yml |   2 +-
 .../ransomware_notes_bulk_creation.yml        |   4 +-
 .../recon_avproduct_through_pwh_or_wmi.yml    |  16 +--
 detections/endpoint/recon_using_wmi_class.yml |   3 +-
 ...rsive_delete_of_directory_in_batch_cmd.yml |  18 +--
 ...ulating_windows_services_registry_keys.yml |  18 +--
 ...istry_keys_for_creating_shim_databases.yml |   5 +-
 .../registry_keys_used_for_persistence.yml    |   3 +-
 ...try_keys_used_for_privilege_escalation.yml |   5 +-
 ...2_silent_and_install_param_dll_loading.yml |  32 +----
 .../remcos_client_registry_install_entry.yml  |   5 +-
 ...cos_rat_file_creation_in_remcos_folder.yml |   5 +-
 ...mote_desktop_process_running_on_system.yml |  18 +--
 ..._instantiation_via_dcom_and_powershell.yml |  20 +--
 ...n_via_dcom_and_powershell_script_block.yml |  16 +--
 ...instantiation_via_winrm_and_powershell.yml |  20 +--
 ..._via_winrm_and_powershell_script_block.yml |  16 +--
 ...cess_instantiation_via_winrm_and_winrs.yml |  23 +--
 .../remote_process_instantiation_via_wmi.yml  |  24 +---
 ...s_instantiation_via_wmi_and_powershell.yml |  24 +---
 ...on_via_wmi_and_powershell_script_block.yml |  16 +--
 ...ote_system_discovery_with_adsisearcher.yml |  15 +-
 .../remote_system_discovery_with_dsquery.yml  |  21 +--
 .../remote_system_discovery_with_wmic.yml     |   5 +-
 .../endpoint/remote_wmi_command_attempt.yml   |  18 +--
 .../endpoint/resize_shadowstorage_volume.yml  |  24 +---
 .../endpoint/revil_common_exec_parameter.yml  |  20 +--
 detections/endpoint/revil_registry_entry.yml  |   5 +-
 .../rubeus_command_line_parameters.yml        |   5 +-
 ...ticket_exports_through_winlogon_access.yml |  16 +--
 .../runas_execution_in_commandline.yml        |  16 +--
 .../endpoint/rundll32_control_rundll_hunt.yml |  16 +--
 ...ontrol_rundll_world_writable_directory.yml |   5 +-
 ...ll32_create_remote_thread_to_a_process.yml |  27 +---
 .../endpoint/rundll32_lockworkstation.yml     |  18 +--
 ...undll32_process_creating_exe_dll_files.yml |  13 +-
 .../endpoint/rundll32_shimcache_flush.yml     |  20 +--
 ...no_command_line_arguments_with_network.yml |   2 +-
 .../rundll_loading_dll_by_ordinal.yml         |  19 +--
 .../endpoint/ryuk_test_files_detected.yml     |   5 +-
 .../endpoint/ryuk_wake_on_lan_command.yml     |  31 +---
 .../sam_database_file_access_attempt.yml      |   3 +-
 .../endpoint/samsam_test_file_write.yml       |   5 +-
 ..._by_app_connect_and_create_adsi_object.yml |  13 +-
 ...edule_task_with_http_command_arguments.yml |   4 +-
 ...ule_task_with_rundll32_command_trigger.yml |   4 +-
 ...k_creation_on_remote_endpoint_using_at.yml |   5 +-
 ...eduled_task_deleted_or_created_via_cmd.yml |  48 +------
 ...led_task_initiation_on_remote_endpoint.yml |  23 +--
 .../endpoint/schtasks_run_task_on_demand.yml  |  18 +--
 ...htasks_scheduling_job_on_remote_system.yml |  23 +--
 .../schtasks_used_for_forcing_a_reboot.yml    |  18 +--
 .../screensaver_event_trigger_execution.yml   |   5 +-
 .../endpoint/script_execution_via_wmi.yml     |  18 +--
 detections/endpoint/sdclt_uac_bypass.yml      |   5 +-
 .../sdelete_application_execution.yml         |  22 +--
 ...host_with_no_command_line_with_network.yml |   2 +-
 .../secretdumps_offline_ntds_dumping_tool.yml |  24 +---
 ...incipalnames_discovery_with_powershell.yml |  16 +--
 ...ceprincipalnames_discovery_with_setspn.yml |  28 +---
 detections/endpoint/services_escalate_exe.yml |  18 +--
 ...ervices_lolbas_execution_process_spawn.yml |  23 +--
 ...ution_policy_to_unrestricted_or_bypass.yml |   5 +-
 ...ai_hulud_2_exfiltration_artifact_files.yml |  25 ++--
 ...workflow_file_creation_or_modification.yml |  57 +++-----
 .../endpoint/shim_database_file_creation.yml  |   5 +-
 ...nstallation_with_suspicious_parameters.yml |   5 +-
 .../endpoint/short_lived_scheduled_task.yml   |  18 +--
 .../endpoint/short_lived_windows_accounts.yml |   4 +-
 .../endpoint/silentcleanup_uac_bypass.yml     |   5 +-
 .../single_letter_process_on_endpoint.yml     |   2 +-
 detections/endpoint/slui_runas_elevated.yml   |  18 +--
 .../endpoint/slui_spawning_a_process.yml      |  18 +--
 ...network_listener_binding_an_executable.yml |  21 ++-
 ...cp_connection_with_local_echo_disabled.yml |  22 +--
 detections/endpoint/spike_in_file_writes.yml  |   2 +-
 .../endpoint/spoolsv_spawning_rundll32.yml    |  18 +--
 .../spoolsv_suspicious_loaded_modules.yml     |   5 +-
 .../spoolsv_suspicious_process_access.yml     |   5 +-
 detections/endpoint/spoolsv_writing_a_dll.yml |   5 +-
 .../spoolsv_writing_a_dll___sysmon.yml        |   5 +-
 .../endpoint/sqlite_module_in_temp_folder.yml |   5 +-
 ...ation_certificates_behavior_identified.yml |   4 +-
 ...urst_correlation_dll_and_network_event.yml |   2 +-
 ...uspicious_computer_account_name_change.yml |   9 +-
 .../endpoint/suspicious_copy_on_system32.yml  |  61 +++-----
 .../suspicious_curl_network_connection.yml    |  17 +--
 ...ious_dllhost_no_command_line_arguments.yml |  15 +-
 ...ous_gpupdate_no_command_line_arguments.yml |  15 +-
 .../suspicious_icedid_rundll32_cmdline.yml    |  18 +--
 ...cious_image_creation_in_appdata_folder.yml |   5 +-
 ...icious_kerberos_service_ticket_request.yml |   4 +-
 .../suspicious_linux_discovery_commands.yml   |   4 +-
 ...ious_microsoft_workflow_compiler_usage.yml |  22 +--
 .../endpoint/suspicious_msbuild_path.yml      |   5 +-
 .../endpoint/suspicious_msbuild_spawn.yml     |  20 +--
 .../suspicious_mshta_child_process.yml        |  20 +--
 .../endpoint/suspicious_mshta_spawn.yml       |  23 +--
 .../endpoint/suspicious_plistbuddy_usage.yml  |  16 +--
 ...uspicious_plistbuddy_usage_via_osquery.yml |   4 +-
 ...s_process_executed_from_container_file.yml |   4 +-
 .../endpoint/suspicious_reg_exe_process.yml   |   4 +-
 ...ious_regsvr32_register_suspicious_path.yml |   5 +-
 .../suspicious_rundll32_dllregisterserver.yml |  18 +--
 ...ous_rundll32_no_command_line_arguments.yml |  41 ++----
 .../suspicious_rundll32_plugininit.yml        |  18 +--
 .../endpoint/suspicious_rundll32_startw.yml   |  18 +--
 ...s_scheduled_task_from_public_directory.yml |   5 +-
 ...protocolhost_no_command_line_arguments.yml |  46 ++----
 ...spicious_sqlite3_lsquarantine_behavior.yml |  16 +--
 ...picious_ticket_granting_ticket_request.yml |   2 +-
 .../suspicious_wav_file_in_appdata_folder.yml |   5 +-
 .../endpoint/suspicious_wevtutil_usage.yml    |  66 ++-------
 ...spicious_writes_to_windows_recycle_bin.yml |   4 +-
 ...svchost_lolbas_execution_process_spawn.yml |  58 +-------
 ...nfo_gathering_using_dxdiag_application.yml |  12 +-
 ...system_information_discovery_detection.yml |   5 +-
 ...rocesses_run_from_unexpected_locations.yml |   2 +-
 .../system_user_discovery_with_query.yml      |  21 +--
 .../system_user_discovery_with_whoami.yml     |  20 +--
 .../time_provider_persistence_registry.yml    |  37 +----
 detections/endpoint/trickbot_named_pipe.yml   |   5 +-
 .../uac_bypass_mmc_load_unsigned_dll.yml      |   5 +-
 .../uac_bypass_with_colorui_com_object.yml    |   5 +-
 .../endpoint/uninstall_app_using_msiexec.yml  |  18 +--
 ...wn_process_using_the_kerberos_protocol.yml |   4 +-
 .../endpoint/unload_sysmon_filter_driver.yml  |  23 +--
 .../unloading_amsi_via_reflection.yml         |  16 +--
 ..._of_computer_service_tickets_requested.yml |   2 +-
 ..._of_kerberos_service_tickets_requested.yml |   4 +-
 ..._remote_endpoint_authentication_events.yml |   2 +-
 .../endpoint/unusually_long_command_line.yml  |   2 +-
 ...ser_discovery_with_env_vars_powershell.yml |  19 +--
 ..._with_env_vars_powershell_script_block.yml |  14 +-
 detections/endpoint/usn_journal_deletion.yml  |  25 +---
 .../vbscript_execution_using_wscript_app.yml  |  23 +--
 .../endpoint/verclsid_clsid_execution.yml     |  19 +--
 .../wbadmin_delete_system_backups.yml         |  23 +--
 .../wbemprox_com_object_execution.yml         |   5 +-
 ...or_application_server_spawning_a_shell.yml |  55 +++----
 ...servers_executing_suspicious_processes.yml |  28 +---
 .../wermgr_process_create_executable_file.yml |  13 +-
 ...cess_spawned_cmd_or_powershell_process.yml |  20 +--
 ...s__key_file_creation_in_root_directory.yml |  30 +---
 ...ss_token_manipulation_sedebugprivilege.yml |   5 +-
 ...lation_winlogon_duplicate_token_handle.yml |  14 +-
 ...ogon_duplicate_handle_in_uncommon_path.yml |  13 +-
 ...account_access_removal_via_logoff_exec.yml |  20 +--
 ...iscovery_for_none_disable_user_account.yml |  14 +-
 ...account_discovery_for_sam_account_name.yml |  16 +--
 ...scovery_with_netuser_preauthnotrequire.yml |  14 +-
 ...ows_ad_abnormal_object_access_activity.yml |   4 +-
 .../endpoint/windows_ad_add_self_to_group.yml |  11 +-
 .../windows_ad_adminsdholder_acl_modified.yml |   5 +-
 ..._computer_spn_modified_by_user_account.yml |  50 ++-----
 ...s_ad_cross_domain_sid_history_addition.yml |   5 +-
 ...ows_ad_dangerous_deny_acl_modification.yml |   5 +-
 ...ws_ad_dangerous_group_acl_modification.yml |   5 +-
 ...ows_ad_dangerous_user_acl_modification.yml |   5 +-
 ...ws_ad_dcshadow_privileges_acl_addition.yml |   4 +-
 ...omain_controller_audit_policy_disabled.yml |   4 +-
 ...windows_ad_domain_controller_promotion.yml |   4 +-
 ...ows_ad_domain_replication_acl_addition.yml |   4 +-
 .../windows_ad_domain_root_acl_deletion.yml   |   5 +-
 ...indows_ad_domain_root_acl_modification.yml |   5 +-
 .../windows_ad_dsrm_account_changes.yml       |   5 +-
 .../windows_ad_dsrm_password_reset.yml        |  13 +-
 .../endpoint/windows_ad_gpo_deleted.yml       |   4 +-
 .../endpoint/windows_ad_gpo_disabled.yml      |   4 +-
 .../windows_ad_gpo_new_cse_addition.yml       |   4 +-
 .../windows_ad_hidden_ou_creation.yml         |   5 +-
 .../windows_ad_object_owner_updated.yml       |   4 +-
 ...rivileged_account_sid_history_addition.yml |   4 +-
 ...ndows_ad_privileged_group_modification.yml |  15 +-
 ...s_ad_privileged_object_access_activity.yml |   4 +-
 ...tion_request_initiated_by_user_account.yml |   4 +-
 ...t_initiated_from_unsanctioned_location.yml |   4 +-
 ...ws_ad_same_domain_sid_history_addition.yml |   5 +-
 .../windows_ad_self_dacl_assignment.yml       |   2 +-
 ...eprincipalname_added_to_domain_account.yml |  10 +-
 ...ed_domain_account_serviceprincipalname.yml |   4 +-
 ..._lived_domain_controller_spn_attribute.yml |   4 +-
 .../windows_ad_short_lived_server_object.yml  |   4 +-
 ...dows_ad_sid_history_attribute_modified.yml |  11 +-
 ...ows_ad_spn_unicode_collision_injection.yml |  26 ++--
 ...s_ad_suspicious_attribute_modification.yml |   4 +-
 .../windows_ad_user_suspicious_upn_change.yml |  50 ++-----
 detections/endpoint/windows_adfind_exe.yml    |  50 +------
 ...ws_admin_password_changed_by_non_admin.yml |  11 +-
 .../windows_admin_permission_discovery.yml    |   5 +-
 ...tive_shares_accessed_on_multiple_hosts.yml |   5 +-
 ...n_default_group_policy_object_modified.yml |  11 +-
 ...dows_admon_group_policy_object_created.yml |  11 +-
 ...installer_msix_with_ai_stubs_execution.yml |   7 +-
 .../windows_ai_platform_dns_query.yml         |   5 +-
 ...e_data_stream_created_over_local_share.yml |  26 ++--
 ..._alternate_datastream___base64_content.yml |   5 +-
 ...ernate_datastream___executable_content.yml |   5 +-
 ...ternate_datastream___process_execution.yml |   4 +-
 ...gistry_value_length_in_environment_key.yml |  27 +---
 .../windows_anonymous_pipe_activity.yml       |   7 +-
 .../windows_apache_benchmark_binary.yml       |  18 +--
 ...ws_app_layer_protocol_qakbot_namedpipe.yml |   5 +-
 ...r_protocol_wermgr_connect_to_namedpipe.yml |   5 +-
 ...pcertdll_modification_via_command_line.yml |  37 ++---
 ...s_appcertdll_modification_via_registry.yml |  40 ++----
 ...yer_protocol_rms_radmin_tool_namedpipe.yml |   5 +-
 ...itelisting_bypass_attempt_via_rundll32.yml |  53 +++----
 .../windows_applocker_block_events.yml        |   6 +-
 ...cker_execution_from_uncommon_locations.yml |   4 +-
 ...ege_escalation_via_unauthorized_bypass.yml |   6 +-
 ...cker_rare_application_launch_detection.yml |   4 +-
 ...oyment_full_trust_package_installation.yml |  15 +-
 ...eployment_package_installation_success.yml |  16 +--
 ...ployment_unsigned_package_installation.yml |  15 +-
 ..._archive_collected_data_via_powershell.yml |   5 +-
 ...windows_archive_collected_data_via_rar.yml |  22 +--
 ...archived_collected_data_in_temp_folder.yml |  24 +---
 ...ndows_attempt_to_stop_security_service.yml |   4 +-
 ..._auditing_option_disabled_via_auditpol.yml |  18 +--
 ...cy_auditing_option_modified___registry.yml |   5 +-
 ...dows_audit_policy_cleared_via_auditpol.yml |  20 +--
 ...ows_audit_policy_disabled_via_auditpol.yml |  20 +--
 ...it_policy_disabled_via_legacy_auditpol.yml |  21 +--
 ..._policy_excluded_category_via_auditpol.yml |  20 +--
 ...ows_audit_policy_restored_via_auditpol.yml |  20 +--
 ...rity_descriptor_tampering_via_auditpol.yml |  20 +--
 .../endpoint/windows_autoit3_execution.yml    |  37 ++---
 ...ion_lsass_driver_registry_modification.yml |   5 +-
 ...ule_installation_via_powershell_script.yml |  35 +----
 ...zure_storage_utility_execution_via_cli.yml |  38 ++---
 ...ndows_binary_execution_from_an_archive.yml |  43 +-----
 ...roxy_execution_mavinject_dll_injection.yml |  18 +--
 ...nder_submission_wizard_dll_sideloading.yml |  44 +-----
 ...ows_bitlocker_suspicious_command_usage.yml |  20 +--
 ...indows_bitlockertogo_process_execution.yml |  16 +--
 ...ws_bitlockertogo_with_network_activity.yml |  14 +-
 ...rvice_installed_from_uncommon_location.yml |  46 +++---
 ..._autostart_execution_in_startup_folder.yml |   5 +-
 .../endpoint/windows_bootloader_inventory.yml |   2 +-
 ...er_process_launched_with_unusual_flags.yml |   5 +-
 ...ndows_builtin_account_name_was_changed.yml |  34 ++---
 .../windows_bypass_uac_via_pkgmgr_tool.yml    |   5 +-
 .../endpoint/windows_cab_file_on_disk.yml     |  64 +++------
 ...ows_cabinet_file_extraction_via_expand.yml |  44 +++---
 ...ws_cached_domain_credentials_reg_query.yml |   5 +-
 ...ows_certutil_root_certificate_addition.yml |  62 +++-----
 ...ge_file_association_command_to_notepad.yml |  23 ++-
 ...rome_auto_update_disabled_via_registry.yml |  47 ++----
 ...ble_extension_loading_via_command_line.yml |  24 +---
 ...xtension_allowed_registry_modification.yml |   5 +-
 ...rowser_launched_with_small_window_size.yml |   2 +-
 ...um_browser_no_security_sandbox_process.yml |  28 ++--
 ...rowser_with_custom_user_data_directory.yml |  29 ++--
 ...s_launched_with_disable_popup_blocking.yml |  15 +-
 ...process_launched_with_logging_disabled.yml |  25 ++--
 ...cess_loaded_extension_via_command_line.yml |  26 ++--
 ...omium_process_with_disabled_extensions.yml |  16 +--
 ...ecure_endpoint_related_service_stopped.yml |   4 +-
 ..._endpoint_stop_immunet_service_via_sfc.yml |   5 +-
 ...o_secure_endpoint_unblock_file_via_sfc.yml |   5 +-
 ...oint_uninstall_immunet_service_via_sfc.yml |   5 +-
 ...ndows_clipboard_data_via_get_clipboard.yml |  27 ++--
 ...iles_filter_loaded_by_uncommon_process.yml |  48 ++-----
 ...lter_log_created_by_non_system_process.yml |  28 ++--
 ...e_file_read_access_by_uncommon_process.yml |  27 ++--
 ..._tool_execution_from_non_shell_process.yml |   5 +-
 ...indows_cobalt_strike_powershell_loader.yml |  29 ++--
 ..._hijacking_inprocserver32_modification.yml |  18 +--
 ...ing_interpreter_hunting_path_traversal.yml |  53 +++----
 ...ipting_interpreter_path_traversal_exec.yml |   5 +-
 ...n_with_environment_variable_substrings.yml |  35 ++---
 ...s_command_shell_dcrat_forkbomb_payload.yml |  17 +--
 ..._common_abused_cmd_shell_risk_behavior.yml |   4 +-
 ...ity_telemetry_suspicious_child_process.yml |  20 +--
 ...y_telemetry_tampering_through_registry.yml |  21 +--
 ...r_account_changed_to_domain_controller.yml |  24 +---
 ...er_account_created_by_computer_account.yml |  13 +-
 ...ter_account_requesting_kerberos_ticket.yml |  12 +-
 .../windows_computer_account_with_spn.yml     |  11 +-
 ...ws_computerdefaults_spawning_a_process.yml |  18 +--
 ...windows_conhost_with_headless_argument.yml |  18 +--
 ...dows_consolehost_history_file_deletion.yml |   5 +-
 ...ntent_copied_from_browser_was_executed.yml |  19 +--
 ...ckdoor_execution_via_powershell_script.yml |  28 ++--
 .../endpoint/windows_create_local_account.yml |  22 +--
 ...te_local_administrator_account_via_net.yml |  22 +--
 ...ial_access_from_browser_password_store.yml |  12 +-
 ...ential_dumping_lsass_memory_createdump.yml |  22 +--
 ...t_information_structure_in_commandline.yml |  18 +--
 ...credentials_access_via_vaultcli_module.yml |   5 +-
 ...sword_stores_chrome_copied_in_temp_dir.yml |   5 +-
 ...assword_stores_chrome_extension_access.yml |  39 ++---
 ...ssword_stores_chrome_localstate_access.yml |  41 ++----
 ...ssword_stores_chrome_login_data_access.yml |  41 ++----
 ...dentials_from_password_stores_creation.yml |  22 +--
 ...dentials_from_password_stores_deletion.yml |  22 +--
 ...credentials_from_password_stores_query.yml |  22 +--
 ...from_web_browsers_saved_in_temp_folder.yml |   5 +-
 ...dows_credentials_in_registry_reg_query.yml |   5 +-
 ...crowdstrike_agent_registry_key_removal.yml |  25 +---
 ...ndows_crowdstrike_rtr_script_execution.yml |  33 +----
 ...ndows_curl_download_to_suspicious_path.yml |  59 +++-----
 ...dows_curl_upload_to_remote_destination.yml |  40 +-----
 ...truction_recursive_exec_files_deletion.yml |   4 +-
 .../windows_debugger_tool_execution.yml       |  20 +--
 ...cement_modify_transcodedwallpaper_file.yml |   5 +-
 ...efault_cobalt_strike_powershell_beacon.yml |  35 ++---
 ...s_default_group_policy_object_modified.yml |  13 +-
 ...group_policy_object_modified_with_gpme.yml |  22 +--
 ...rdp_file_creation_by_non_mstsc_process.yml |   4 +-
 .../windows_default_rdp_file_deletion.yml     |   5 +-
 .../windows_default_rdp_file_unhidden.yml     |  18 +--
 .../windows_defender_asr_audit_events.yml     |  10 +-
 .../windows_defender_asr_block_events.yml     |  16 +--
 ...der_asr_or_threat_configuration_tamper.yml |  56 +++-----
 ...ows_defender_asr_registry_modification.yml |   3 +-
 .../windows_defender_asr_rule_disabled.yml    |   5 +-
 .../windows_defender_asr_rules_stacking.yml   |   2 +-
 ...dows_defender_exclusion_registry_entry.yml |   5 +-
 ...der_intermediary_artifact_was_observed.yml |  25 ++--
 ...ent_dll_loaded_by_non_defender_process.yml |  22 +--
 ..._threat_detected_on_kernel_object_path.yml |  34 ++---
 ...ndows_delete_or_modify_system_firewall.yml |  16 +--
 ...ry_by_a_non_critical_process_file_path.yml |   5 +-
 ...indows_detect_network_scanner_behavior.yml |   5 +-
 ...loper_signed_msix_package_installation.yml |  14 +-
 .../endpoint/windows_devtunnels_execution.yml |  34 ++---
 .../windows_devtunnels_image_loaded.yml       |  28 ++--
 .../windows_dir_piped_to_findstr_activity.yml |  41 ++----
 ...sable_change_password_through_registry.yml |   5 +-
 ...ndows_disable_internet_explorer_addons.yml |  22 +--
 ...k_workstation_feature_through_registry.yml |   5 +-
 ...disable_logoff_button_through_registry.yml |   5 +-
 .../windows_disable_memory_crash_dump.yml     |   5 +-
 .../windows_disable_notification_center.yml   |  19 +--
 ...s_disable_or_modify_tools_via_taskkill.yml |  18 +--
 ...indows_disable_or_stop_browser_process.yml |  18 +--
 ...sable_shutdown_button_through_registry.yml |  50 ++-----
 ...ows_event_logging_disable_http_logging.yml |  18 +--
 ...group_policy_features_through_registry.yml |   5 +-
 .../windows_disableantispyware_registry.yml   |   5 +-
 .../endpoint/windows_diskcryptor_usage.yml    |  20 +--
 .../windows_diskshadow_proxy_execution.yml    |  16 +--
 ...ows_dism_install_powershell_web_access.yml |  24 +---
 .../endpoint/windows_dism_remove_defender.yml |  24 +---
 .../windows_dll_module_loaded_in_temp_dir.yml |   3 +-
 ...earch_order_hijacking_hunt_with_sysmon.yml |   3 +-
 ...l_search_order_hijacking_with_iscsicpl.yml |  18 +--
 .../windows_dll_side_loading_in_calc.yml      |  21 +--
 ...dll_side_loading_process_child_of_calc.yml |  20 +--
 .../windows_dns_gather_network_info.yml       |  18 +--
 .../windows_dns_query_request_to_tinyurl.yml  |  39 ++---
 .../windows_dnsadmins_new_member_added.yml    |  11 +-
 ..._account_discovery_via_get_netcomputer.yml |  16 +--
 ...s_domain_admin_impersonation_indicator.yml |   4 +-
 ...ows_dotnet_binary_in_non_standard_path.yml |  24 +++-
 .../windows_downdate_registry_activity.yml    |  35 +----
 .../endpoint/windows_driver_inventory.yml     |   2 +-
 .../windows_driver_load_non_standard_path.yml |  27 ++--
 .../windows_drivers_loaded_by_signature.yml   |   2 +-
 ...rsilencer_custom_outbound_filter_added.yml |  54 ++-----
 .../windows_edrsilencer_execution.yml         |  39 ++---
 ...ndows_efi_bootloader_file_modification.yml |  31 +---
 ..._efi_volume_mount_attempt_via_mountvol.yml |  36 +----
 .../windows_enable_powershell_web_access.yml  |  18 +--
 ...enable_win32_scheduledjob_via_registry.yml |   5 +-
 ...ws_entra_user_management_via_azure_cli.yml |  39 +----
 ...report_created_in_reportqueue_manually.yml |  38 ++---
 ...x_admins_group_creation_security_event.yml |  16 +--
 ...dows_esx_admins_group_creation_via_net.yml |  20 +--
 ...x_admins_group_creation_via_powershell.yml |  16 +--
 .../windows_event_for_service_disabled.yml    |  11 +-
 .../endpoint/windows_event_log_cleared.yml    |  13 +-
 ...ows_event_logging_service_has_shutdown.yml |   2 +-
 ...image_file_execution_options_injection.yml |   2 +-
 .../windows_eventlog_cleared_via_wevtutil.yml |  10 +-
 ...con_activity_using_log_query_utilities.yml |  71 ++-------
 ...spawning_microsoft_project_application.yml |  40 ++----
 ...dows_excessive_disabled_services_event.yml |   4 +-
 ...windows_excessive_service_stop_attempt.yml |  20 +--
 .../windows_excessive_usage_of_net_app.yml    |  15 +-
 .../windows_executable_in_loaded_modules.yml  |  18 +--
 ...able_masquerading_as_benign_file_types.yml |  20 +--
 ...s_execute_arbitrary_commands_with_msdt.yml |  26 +---
 ..._microsoft_msc_file_in_suspicious_path.yml |   2 +-
 ...ltration_over_c2_via_invoke_restmethod.yml |  16 +--
 ...on_over_c2_via_powershell_uploadstring.yml |  16 +--
 ...xplorer_exe_spawning_powershell_or_cmd.yml |   5 +-
 ...nk_exploit_process_launch_with_padding.yml |   7 +-
 .../endpoint/windows_export_certificate.yml   |   4 +-
 ...fmpeg_audio_and_video_device_discovery.yml |  26 +---
 ...indows_ffmpeg_directshow_video_capture.yml |  26 +---
 ..._directory_enable_readonly_permissions.yml |   5 +-
 ...rectory_permissions_enable_inheritance.yml |  20 +--
 ...rectory_permissions_remove_inheritance.yml |  20 +--
 ...ile_association_modification_via_ftype.yml |  35 ++---
 ...ows_file_collection_via_copy_utilities.yml |  39 +----
 .../windows_file_download_via_certutil.yml    |  24 +---
 .../windows_file_download_via_powershell.yml  |  41 ++++--
 ...ws_file_share_discovery_with_powerview.yml |  16 +--
 ...er_protocol_in_non_common_process_path.yml |  25 +---
 ...e_without_extension_in_critical_folder.yml |  14 +-
 ..._access_rights_modification_via_icacls.yml |  28 ++--
 ...form_filter_added_to_block_edr_process.yml |  20 +--
 ...form_policy_added_to_block_edr_process.yml |  87 +----------
 ..._organizational_units_with_getdomainou.yml |  16 +--
 ...ting_acl_with_findinterestingdomainacl.yml |  16 +--
 .../windows_findstr_gpp_discovery.yml         |  24 +---
 ...finger_exe_connecting_to_a_remote_host.yml |  44 ++----
 .../endpoint/windows_firewall_rule_added.yml  |   4 +-
 .../windows_firewall_rule_deletion.yml        |   4 +-
 .../windows_firewall_rule_modification.yml    |   4 +-
 ...age_within_cmd_exe_to_execute_commands.yml |  51 ++-----
 ..._forest_discovery_with_getforestdomain.yml |  16 +--
 ..._gather_victim_host_information_camera.yml |  16 +--
 ...indows_gather_victim_identity_sam_info.yml |   3 +-
 .../windows_gdrive_binary_activity.yml        |  23 +--
 ...ter_unconstrained_delegation_discovery.yml |  16 +--
 ..._local_admin_with_findlocaladminaccess.yml |  16 +--
 ..._exe_execution_from_windowsapps_folder.yml |  31 +---
 ...access_audit_list_cleared_via_auditpol.yml |  20 +--
 ...ource___mmc_process_accessing_apds_dll.yml |  26 +---
 .../windows_group_discovery_via_net.yml       |   3 +-
 .../windows_group_policy_object_created.yml   |  12 +-
 ...dows_guest_account_enabled_via_net_exe.yml |  33 +----
 ...plication_in_known_uac_bypass_binaries.yml |  51 +------
 .../windows_hidden_schedule_task_settings.yml |  11 +-
 ...notification_features_through_registry.yml |   5 +-
 .../windows_high_file_deletion_frequency.yml  |   5 +-
 ...k_execution_flow_version_dll_side_load.yml |   5 +-
 .../endpoint/windows_hosts_file_access.yml    |  12 +-
 ...ttp_network_communication_from_msiexec.yml |   4 +-
 ...hunting_system_account_targeting_lsass.yml |  18 +--
 ...dentify_powershell_web_access_iis_pool.yml |   5 +-
 .../windows_identify_protocol_handlers.yml    |   2 +-
 .../windows_iis_components_add_new_module.yml |  20 +--
 ...nents_get_webglobalmodule_module_query.yml |   2 +-
 ...s_iis_components_module_failed_to_load.yml |  12 +-
 ...indows_iis_components_new_module_added.yml |   4 +-
 ...impair_defense_add_xml_applocker_rules.yml |  22 +--
 ...ge_win_defender_health_check_intervals.yml |   5 +-
 ...hange_win_defender_quick_scan_interval.yml |   5 +-
 ...ense_change_win_defender_throttle_rate.yml |   5 +-
 ...ense_change_win_defender_tracing_level.yml |   5 +-
 ..._defense_configure_app_install_control.yml |   5 +-
 ...ense_define_win_defender_threat_action.yml |   5 +-
 ...fense_delete_win_defender_context_menu.yml |   3 +-
 ...e_delete_win_defender_profile_registry.yml |   5 +-
 ..._deny_security_software_with_applocker.yml |   5 +-
 ...fense_disable_controlled_folder_access.yml |   5 +-
 ..._disable_defender_firewall_and_network.yml |   5 +-
 ..._disable_defender_protocol_recognition.yml |   5 +-
 ..._impair_defense_disable_pua_protection.yml |   5 +-
 ...se_disable_realtime_signature_delivery.yml |   5 +-
 ..._impair_defense_disable_web_evaluation.yml |  13 +-
 ...defense_disable_win_defender_app_guard.yml |   5 +-
 ...sable_win_defender_compute_file_hashes.yml |   5 +-
 ...fense_disable_win_defender_gen_reports.yml |   5 +-
 ...isable_win_defender_network_protection.yml |   5 +-
 ..._disable_win_defender_report_infection.yml |   5 +-
 ...se_disable_win_defender_scan_on_update.yml |   5 +-
 ...able_win_defender_signature_retirement.yml |   5 +-
 ...e_overide_win_defender_phishing_filter.yml |   5 +-
 ...ir_defense_override_smartscreen_prompt.yml |   5 +-
 ...in_defender_smart_screen_level_to_warn.yml |   5 +-
 ...r_defenses_disable_auto_logger_session.yml |   5 +-
 ...nses_disable_av_autostart_via_registry.yml |   5 +-
 .../windows_impair_defenses_disable_hvci.yml  |   5 +-
 ...nses_disable_win_defender_auto_logging.yml |   5 +-
 ...indows_important_audit_policy_disabled.yml |   4 +-
 ..._group_or_object_modification_activity.yml |   4 +-
 ...increase_in_user_modification_activity.yml |   4 +-
 .../windows_indicator_removal_via_rmdir.yml   |   5 +-
 ...ndirect_command_execution_via_forfiles.yml |  18 +--
 ..._indirect_command_execution_via_pcalua.yml |  18 +--
 ...mmand_execution_via_series_of_forfiles.yml |  16 +--
 .../windows_information_discovery_fsutil.yml  |  39 +----
 ...s_ingress_tool_transfer_using_explorer.yml |  15 +-
 ...indows_inprocserver32_new_outlook_form.yml |   5 +-
 ..._input_capture_using_credential_ui_dll.yml |   3 +-
 .../windows_installutil_credential_theft.yml  |   5 +-
 ...ndows_installutil_in_non_standard_path.yml |   5 +-
 ..._installutil_remote_network_connection.yml |   2 +-
 .../windows_installutil_uninstall_option.yml  |   5 +-
 ...indows_installutil_url_in_command_line.yml |  16 +--
 ...xtension_dll_registration_via_regsvr32.yml |  35 ++---
 .../windows_iso_lnk_file_creation.yml         |   3 +-
 .../windows_kerberos_coercion_via_dns.yml     |  13 +-
 ...indows_kerberos_local_successful_logon.yml |  24 ++--
 .../windows_known_abused_dll_created.yml      |   5 +-
 ...s_known_abused_dll_loaded_suspiciously.yml |  17 ++-
 ...s_known_graphicalproton_loaded_modules.yml |   5 +-
 .../windows_krbrelayup_service_creation.yml   |  12 +-
 ...ssword_gathering_via_powershell_script.yml |  30 ++--
 ..._of_computer_service_tickets_requested.yml |  11 +-
 ...ndows_ldifde_directory_object_behavior.yml |  18 +--
 ..._level_rmm_powershell_script_installer.yml |  30 ++--
 ...indows_level_rmm_watchdog_task_created.yml |  26 ++--
 ...dows_linked_policies_in_adsi_discovery.yml |  16 +--
 ...s_via_set_command_from_uncommon_parent.yml |   4 +-
 ...ocal_administrator_credential_stuffing.yml |   4 +-
 .../windows_local_llm_framework_execution.yml | 120 ++--------------
 ..._lolbas_executed_outside_expected_path.yml |  15 +-
 .../windows_lsa_secrets_nolmhash_registry.yml |   5 +-
 ...il_protocol_in_non_common_process_path.yml |  24 +---
 .../windows_mark_of_the_web_bypass.yml        |  19 +--
 ...masquerading_explorer_as_child_process.yml |  41 ++----
 .../windows_masquerading_msdtc_process.yml    |  18 +--
 ...metasploit_confluence_plugin_execution.yml |  34 +----
 .../windows_mimikatz_binary_execution.yml     |  22 +--
 ...mimikatz_crypto_export_file_extensions.yml |  16 +--
 .../windows_mmc_loaded_script_engine_dll.yml  |   5 +-
 ...ck_trusted_directory_msc_file_creation.yml |  38 +----
 ...y_registry_authenticationleveloverride.yml |   5 +-
 ...ows_modify_registry_auto_minor_updates.yml |   3 +-
 ...dows_modify_registry_auto_update_notif.yml |   5 +-
 ...ws_modify_registry_configure_bitlocker.yml |   5 +-
 ...s_modify_registry_default_icon_setting.yml |   5 +-
 ..._modify_registry_delete_firewall_rules.yml |   5 +-
 .../windows_modify_registry_disable_rdp.yml   |   5 +-
 ...dify_registry_disable_restricted_admin.yml |   5 +-
 ...y_registry_disable_toast_notifications.yml |   5 +-
 ...y_disable_win_defender_raw_write_notif.yml |   5 +-
 ...stry_disable_windefender_notifications.yml |   5 +-
 ..._disable_windows_security_center_notif.yml |   5 +-
 ...registry_disableremotedesktopantialias.yml |   5 +-
 ...odify_registry_disablesecuritysettings.yml |   5 +-
 ...modify_registry_disabling_wer_settings.yml |   5 +-
 ...s_modify_registry_disallow_windows_app.yml |   5 +-
 ..._registry_do_not_connect_to_win_update.yml |   5 +-
 .../windows_modify_registry_dontshowui.yml    |   5 +-
 ...odify_registry_enablelinkedconnections.yml |   5 +-
 ...ndows_modify_registry_longpathsenabled.yml |   5 +-
 ...modify_registry_maxconnectionperserver.yml |   5 +-
 ...egistry_no_auto_reboot_with_logon_user.yml |   5 +-
 ...windows_modify_registry_no_auto_update.yml |   5 +-
 ...ws_modify_registry_nochangingwallpaper.yml |   5 +-
 ...fy_registry_on_smart_card_group_policy.yml |   5 +-
 .../windows_modify_registry_proxyenable.yml   |   5 +-
 .../windows_modify_registry_proxyserver.yml   |   5 +-
 ...y_registry_qakbot_binary_data_registry.yml |   5 +-
 ...ify_registry_regedit_silent_reg_import.yml |  23 +--
 .../windows_modify_registry_risk_behavior.yml |   4 +-
 ...y_registry_suppress_win_defender_notif.yml |   5 +-
 ...dows_modify_registry_tamper_protection.yml |   5 +-
 ...egistry_to_add_or_modify_firewall_rule.yml |   5 +-
 ...ify_registry_updateserviceurlalternate.yml |   5 +-
 .../windows_modify_registry_usewuserver.yml   |   3 +-
 ...indows_modify_registry_utilize_progids.yml |   5 +-
 ...ws_modify_registry_valleyrat_c2_config.yml |   7 +-
 ...odify_registry_valleyrat_pwn_reg_entry.yml |   5 +-
 ..._modify_registry_with_md5_reg_key_name.yml |   5 +-
 .../windows_modify_registry_wuserver.yml      |   3 +-
 ...windows_modify_registry_wustatusserver.yml |   3 +-
 ...w_compress_color_and_info_tip_registry.yml |   5 +-
 ...tem_firewall_with_notable_process_path.yml |   5 +-
 ..._mof_event_triggered_execution_via_wmi.yml |   5 +-
 .../windows_moveit_transfer_writing_aspx.yml  |  30 ++--
 ...s_mpcmdrun_removedefinitions_execution.yml |  30 ++--
 ...c_eviltwin_directory_path_manipulation.yml |   5 +-
 ...change_management_mailbox_cmdlet_usage.yml |   4 +-
 .../windows_mshta_execution_in_registry.yml   |  18 +--
 ...s_mshta_writing_to_world_writable_path.yml |  35 +----
 ..._script_deleted_by_non_msiexec_process.yml |  28 ++--
 .../windows_msiexec_dllregisterserver.yml     |  18 +--
 ..._msiexec_hidewindow_rundll32_execution.yml |  18 +--
 .../windows_msiexec_remote_download.yml       |  43 +++---
 ...indows_msiexec_spawn_discovery_command.yml |  14 +-
 .../endpoint/windows_msiexec_spawn_windbg.yml |  18 +--
 ...s_msiexec_unregister_dllregisterserver.yml |  18 +--
 .../windows_msix_package_interaction.yml      |  11 +-
 .../windows_msmpeng_writing_to_system32.yml   |  30 ++--
 .../windows_mstsc_rdp_commandline.yml         |  18 +--
 ...ows_multiple_account_passwords_changed.yml |   4 +-
 .../windows_multiple_accounts_deleted.yml     |   4 +-
 .../windows_multiple_accounts_disabled.yml    |   4 +-
 ...rs_failed_to_authenticate_wth_kerberos.yml |   8 +-
 ...rs_fail_to_authenticate_using_kerberos.yml |   8 +-
 ...sers_failed_to_authenticate_using_ntlm.yml |   8 +-
 ...tiple_ntlm_null_domain_authentications.yml |   5 +-
 ...o_authenticate_wth_explicitcredentials.yml |   8 +-
 ...d_to_authenticate_from_host_using_ntlm.yml |   8 +-
 ...rs_failed_to_authenticate_from_process.yml |   8 +-
 ..._failed_to_authenticate_using_kerberos.yml |   8 +-
 ...otely_failed_to_authenticate_from_host.yml |   8 +-
 ...ndows_mustang_panda_usb_tool_execution.yml |  61 +-------
 .../windows_net_system_service_discovery.yml  |  18 +--
 ...ndows_netspy_network_scanner_execution.yml |  43 +-----
 ...ort_rmm_dll_loaded_by_uncommon_process.yml |  45 ++----
 ...s_network_connection_discovery_via_net.yml |  23 +--
 ...ction_from_program_in_suspect_location.yml |  11 +-
 ...dows_network_share_interaction_via_net.yml |  23 +--
 ...windows_network_sniffing_tool_executed.yml |  48 ++-----
 ...ity_descriptor_set_on_eventlog_channel.yml |   5 +-
 ...new_default_file_association_value_set.yml |   5 +-
 ...ermission_set_on_service_sd_via_sc_exe.yml |  67 ++-------
 ...ntlog_channelaccess_registry_value_set.yml |   5 +-
 .../windows_new_inprocserver32_added.yml      |   5 +-
 ...ice_security_descriptor_set_via_sc_exe.yml |  46 ++----
 .../windows_ngrok_reverse_proxy_usage.yml     |  18 +--
 ...ndows_nirsoft_tool_bundle_file_created.yml |  23 +--
 .../endpoint/windows_nirsoft_utilities.yml    |  17 ++-
 ...ws_njrat_fileless_storage_via_registry.yml |   5 +-
 ...xecuting_js_script_in_immediate_folder.yml |  19 ++-
 ...non_discord_app_access_discord_leveldb.yml |   5 +-
 ...ows_non_system_account_targeting_lsass.yml |   5 +-
 ...tem_process_querying_definition_update.yml |  41 +-----
 .../windows_northstar_c2_agent_execution.yml  |  36 +----
 ...cated_files_or_information_via_rar_sfx.yml |  13 +-
 .../endpoint/windows_odbcconf_hunting.yml     |  16 +--
 .../endpoint/windows_odbcconf_load_dll.yml    |  18 +--
 .../windows_odbcconf_load_response_file.yml   |  18 +--
 ...office_product_dropped_cab_or_inf_file.yml |   4 +-
 ...s_office_product_dropped_uncommon_file.yml |   4 +-
 ...ws_office_product_loaded_mshtml_module.yml |   5 +-
 ...ws_office_product_loading_taskschd_dll.yml |   5 +-
 ...indows_office_product_loading_vbe7_dll.yml |   5 +-
 ...uct_spawned_child_process_for_download.yml |  22 +--
 ...windows_office_product_spawned_control.yml |  18 +--
 .../windows_office_product_spawned_msdt.yml   |  18 +--
 ...e_product_spawned_rundll32_with_no_dll.yml |  18 +--
 ...ffice_product_spawned_uncommon_process.yml |  45 +-----
 ...windows_onedrive_share_mounted_via_net.yml |  34 ++---
 ..._dialogs_disabled_from_unusual_process.yml |   5 +-
 ...ok_loadmacroprovideronboot_persistence.yml |   5 +-
 ...ok_macro_created_by_suspicious_process.yml |   5 +-
 ...indows_outlook_macro_security_modified.yml |   5 +-
 ..._outlook_webview_registry_modification.yml |   5 +-
 .../windows_papercut_ng_spawn_shell.yml       |  22 +--
 ...dows_parent_pid_spoofing_with_explorer.yml |  18 +--
 .../windows_password_managers_discovery.yml   |  22 +--
 ...ows_password_policy_discovery_with_net.yml |  20 +--
 .../windows_phantom_dll_created_on_disk.yml   |  52 ++-----
 ..._phishing_outlook_drop_dll_in_form_dir.yml |   5 +-
 ...ws_phishing_pdf_file_executes_url_link.yml |  18 +--
 ...dows_phishing_recent_iso_exec_registry.yml |   3 +-
 .../windows_possible_credential_dumping.yml   |  10 +-
 ...indows_post_exploitation_risk_behavior.yml |   4 +-
 ...to_privilege_escalation_tool_execution.yml |  61 ++------
 ...omainmanager_hijack_artifacts_creation.yml |  32 +----
 ...tential_cloudflared_network_connection.yml |   9 +-
 ...potential_cloudflared_tunnel_execution.yml |  42 +-----
 ...hell_creation_for_vmware_workspace_one.yml |  28 +---
 ...ll_add_module_to_global_assembly_cache.yml |  16 +--
 ...ndows_powershell_commands_from_dns_txt.yml |  41 ++----
 ...dows_powershell_cryptography_namespace.yml |  16 +--
 ...indows_powershell_disable_http_logging.yml |  16 +--
 .../windows_powershell_export_certificate.yml |  17 +--
 ...ndows_powershell_export_pfxcertificate.yml |  16 +--
 ...rshell_fakecaptcha_clipboard_execution.yml |  39 +----
 ...rshell_get_ciminstance_remote_computer.yml |  16 +--
 ...ndows_powershell_history_file_deletion.yml |  15 +-
 ...l_iis_components_webglobalmodule_usage.yml |  16 +--
 ...ows_powershell_import_applocker_policy.yml |  29 ++--
 ...e_restmethod_ip_information_collection.yml |  14 +-
 ...ows_powershell_invoke_sqlcmd_execution.yml |  11 +-
 ...ndows_powershell_logoff_user_via_quser.yml |  26 +---
 ...windows_powershell_module_file_created.yml |  30 +---
 ...s_powershell_msix_package_installation.yml |  26 ++--
 ...ess_implementing_manual_base64_decoder.yml |  53 +++----
 ...wershell_process_with_malicious_string.yml |   4 +-
 .../windows_powershell_remotesigned_file.yml  |  18 +--
 .../windows_powershell_scheduletask.yml       |  16 +--
 ...ell_script_block_with_malicious_string.yml |   5 +-
 ...hell_script_from_windowsapps_directory.yml |  45 ++----
 ...rshell_script_tabexpansion_direct_call.yml |  28 ++--
 ...dows_powershell_wmi_win32_scheduledjob.yml |  16 +--
 .../windows_powersploit_gpp_discovery.yml     |  16 +--
 ...iew_ad_access_control_list_enumeration.yml |  16 +--
 ...rview_constrained_delegation_discovery.yml |  16 +--
 ...erview_kerberos_service_ticket_request.yml |  16 +--
 .../windows_powerview_spn_discovery.yml       |  16 +--
 ...iew_unconstrained_delegation_discovery.yml |  16 +--
 .../windows_powgoop_beacon_decoding.yml       |  35 ++---
 .../windows_private_keys_discovery.yml        |  18 +--
 ...ge_escalation_attempt_via_msi_rollback.yml |  33 ++---
 ...scalation_suspicious_process_elevation.yml |  22 +--
 ...n_system_process_without_system_parent.yml |   9 +-
 ...tion_user_process_spawn_system_process.yml |  16 ++-
 .../windows_privileged_group_modification.yml |  74 ++--------
 ...ing_ironlanguages_repository_on_github.yml |  47 +++---
 ...ess_accessing_windows_recall_directory.yml |  38 ++---
 .../windows_process_commandline_discovery.yml |  16 +--
 ..._process_executed_from_removable_media.yml |   4 +-
 ...ows_process_execution_from_programdata.yml |  29 ++--
 ...ndows_process_execution_from_rdp_share.yml |  48 +++----
 .../windows_process_execution_in_temp_dir.yml |   3 +-
 ...injection_in_non_service_searchindexer.yml |  18 +--
 ...jection_into_commonly_abused_processes.yml |  12 +-
 ...indows_process_injection_remote_thread.yml |  39 +----
 ...process_injection_wermgr_child_process.yml |  20 +--
 ...ows_process_with_namedpipe_commandline.yml |  52 ++-----
 ...s_with_netexec_command_line_parameters.yml |  28 +---
 ...ss_writing_file_to_world_writable_path.yml |   5 +-
 ...ocesses_killed_by_industroyer2_malware.yml |  14 +-
 .../windows_product_key_registry_query.yml    |  26 ++--
 .../windows_protocol_tunneling_with_plink.yml |  25 +---
 ...xecution_of__net_utilities_via_scripts.yml |  55 +------
 .../endpoint/windows_proxy_via_netsh.yml      |  18 +--
 .../endpoint/windows_proxy_via_registry.yml   |   5 +-
 .../endpoint/windows_pstools_recon_usage.yml  |  77 +++-------
 .../endpoint/windows_pua_named_pipe.yml       |  22 +--
 .../windows_putty_suite_utility_execution.yml |  51 ++-----
 ...uery_registry_browser_list_application.yml |   5 +-
 ..._query_registry_uninstall_program_list.yml |   5 +-
 ...indows_raccine_scheduled_task_deletion.yml |  20 +--
 ...rapid_authentication_on_multiple_hosts.yml |   4 +-
 .../windows_rasautou_dll_execution.yml        |  18 +--
 ...ws_raw_access_to_disk_volume_partition.yml |   5 +-
 ...raw_access_to_master_boot_record_drive.yml |   5 +-
 ...ows_rdp_automaticdestinations_deletion.yml |  19 +--
 ...windows_rdp_bitmap_cache_file_creation.yml |   5 +-
 .../windows_rdp_cache_file_deletion.yml       |  31 ++--
 ...rdp_client_launched_with_admin_session.yml |  18 +--
 .../windows_rdp_connection_successful.yml     |   2 +-
 .../endpoint/windows_rdp_file_execution.yml   |   7 +-
 ...dows_rdp_login_session_was_established.yml |  17 +--
 .../windows_rdp_server_registry_deletion.yml  |   5 +-
 ...dows_rdp_server_registry_entry_created.yml |   5 +-
 ...s_rdpclient_connection_sequence_events.yml |  15 +-
 ...dows_registry_bootexecute_modification.yml |   5 +-
 .../windows_registry_certificate_added.yml    |   5 +-
 .../windows_registry_delete_task_sd.yml       |  40 ++----
 ...y_dotnet_etw_disabled_via_env_variable.yml |  37 ++---
 ...dows_registry_entries_exported_via_reg.yml |  18 +--
 ...dows_registry_entries_restored_via_reg.yml |  18 +--
 ...modification_for_safe_mode_persistence.yml |   5 +-
 .../windows_registry_payload_injection.yml    |  18 +--
 ...ows_registry_sip_provider_modification.yml |   5 +-
 ...remote_access_software_brc4_loaded_dll.yml |   4 +-
 ...ws_remote_access_software_rms_registry.yml |   5 +-
 ...ows_remote_assistance_spawning_process.yml |  18 +--
 .../windows_remote_create_service.yml         |   5 +-
 ...remote_host_computer_management_access.yml |  22 +--
 .../endpoint/windows_remote_image_load.yml    |  26 +---
 ...indows_remote_management_execute_shell.yml |  20 +--
 ...remote_service_rdpwinst_tool_execution.yml |  23 +--
 ..._remote_services_allow_rdp_in_firewall.yml |  23 +--
 ...emote_services_allow_remote_assistance.yml |   5 +-
 .../windows_remote_services_rdp_enable.yml    |   5 +-
 ...named_command_interpreter_was_executed.yml |  24 ++--
 ...ows_renamed_lolbas_binary_was_executed.yml |  25 ++--
 ...opular_3rd_party_software_was_executed.yml |  24 ++--
 ...ows_renamed_python_binary_was_executed.yml |  24 ++--
 ...ws_replication_through_removable_media.yml |   5 +-
 .../endpoint/windows_rmm_named_pipe.yml       |  22 +--
 .../endpoint/windows_rmm_tool_execution.yml   | 135 +-----------------
 ..._root_domain_linked_policies_discovery.yml |  16 +--
 ...ote_access_service_registry_key_change.yml |  39 ++---
 ...s_rundll32_apply_user_settings_changes.yml |  32 ++---
 ...indows_rundll32_execution_with_log_dll.yml |  32 ++---
 .../windows_rundll32_load_dll_in_temp_dir.yml |   5 +-
 .../windows_rundll32_webdav_request.yml       |   3 +-
 ...undll32_webdav_with_network_connection.yml |  18 ++-
 ...dll32_with_non_standard_file_extension.yml |  19 ++-
 .../windows_runmru_command_execution.yml      |   5 +-
 ...s_runmru_registry_key_or_value_deleted.yml |   5 +-
 ..._was_planted_in_sms_provider_directory.yml |  43 ++----
 ...xec_spawned_a_suspicious_child_process.yml |  60 ++------
 ..._task_created_in_a_group_policy_object.yml |  29 +---
 ...windows_scheduled_task_created_via_xml.yml |  30 +---
 ...ndows_scheduled_task_dll_module_loaded.yml |   5 +-
 ...s_scheduled_task_service_spawned_shell.yml |  58 ++------
 ...scheduled_task_with_highest_privileges.yml |   5 +-
 ...scheduled_task_with_suspicious_command.yml |   4 +-
 ...ws_scheduled_task_with_suspicious_name.yml |   4 +-
 ...tasks_for_compmgmtlauncher_or_eventvwr.yml |   5 +-
 .../windows_schtasks_create_run_as_system.yml |   5 +-
 ...curity_descriptor_tampering_via_sc_exe.yml |  23 +--
 .../windows_screen_capture_in_temp_folder.yml |   5 +-
 .../windows_screen_capture_via_powershell.yml |  23 +--
 ...ndows_security_account_manager_stopped.yml |   4 +-
 ...dows_security_and_backup_services_stop.yml |   4 +-
 ...ws_security_support_provider_reg_query.yml |   3 +-
 ...ows_sensitive_group_discovery_with_net.yml |  18 +--
 ...ive_registry_hive_dump_via_commandline.yml |  34 +----
 ...tware_component_gacutil_install_to_gac.yml |  18 +--
 ...dows_service_create_kernel_mode_driver.yml |  15 +-
 .../windows_service_create_remcomsvc.yml      |  12 +-
 .../windows_service_create_sliverc2.yml       |  13 +-
 .../windows_service_create_with_tscon.yml     |  18 +--
 ...e_created_with_suspicious_service_name.yml |   4 +-
 ...e_created_with_suspicious_service_path.yml |   5 +-
 ...ws_service_creation_on_remote_endpoint.yml |   5 +-
 ..._service_creation_using_registry_entry.yml |   5 +-
 .../windows_service_deletion_in_registry.yml  |   5 +-
 .../windows_service_execution_remcom.yml      |   5 +-
 ..._service_initiation_on_remote_endpoint.yml |   5 +-
 .../endpoint/windows_service_stop_attempt.yml |  23 +--
 .../windows_service_stop_by_deletion.yml      |  21 +--
 .../windows_service_stop_win_updates.yml      |  14 +-
 ...t_password_policy_to_unlimited_via_net.yml |  41 ++----
 ...ustom_dns_serverlevelplugin_via_dnscmd.yml |  33 +----
 ...ofile_category_to_private_via_registry.yml |   5 +-
 ...oint_spinstall0_webshell_file_creation.yml |   5 +-
 ...or_script_execution_from_iis_directory.yml |  36 +----
 .../windows_shell_process_from_crushftp.yml   |  21 +--
 .../windows_short_lived_dns_record.yml        |  15 +-
 .../windows_sip_provider_inventory.yml        |   3 +-
 ...winverifytrust_failed_trust_validation.yml |   4 +-
 ...snake_malware_file_modification_crmlog.yml |   5 +-
 ...s_snake_malware_kernel_driver_comadmin.yml |   5 +-
 ...istry_modification_wav_openwithprogids.yml |   5 +-
 .../windows_snake_malware_service_create.yml  |   5 +-
 ...windows_snappybee_create_test_registry.yml |   5 +-
 .../windows_soaphound_binary_execution.yml    |  22 +--
 ..._vpn_masquerading_as_legitimate_binary.yml |  34 +----
 ...dows_software_discovery_via_powershell.yml |  27 ++--
 ...hishing_attachment_onenote_spawn_mshta.yml |  18 +--
 ...ial_privileged_logon_on_multiple_hosts.yml |   4 +-
 ...s_speechruntime_com_hijacking_dll_load.yml |  20 +--
 ...speechruntime_suspicious_child_process.yml |  21 +--
 ...s_sql_server_configuration_option_hunt.yml |   4 +-
 ...sql_server_critical_procedures_enabled.yml |   6 +-
 ...er_extended_procedure_dll_loading_hunt.yml |   4 +-
 .../windows_sql_server_startup_procedure.yml  |   7 +-
 ...s_sql_server_xp_cmdshell_config_change.yml |   4 +-
 .../windows_sql_spawning_certutil.yml         |  18 +--
 .../endpoint/windows_sqlcmd_execution.yml     |  15 +-
 .../windows_sqlservr_spawning_shell.yml       |  20 +--
 ...ndows_sqlwriter_sqldumper_dll_sideload.yml |   7 +-
 .../endpoint/windows_ssh_proxy_command.yml    |  57 ++------
 ...thentication_certificates___esc1_abuse.yml |   5 +-
 ...ion_certificates___esc1_authentication.yml |   4 +-
 ...cation_certificates_certificate_issued.yml |   4 +-
 ...ation_certificates_certificate_request.yml |   4 +-
 ...ntication_certificates_certutil_backup.yml |  18 +--
 ..._authentication_certificates_cryptoapi.yml |   4 +-
 ..._authentication_certificates_cs_backup.yml |   4 +-
 ...cation_certificates_export_certificate.yml |  18 +--
 ...ion_certificates_export_pfxcertificate.yml |  18 +--
 ..._steal_or_forge_kerberos_tickets_klist.yml |  18 +--
 .../endpoint/windows_subinacl_execution.yml   |  22 +--
 ...ct_process_with_authentication_traffic.yml |   5 +-
 ...s_suspicious_burst_of_password_changes.yml |  48 +------
 .../windows_suspicious_c2_named_pipe.yml      |  12 +-
 ...uspicious_child_process_of_consent_exe.yml |  42 ++----
 ...ld_process_of_tieringengineservice_exe.yml |  65 +--------
 ...s_child_process_spawned_from_webserver.yml |  22 +--
 ...nder_engine_or_signature_files_created.yml |  37 ++---
 ..._defender_update_activity_in_inetcache.yml |  33 ++---
 .../windows_suspicious_driver_loaded_path.yml |   5 +-
 .../windows_suspicious_file_in_efi_volume.yml |  29 +---
 .../windows_suspicious_named_pipe.yml         |  20 +--
 .../windows_suspicious_process_file_path.yml  |   3 +-
 .../windows_suspicious_qemu_execution.yml     |  34 +----
 ...picious_react_or_next_js_child_process.yml | 103 ++-----------
 ..._suspicious_vmware_tools_child_process.yml |   3 +-
 ...ows_svchost_exe_parent_process_anomaly.yml |   5 +-
 ...iclink_testing_tools_utility_execution.yml |  43 ++----
 ...s_symlink_evaluation_change_via_fsutil.yml |  51 +++----
 ...execution_compiled_html_file_decompile.yml |  18 +--
 ...s_system_discovery_using_ldap_nslookup.yml |  23 +--
 ...windows_system_discovery_using_qwinsta.yml |  18 +--
 .../endpoint/windows_system_file_on_disk.yml  |  14 +-
 .../windows_system_logoff_commandline.yml     |  23 +--
 ...m_network_config_discovery_display_dns.yml |  22 +--
 ...em_network_connections_discovery_netsh.yml |  30 +---
 .../windows_system_reboot_commandline.yml     |  21 +--
 ...ows_system_remote_discovery_with_query.yml |  21 +--
 ...oxy_execution_syncappvpublishingserver.yml |  18 +--
 .../windows_system_shutdown_commandline.yml   |   5 +-
 ...dows_system_time_discovery_w32tm_delay.yml |  18 +--
 ...indows_system_user_discovery_via_quser.yml |  18 +--
 ...indows_system_user_privilege_discovery.yml |  16 +--
 ..._payload_execution_from_temp_directory.yml |  36 +----
 .../windows_teamcity_plugin_installed.yml     |  29 +---
 .../windows_terminating_lsass_process.yml     |  10 +-
 ...heme_file_creation_in_unusual_location.yml |  32 +----
 .../endpoint/windows_time_based_evasion.yml   |  53 ++-----
 ...ows_time_based_evasion_via_choice_exec.yml |  18 +--
 .../windows_tinycc_shellcode_execution.yml    |  54 +++----
 .../endpoint/windows_tor_client_execution.yml |  50 +++----
 ...ws_uac_bypass_suspicious_child_process.yml |   5 +-
 ..._bypass_suspicious_escalation_behavior.yml |  20 ++-
 ...ote_thread_creation_in_browser_process.yml | 124 ++--------------
 ...dows_universal_data_link_file_creation.yml |  30 +---
 ...outlook_credentials_access_in_registry.yml |  33 ++---
 .../windows_unsigned_dll_side_loading.yml     |   5 +-
 ..._dll_side_loading_in_same_process_path.yml |   5 +-
 .../windows_unsigned_ms_dll_side_loading.yml  |   4 +-
 ...abled_users_failed_auth_using_kerberos.yml |   8 +-
 ...alid_users_fail_to_auth_using_kerberos.yml |   8 +-
 ...nvalid_users_failed_to_auth_using_ntlm.yml |   8 +-
 ...s_fail_to_auth_wth_explicitcredentials.yml |   8 +-
 ...of_users_failed_to_auth_using_kerberos.yml |   8 +-
 ...rs_failed_to_authenticate_from_process.yml |   8 +-
 ...sers_failed_to_authenticate_using_ntlm.yml |   8 +-
 ...sers_remotely_failed_to_auth_from_host.yml |   8 +-
 ..._file_creation_in_confluence_directory.yml |  46 ++----
 ...ws_unusual_filezilla_xml_config_access.yml |   5 +-
 ...al_intelliform_storage_registry_access.yml |   5 +-
 ..._authentication_destinations_by_source.yml |   2 +-
 ...lm_authentication_destinations_by_user.yml |   2 +-
 ...lm_authentication_users_by_destination.yml |   2 +-
 ...al_ntlm_authentication_users_by_source.yml |   2 +-
 ...rocess_load_mozilla_nss_mozglue_module.yml |   5 +-
 ...swow64_process_run_system32_executable.yml |   5 +-
 ...dows_usbstor_registry_key_modification.yml |  19 +--
 .../windows_user_deletion_via_net.yml         |  22 +--
 .../windows_user_disabled_via_net.yml         |  22 +--
 .../windows_user_discovery_via_net.yml        |  49 ++-----
 ..._execution_malicious_url_shortcut_file.yml |   5 +-
 ...al_basic_commandline_compiler_dnsquery.yml |  17 +--
 ...ssvc_process_accessing_defender_engine.yml |  38 ++---
 .../windows_vulnerable_3cx_software.yml       |  17 +--
 .../windows_vulnerable_driver_installed.yml   |   4 +-
 .../windows_vulnerable_driver_loaded.yml      |   2 +-
 ...dows_wbadmin_file_recovery_from_backup.yml |  46 +++---
 ...rmgr_alternate_data_stream_in_temp_dir.yml |  33 ++---
 ...rmgr_spawning_system_integrity_process.yml |  42 ++----
 .../windows_windbg_spawning_autoit3.yml       |   5 +-
 ...inlogon_with_public_network_connection.yml |   2 +-
 ...ws_winpeas_powershell_script_execution.yml |  30 +---
 ...outside_default_installation_directory.yml |  34 ++---
 ...s_winscp_configuration_security_access.yml |  34 ++---
 .../windows_wmi_impersonate_token.yml         |  10 +-
 .../windows_wmi_process_and_service_list.yml  |  18 +--
 .../windows_wmi_process_call_create.yml       |  16 +--
 ...windows_wmi_reconnaissance_class_query.yml |  59 +-------
 .../endpoint/windows_wmic_cpu_discovery.yml   |  18 +--
 .../windows_wmic_diskdrive_discovery.yml      |  18 +--
 .../windows_wmic_memory_chip_discovery.yml    |  18 +--
 .../windows_wmic_network_discovery.yml        |  18 +--
 .../windows_wmic_shadowcopy_delete.yml        |  10 +-
 .../windows_wmic_systeminfo_discovery.yml     |  18 +--
 ...s_wpdbusenum_registry_key_modification.yml |  21 +--
 .../endpoint/windows_wsus_spawning_shell.yml  |  24 +---
 ...e_creation_outside_of_typical_location.yml |  33 +----
 ..._scheduled_task_created_to_spawn_shell.yml |  12 +-
 ...eduled_task_created_within_public_path.yml |  15 +-
 ...ws_task_scheduler_event_action_started.yml |   3 +-
 .../endpoint/winhlp32_spawning_a_process.yml  |   5 +-
 .../winrar_spawning_shell_application.yml     |  20 +--
 .../endpoint/winrm_spawning_a_process.yml     |  16 +--
 .../wmi_permanent_event_subscription.yml      |  14 +-
 ..._permanent_event_subscription___sysmon.yml |  29 +---
 .../wmi_recon_running_process_or_services.yml |  16 +--
 detections/endpoint/wmic_group_discovery.yml  |  18 +--
 ...wmic_noninteractive_app_uninstallation.yml |  16 +--
 .../endpoint/wmic_xsl_execution_via_url.yml   |  46 +++---
 ...miprvse_lolbas_execution_process_spawn.yml |  21 +--
 ...pt_or_cscript_suspicious_child_process.yml |   3 +-
 ...rovhost_lolbas_execution_process_spawn.yml |  19 +--
 detections/endpoint/wsreset_uac_bypass.yml    |   5 +-
 .../xsl_script_execution_with_wmic.yml        |  18 +--
 ...supply_chain_attack_network_indicators.yml |   2 +-
 ...configuration_archive_logging_analysis.yml |   6 +-
 ...suspicious_privileged_account_creation.yml |   6 +-
 .../cisco_network_interface_modifications.yml |   6 +-
 ...t_creation_with_http_command_execution.yml |  17 +--
 ..._creation_with_suspicious_ssh_activity.yml |  15 +-
 ...sco_sa___access_to_anonymizer_services.yml |  28 ++--
 ..._reconnaissance_via_http_access_errors.yml |  23 +--
 ...y_file_overwrite_exploitation_activity.yml |  20 +--
 ...isco_sd_wan___low_frequency_rogue_peer.yml |  30 ++--
 .../cisco_sd_wan___peering_activity.yml       |  27 ++--
 ...uncommon_user_agent_multi_uri_activity.yml |  18 +--
 ...e_firewall___binary_file_type_download.yml |  22 ++-
 ...ecure_firewall___bits_network_activity.yml |  27 ++--
 ...lacklisted_ssl_certificate_fingerprint.yml |  20 ++-
 ...o_secure_firewall___blocked_connection.yml |  20 +--
 ...trix_netscaler_memory_overread_attempt.yml |  49 +++----
 ...___communication_over_suspicious_ports.yml |  37 +++--
 ...ll___connection_to_file_sharing_domain.yml |  37 +++--
 ...all___file_download_over_uncommon_port.yml |  17 ++-
 ..._firewall___high_eve_threat_confidence.yml |  35 +++--
 ...high_priority_intrusion_classification.yml |  48 +++----
 ...gh_volume_of_intrusion_events_per_host.yml |  28 ++--
 ...___intrusion_events_by_threat_activity.yml |  45 ++++--
 ...cure_firewall___lumma_stealer_activity.yml |  23 +--
 ...ewall___lumma_stealer_download_attempt.yml |  30 ++--
 ...ma_stealer_outbound_connection_attempt.yml |  30 ++--
 ...ure_firewall___malware_file_downloaded.yml |  17 ++-
 ...___oracle_e_business_suite_correlation.yml |  24 ++--
 ...__oracle_e_business_suite_exploitation.yml |  46 +++---
 ...e_firewall___possibly_compromised_host.yml |  32 ++---
 ...firewall___potential_data_exfiltration.yml |  40 +++---
 ..._privileged_command_execution_via_http.yml |  46 ++----
 ...e_firewall___rare_snort_rule_triggered.yml |  32 ++---
 ...___react_server_components_rce_attempt.yml |  49 +++----
 ...__remote_access_software_usage_traffic.yml |  29 ++--
 ...irewall___repeated_blocked_connections.yml |  26 ++--
 ..._firewall___repeated_malware_downloads.yml |  19 ++-
 ...t_rule_triggered_across_multiple_hosts.yml |  19 ++-
 ...___ssh_connection_to_non_standard_port.yml |  46 ++----
 ...rewall___ssh_connection_to_sshd_operns.yml |  47 +++---
 ...ll___static_tundra_smart_install_abuse.yml |  27 ++--
 ...m_cve_2023_27532_exploitation_activity.yml |  24 ++--
 ...ecure_firewall___wget_or_curl_download.yml |  38 +++--
 ...art_install_oversized_packet_detection.yml |  28 ++--
 ...mart_install_port_discovery_and_status.yml |   6 +-
 ...community_string_configuration_changes.yml |   6 +-
 ...er_configuration_for_data_exfiltration.yml |   6 +-
 detections/network/detect_arp_poisoning.yml   |  10 +-
 ..._dns_query_to_decommissioned_s3_bucket.yml |   6 +-
 ...connecting_to_dynamic_domain_providers.yml |   4 +-
 ...ct_ipv6_network_infrastructure_threats.yml |  12 +-
 .../network/detect_outbound_ldap_traffic.yml  |  35 +----
 .../network/detect_outbound_smb_traffic.yml   |   2 +-
 .../detect_port_security_violation.yml        |  10 +-
 ...etect_remote_access_software_usage_dns.yml |   2 +-
 ...t_remote_access_software_usage_traffic.yml |   9 +-
 .../network/detect_rogue_dhcp_server.yml      |   9 +-
 .../detect_snicat_sni_exfiltration.yml        |   2 +-
 ...ct_software_download_to_network_device.yml |   2 +-
 .../network/detect_traffic_mirroring.yml      |   9 +-
 ...ect_unauthorized_assets_by_mac_address.yml |   2 +-
 .../network/detect_zerologon_via_zeek.yml     |   2 +-
 detections/network/dns_kerberos_coercion.yml  |  19 +--
 ...ry_length_with_high_standard_deviation.yml |   4 +-
 detections/network/excessive_dns_failures.yml |   2 +-
 ...ntrol_rest_vulnerability_cve_2022_1388.yml |  32 ++---
 ...e_of_network_traffic_from_email_server.yml |   3 +-
 .../network/http_c2_framework_user_agent.yml  |   6 +-
 .../network/http_malware_user_agent.yml       |   6 +-
 ...http_post_request_with_encoded_payload.yml |  52 ++-----
 detections/network/http_pua_user_agent.yml    |   6 +-
 detections/network/http_rmm_user_agent.yml    |   6 +-
 .../network/internal_horizontal_port_scan.yml |   4 +-
 ...ernal_horizontal_port_scan_nmap_top_20.yml |   2 +-
 .../network/internal_vertical_port_scan.yml   |   2 +-
 .../network/internal_vulnerability_scan.yml   |   2 +-
 .../large_volume_of_dns_any_queries.yml       |   2 +-
 .../ngrok_reverse_proxy_on_network.yml        |  14 +-
 .../prohibited_network_traffic_allowed.yml    |  24 ++--
 .../network/protocol_or_port_mismatch.yml     |   2 +-
 ...ls_passing_authentication_in_cleartext.yml |   4 +-
 .../remote_desktop_network_traffic.yml        |   6 +-
 detections/network/rundll32_dnsquery.yml      |  16 +--
 detections/network/smb_traffic_spike.yml      |   2 +-
 .../ssl_certificates_with_punycode.yml        |   2 +-
 ...ess_dns_query_known_abuse_web_services.yml |   5 +-
 ...picious_process_with_discord_dns_query.yml |   5 +-
 detections/network/tor_traffic.yml            |  32 ++---
 .../network/unusual_ssh_client_banner.yml     |  63 ++------
 ...ss_connecting_to_ip_check_web_services.yml |  16 +--
 .../network/windows_abused_web_services.yml   |  55 +------
 ...windows_ad_replication_service_traffic.yml |   2 +-
 ...gue_domain_controller_network_activity.yml |   2 +-
 ..._dns_query_request_by_telegram_bot_api.yml |  16 +--
 ...ork_info_through_ip_check_web_services.yml |  16 +--
 ...dows_multi_hop_proxy_tor_website_query.yml |  16 +--
 ...ote_desktop_network_bruteforce_attempt.yml |   4 +-
 ...hment_connect_to_none_ms_office_domain.yml |   3 +-
 .../zeek_x509_certificate_with_punycode.yml   |   2 +-
 ...vanti_connect_secure_bookmark_endpoint.yml |  13 +-
 ...adobe_coldfusion_access_control_bypass.yml |  45 ++----
 ...on_unauthenticated_arbitrary_file_read.yml |  42 +++---
 .../web/cisco_ios_xe_implant_access.yml       |  35 ++---
 ...ateway_citrixbleed_2_memory_disclosure.yml |  33 ++---
 ...d_gateway_unauthorized_data_disclosure.yml |  14 +-
 .../citrix_adc_exploitation_cve_2023_3519.yml |  34 +----
 ..._sharefile_exploitation_cve_2023_24489.yml |  35 +----
 ...e_cve_2023_22515_trigger_vulnerability.yml |  14 +-
 ...center_and_server_privilege_escalation.yml |  14 +-
 ..._rce_via_ognl_injection_cve_2023_22527.yml |  13 +-
 ...d_remote_code_execution_cve_2022_26134.yml |  48 +------
 ...se_screenconnect_authentication_bypass.yml |   6 +-
 ...ftp_authentication_bypass_exploitation.yml |   7 +-
 ...rushftp_max_simultaneous_users_from_ip.yml |   7 +-
 ..._scanning_for_vulnerable_jboss_servers.yml |   2 +-
 ...ious_requests_to_exploit_jboss_servers.yml |   2 +-
 ...etect_remote_access_software_usage_url.yml |  15 +-
 ...web_access_to_decommissioned_s3_bucket.yml |   6 +-
 ...ng_application_via_apache_commons_text.yml |   4 +-
 ...acing_fortinet_fortinac_cve_2022_39952.yml |  34 ++---
 .../web/f5_tmui_authentication_bypass.yml     |  14 +-
 .../web/fortinet_appliance_auth_bypass.yml    |  38 ++---
 .../web/high_volume_of_bytes_out_to_url.yml   |  11 +-
 detections/web/http_duplicated_header.yml     |   6 +-
 .../web/http_possible_request_smuggling.yml   |   6 +-
 ...ttp_rapid_post_with_mixed_status_codes.yml |   4 +-
 ...request_to_reserved_name_on_iis_server.yml |  21 ++-
 .../web/http_scripting_tool_user_agent.yml    |   4 +-
 detections/web/hunting_for_log4shell.yml      |   3 +-
 ...nect_secure_command_injection_attempts.yml |  13 +-
 ..._connect_secure_ssrf_in_saml_component.yml |  13 +-
 ...tem_information_access_via_auth_bypass.yml |  13 +-
 ...pm_sql_injection_remote_code_execution.yml |  40 ++----
 ...uthenticated_api_access_cve_2023_35078.yml |  38 ++---
 ...uthenticated_api_access_cve_2023_35082.yml |  38 ++---
 ...class_file_download_by_java_user_agent.yml |   4 +-
 ...ins_arbitrary_file_read_cve_2024_23897.yml |  13 +-
 ...y_authentication_bypass_cve_2024_27198.yml |  21 +--
 ...ication_bypass_suricata_cve_2024_27198.yml |  14 +-
 ...ed_auth_bypass_suricata_cve_2024_27199.yml |  14 +-
 .../web/jetbrains_teamcity_rce_attempt.yml    |  36 ++---
 ...emote_code_execution_exploit_detection.yml |  14 +-
 ...g4shell_jndi_payload_injection_attempt.yml |   4 +-
 ...oad_injection_with_outbound_connection.yml |   4 +-
 ...arepoint_server_elevation_of_privilege.yml |  33 ++---
 ...ltiple_archive_files_http_post_traffic.yml |  17 +--
 ...se_screenconnect_authentication_bypass.yml |  15 +-
 .../papercut_ng_remote_web_access_attempt.yml |  17 +--
 .../web/plain_http_post_exfiltrated_data.yml  |  13 +-
 ...yshell_proxynotshell_behavior_detected.yml |   4 +-
 ...r_visual_composer_exploitation_attempt.yml |  53 ++-----
 .../web/spring4shell_payload_url_request.yml  |  13 +-
 .../web/sql_injection_with_long_urls.yml      |   2 +-
 detections/web/supernova_webshell.yml         |   2 +-
 ...tomcat_session_deserialization_attempt.yml |   6 +-
 .../tomcat_session_file_upload_attempt.yml    |   6 +-
 .../web/unusual_http_request_method.yml       |  67 ++-------
 .../unusually_long_content_type_length.yml    |  10 +-
 ...vmware_aria_operations_exploit_attempt.yml |  38 ++---
 ...re_server_side_template_injection_hunt.yml |  36 ++---
 ...emarker_server_side_template_injection.yml |  35 ++---
 detections/web/web_jsp_request_via_url.yml    |  13 +-
 .../web/web_remote_shellservlet_access.yml    |  14 +-
 ...spring4shell_http_request_class_module.yml |  14 +-
 ...b_spring_cloud_function_functionrouter.yml |   4 +-
 ...ndows_exchange_autodiscover_ssrf_abuse.yml |   4 +-
 ...windows_iis_server_pswa_console_access.yml |   4 +-
 ...dows_sharepoint_spinstall0_get_request.yml |  16 +--
 ...toolpane_endpoint_exploitation_attempt.yml |  18 +--
 .../wordpress_bricks_builder_plugin_rce.yml   |  14 +-
 .../web/ws_ftp_remote_code_execution.yml      |  37 ++---
 ...caler_adware_activities_threat_blocked.yml |   4 +-
 ...caler_behavior_analysis_threat_blocked.yml |   4 +-
 ..._cryptominer_downloaded_threat_blocked.yml |   4 +-
 ...zscaler_employment_search_web_activity.yml |   4 +-
 .../web/zscaler_exploit_threat_blocked.yml    |   4 +-
 ...zscaler_legal_liability_threat_blocked.yml |   4 +-
 ...scaler_malware_activity_threat_blocked.yml |   4 +-
 ...caler_phishing_activity_threat_blocked.yml |   4 +-
 ...caler_potentially_abused_file_download.yml |   4 +-
 ...ivacy_risk_destinations_threat_blocked.yml |   4 +-
 ...caler_scam_destinations_threat_blocked.yml |   4 +-
 .../zscaler_virus_download_threat_blocked.yml |   4 +-
 2182 files changed, 10348 insertions(+), 25904 deletions(-)

diff --git a/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml b/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml
index ceb99790901..7744803f91e 100644
--- a/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml
+++ b/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This detection identifies potential cross-region inference abuse in AWS Bedrock Claude models. Cross-region inference abuse may indicate attempts to bypass regional restrictions, exfiltrate data, or perform unauthorized actions across different AWS regions.
 data_source:
     - AWS Bedrock Claude
-search: |-
+search: |
     `aws_bedrock_claude`
     | rename "identity.arn" AS user_arn
     | rename "input.inputTokenCount" AS input_tokens
@@ -43,7 +43,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -63,8 +63,8 @@ category: application
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_cross_region_possible_inference_abuse.ndjson
-          sourcetype: json_no_timestamp
           source: http:bulkawsbedrock
+          sourcetype: json_no_timestamp
+      test_type: unit
diff --git a/detections/application/aws_bedrock_claude_excessive_use_of_tokens.yml b/detections/application/aws_bedrock_claude_excessive_use_of_tokens.yml
index 20242b21612..9f91b58ce3c 100644
--- a/detections/application/aws_bedrock_claude_excessive_use_of_tokens.yml
+++ b/detections/application/aws_bedrock_claude_excessive_use_of_tokens.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: Detects identities generating anomalously large model responses relative to their own historical baseline. For each identity, computes the average, maximum, and standard deviation of output token counts across all invocations, then flags any identity whose single largest response exceeds two standard deviations above their own mean. A statistically significant output spike from a single identity may indicate bulk data extraction, successful prompt injection producing verbose output, or a runaway agentic loop hitting context limits.
 data_source:
     - AWS Bedrock Claude
-search: |-
+search: |
     `aws_bedrock_claude`
     | spath output="out_tokens" path="output.outputBodyJson.usage.output_tokens"
     | eval user = replace('identity.arn', ".*/", "")
@@ -46,7 +46,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -68,6 +68,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_excessive_use_of_tokens.ndjson
-          sourcetype: json_no_timestamp
           source: http:bulkawsbedrock
+          sourcetype: json_no_timestamp
       test_type: unit
diff --git a/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml b/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml
index d89921d2811..dfe34a63e1c 100644
--- a/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml
+++ b/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: Detects identities invoking high-risk filesystem and execution tools via AWS Bedrock Claude. For each identity, monitors the usage of potentially dangerous commands and flags any anomalous activity that deviates from their historical baseline. This may indicate attempts to escalate privileges, exfiltrate data, or execute unauthorized commands.
 data_source:
     - AWS Bedrock Claude
-search: |-
+search: |
     `aws_bedrock_claude`
     | spath output="tool_called"       path="output.outputBodyJson{}.content_block.toolUse.name"
     | spath output="out_tokens_stream" path="output.outputBodyJson{}.usage.output_tokens"
@@ -81,7 +81,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -103,6 +103,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.ndjson
-          sourcetype: json_no_timestamp
           source: http:bulkawsbedrock
+          sourcetype: json_no_timestamp
       test_type: unit
diff --git a/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml b/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml
index 1070ebd0da5..e5a2b2a7e56 100644
--- a/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml
+++ b/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This detection identifies prompts with hostile or aggressive sentiment being sent to AWS Bedrock Claude models. Hostile prompts may indicate potential abuse, harassment, or other malicious intent.
 data_source:
     - AWS Bedrock Claude
-search: |-
+search: |
     `aws_bedrock_claude`
     | rename "identity.arn" AS user_arn
     | rename "input.inputBodyJson.messages{}.content{}.text" AS prompt_text
@@ -43,7 +43,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$host$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
@@ -63,8 +63,8 @@ category: application
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_hostile_prompt_sentiment.ndjson
-          sourcetype: json_no_timestamp
           source: http:bulkawsbedrock
+          sourcetype: json_no_timestamp
+      test_type: unit
diff --git a/detections/application/aws_bedrock_claude_possible_prompt_injection.yml b/detections/application/aws_bedrock_claude_possible_prompt_injection.yml
index 74e80256de1..bc21c54886b 100644
--- a/detections/application/aws_bedrock_claude_possible_prompt_injection.yml
+++ b/detections/application/aws_bedrock_claude_possible_prompt_injection.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: This search surfaces AWS Bedrock Claude prompts containing phrases commonly associated with prompt injection or jailbreak attempts, such as instruction overrides, persona switching, or requests to ignore prior guidance. These strings are not inherently malicious on their own - many of them (for example "act as", "you must", or "new persona") appear routinely in legitimate system prompts, few-shot examples, and role-play or creative-writing use cases. This is a hunting search rather than an anomaly detection because the base rate of benign matches is high; use it to pivot into the surrounding conversation and look for corroborating signals such as the phrase appearing mid-conversation rather than in an expected system/few-shot prompt, the user attempting to override guardrails or safety instructions rather than set a benign persona, instructions that follow the injected phrase requesting privilege escalation, data exfiltration, or access to restricted tools/resources, repeated or iterative attempts from the same user/role after being refused, and injected phrases originating from untrusted input (e.g., retrieved documents or tool output) rather than the human user turn.
 data_source:
     - AWS Bedrock Claude
-search: |-
+search: |
     `aws_bedrock_claude`
     | rename "identity.arn" AS user_arn, "input.inputBodyJson.messages{}.content{}.text" AS prompt_mv
     | eval prompt_text = mvjoin(prompt_mv, " || ")
@@ -40,7 +40,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$host$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 analytic_story:
     - Suspicious AWS Bedrock Claude Activities
 asset_type: Web Application
@@ -54,8 +54,8 @@ category: application
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_possible_prompt_injection.ndjson
-          sourcetype: json_no_timestamp
           source: http:bulkawsbedrock
+          sourcetype: json_no_timestamp
+      test_type: unit
diff --git a/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml b/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml
index 2e14dadae53..f25eda03404 100644
--- a/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml
+++ b/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This detection identifies sensitive data such as social security numbers, passwords, API keys, and credit card numbers being sent in prompts to AWS Bedrock Claude models. Exposure of sensitive data through AI prompts may indicate data loss, credential leakage, or insider threat activity.
 data_source:
     - AWS Bedrock Claude
-search: |-
+search: |
     `aws_bedrock_claude`
     | rename "identity.arn" AS user_arn, "input.inputBodyJson.messages{}.content{}.text" AS prompt_mv, "accountId" AS account_id
     | eval prompt_text = mvjoin(prompt_mv, " || ")
@@ -39,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$host$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
@@ -59,8 +59,8 @@ category: application
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_sensitive_data_in_prompts.ndjson
-          sourcetype: json_no_timestamp
           source: http:bulkawsbedrock
+          sourcetype: json_no_timestamp
+      test_type: unit
diff --git a/detections/application/aws_bedrock_claude_unusually_large_prompts.yml b/detections/application/aws_bedrock_claude_unusually_large_prompts.yml
index f3e883a80ee..08ce18ed013 100644
--- a/detections/application/aws_bedrock_claude_unusually_large_prompts.yml
+++ b/detections/application/aws_bedrock_claude_unusually_large_prompts.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed one standard deviations above the mean. Abnormally large prompts may indicate prompt injection attacks, data exfiltration attempts, or abuse of the AI service.
 data_source:
     - AWS Bedrock Claude
-search: |-
+search: |
     `aws_bedrock_claude`
     | rename "input.inputTokenCount" AS input_tokens
     | rename "identity.arn" AS user_arn
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$host$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
@@ -58,8 +58,8 @@ category: application
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_unusually_large_prompts.ndjson
-          sourcetype: json_no_timestamp
           source: http:bulkawsbedrock
+          sourcetype: json_no_timestamp
+      test_type: unit
diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
index cf1d7ef9e39..a0f0d7a1902 100644
--- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
+++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The search surfaces alerts from the Cisco AI Defense product for potential attacks against the AI models running in your environment. This analytic identifies security events within Cisco AI Defense by examining event messages, actions, and policy names. It focuses on connections and applications associated with specific guardrail entities and ruleset types. By aggregating and analyzing these elements, the search helps detect potential policy violations and security threats, enabling proactive defense measures and ensuring network integrity.
 data_source:
     - Cisco AI Defense Alerts
-search: |-
+search: |
     `cisco_ai_defense`
       | rename genai_application.application_name as application_name
       | rename connection.connection_name as connection_name
@@ -51,7 +51,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$application_name$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$application_name$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: application_name
diff --git a/detections/application/cisco_asa___aaa_policy_tampering.yml b/detections/application/cisco_asa___aaa_policy_tampering.yml
index 8960f2804ba..de05cc78717 100644
--- a/detections/application/cisco_asa___aaa_policy_tampering.yml
+++ b/detections/application/cisco_asa___aaa_policy_tampering.yml
@@ -6,46 +6,29 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects modifications to authentication and authorization (AAA) security policies on Cisco ASA devices via CLI or ASDM.
+description: 'This analytic detects modifications to authentication and authorization (AAA) security policies on Cisco ASA devices via CLI or ASDM.
+
     AAA policies control critical security mechanisms including authentication attempts, lockout thresholds, password policies, and access control settings that protect administrative access to network infrastructure.
+
     Adversaries or malicious insiders may weaken authentication policies to facilitate brute force attacks, disable account lockouts to enable unlimited password attempts, reduce password complexity requirements, or modify authorization settings to elevate privileges and maintain persistent access.
+
     The detection monitors for command execution events containing AAA-related commands such as `aaa authentication`, `aaa authorization`, or `aaa local authentication`, focusing on changes to authentication attempts, lockout policies, and access control configurations.
-    Investigate any unauthorized modifications to AAA policies, especially changes that weaken security posture (increasing max-fail attempts, disabling lockouts, reducing password requirements), and verify these changes against approved change management processes and security policies.
+
+    Investigate any unauthorized modifications to AAA policies, especially changes that weaken security posture (increasing max-fail attempts, disabling lockouts, reducing password requirements), and verify these changes against approved change management processes and security policies.'
 data_source:
     - Cisco ASA Logs
 search: |
-    `cisco_asa`
-    message_id IN (111008, 111010)
-    command IN (
-        "aaa authentication*",
-        "aaa authorization*",
-        "aaa local authentication*",
-        "aaa-server*",
-        "no aaa*"
-    )
-    | fillnull
-    | stats count
-            earliest(_time) as firstTime
-            latest(_time) as lastTime
-            values(user) as user
-            values(action) as action
-            values(message_id) as message_id
-            values(command) as command
-            values(src_ip) as src_ip
-            values(process_name) as process_name
-      by host
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_asa___aaa_policy_tampering_filter`
-how_to_implement: |
-    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+    `cisco_asa` message_id IN ("111008", "111010") command IN ("aaa authentication*", "aaa authorization*", "aaa local authentication*", "aaa-server*", "no aaa*") | eval user=user, dest=dest, remote_protocol=remote_protocol, privilege_level=privilege_level, old_privilege_level=old_privilege_level, new_privilege_level=new_privilege_level | stats count min(_time) as firstTime max(_time) as lastTime by message_id command host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_asa___aaa_policy_tampering_filter`
+how_to_implement: 'This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+
     To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
-    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
+
+    If your logging level is set to ''Notifications'' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
+
     You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
-    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
-known_false_positives: |
-    Legitimate AAA configuration modifications may occur during normal administrative activities such as implementing new security policies, adjusting lockout thresholds or troubleshooting authentication issues. These events should be verified and investigated. Consider filtering modifications performed by known administrative accounts where necessary.
+
+    You can also change the severity level of the above message id''s to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da'
+known_false_positives: Legitimate AAA configuration modifications may occur during normal administrative activities such as implementing new security policies, adjusting lockout thresholds or troubleshooting authentication issues. These events should be verified and investigated. Consider filtering modifications performed by known administrative accounts where necessary.
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/A-H/asa-command-ref-A-H/aa-ac-commands.html
 drilldown_searches:
@@ -56,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for $host$
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
diff --git a/detections/application/cisco_asa___core_syslog_message_volume_drop.yml b/detections/application/cisco_asa___core_syslog_message_volume_drop.yml
index 4b3fe892f1d..9ae0cac4a90 100644
--- a/detections/application/cisco_asa___core_syslog_message_volume_drop.yml
+++ b/detections/application/cisco_asa___core_syslog_message_volume_drop.yml
@@ -6,8 +6,7 @@ modification_date: '2026-05-13'
 author: Bhavin Patel, Micheal Haag, Splunk
 status: production
 type: Hunting
-description: |
-    Adversaries may intentionally suppress or reduce the volume of core Cisco ASA syslog messages to evade detection or cover their tracks. This hunting search is recommended to proactively identify suspicious downward shifts or absences in key syslog message IDs, which may indicate tampering or malicious activity. Visualizing this data in Splunk dashboards enables security teams to quickly spot anomalies and investigate potential compromise.
+description: Adversaries may intentionally suppress or reduce the volume of core Cisco ASA syslog messages to evade detection or cover their tracks. This hunting search is recommended to proactively identify suspicious downward shifts or absences in key syslog message IDs, which may indicate tampering or malicious activity. Visualizing this data in Splunk dashboards enables security teams to quickly spot anomalies and investigate potential compromise.
 data_source:
     - Cisco ASA Logs
 search: |
@@ -25,14 +24,16 @@ search: |
       by _time message_id
     | xyseries _time message_id count
     | `cisco_asa___core_syslog_message_volume_drop_filter`
-how_to_implement: |
-    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward both debug and informational level syslog messages before they are sent to Splunk.
+how_to_implement: 'This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward both debug and informational level syslog messages before they are sent to Splunk.
+
     This analytic is designed to be used with comprehensive logging enabled, as it relies on the presence of specific message IDs. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#toc-hId--1451069880.
+
     The search produces a time-series suitable for dashboards to visualize drops across message IDs 302013, 302014, 609002, and 710005.
-    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
-known_false_positives: |
-    Planned maintenance, network outages, routing changes, or benign configuration updates may reduce log volume temporarily.
-    Validate against change management records and corroborate with device health metrics.
+
+    You can also change the severity level of the above message id''s to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da'
+known_false_positives: 'Planned maintenance, network outages, routing changes, or benign configuration updates may reduce log volume temporarily.
+
+    Validate against change management records and corroborate with device health metrics.'
 references:
     - https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
     - https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
diff --git a/detections/application/cisco_asa___device_file_copy_activity.yml b/detections/application/cisco_asa___device_file_copy_activity.yml
index bbeecd22ccd..6f74b50fad8 100644
--- a/detections/application/cisco_asa___device_file_copy_activity.yml
+++ b/detections/application/cisco_asa___device_file_copy_activity.yml
@@ -6,46 +6,27 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM.
+description: 'This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM.
+
     Adversaries may copy device files including configurations, logs, packet captures, or system files for reconnaissance, credential extraction, or data exfiltration. While legitimate file operations occur during backups and maintenance, unauthorized copies may indicate malicious activity.
+
     The detection monitors for command execution events (message ID 111008 or 111010) containing copy commands targeting running-config, startup-config, packet capture files, or other system files from disk0:, flash:, system:, or capture: locations.
-    Investigate unexpected file copies, especially from non-administrative accounts, during unusual hours, or when combined with other suspicious activities.
+
+    Investigate unexpected file copies, especially from non-administrative accounts, during unusual hours, or when combined with other suspicious activities.'
 data_source:
     - Cisco ASA Logs
 search: |
-    `cisco_asa`
-    message_id IN (111008, 111010)
-    command = "copy *"
-    command IN (
-        "*running-config*",
-        "*startup-config*",
-        "*/pcap capture:*",
-        "* disk0:*",
-        "* flash:*",
-        "* system:*"
-    )
-    | fillnull
-    | stats earliest(_time) as firstTime
-            latest(_time) as lastTime
-            values(user) as user
-            values(action) as action
-            values(message_id) as message_id
-            values(command) as command
-            values(src_ip) as src_ip
-            values(process_name) as process_name
-      by host
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_asa___device_file_copy_activity_filter`
-how_to_implement: |
-    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+    `cisco_asa` message_id IN ("111008", "111010") command="copy *" command IN ("*running-config*", "*startup-config*", "*/pcap capture:*", "* disk0:*", "* flash:*", "* system:*") | eval user=user, dest=dest, remote_protocol=remote_protocol, privilege_level=privilege_level, old_privilege_level=old_privilege_level, new_privilege_level=new_privilege_level | stats count min(_time) as firstTime max(_time) as lastTime by message_id command host src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_asa___device_file_copy_activity_filter`
+how_to_implement: 'This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+
     To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
-    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
+
+    If your logging level is set to ''Notifications'' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
+
     You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
-    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
-known_false_positives: |
-    Legitimate configuration exports may occur during normal administrative activities. These events should be verified and investigated.
+
+    You can also change the severity level of the above message id''s to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da'
+known_false_positives: Legitimate configuration exports may occur during normal administrative activities. These events should be verified and investigated.
 references:
     - https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
 drilldown_searches:
@@ -56,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for $host$
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
diff --git a/detections/application/cisco_asa___device_file_copy_to_remote_location.yml b/detections/application/cisco_asa___device_file_copy_to_remote_location.yml
index dcf5df8840c..9d60082dcc0 100644
--- a/detections/application/cisco_asa___device_file_copy_to_remote_location.yml
+++ b/detections/application/cisco_asa___device_file_copy_to_remote_location.yml
@@ -6,66 +6,31 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM.
+description: 'This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM.
+
     Adversaries may exfiltrate device files including configurations, logs, packet captures, or system data to remote servers using protocols like TFTP, FTP, HTTP, HTTPS, SMB, or SCP. While legitimate backups to centralized servers are common, copies to unexpected destinations may indicate data exfiltration to attacker-controlled infrastructure.
+
     The detection monitors for command execution events (message ID 111008 or 111010) containing copy commands with remote protocol indicators (tftp:, ftp:, http:, https:, smb:, scp:).
+
     Investigate copies to unexpected destinations, from non-administrative accounts, or outside approved maintenance windows.
-    We recommend adapting the detection filters to exclude known legitimate backup activities.
+
+    We recommend adapting the detection filters to exclude known legitimate backup activities.'
 data_source:
     - Cisco ASA Logs
 search: |
-    `cisco_asa`
-    message_id IN (111008, 111010)
-    command = "copy *"
-    command IN (
-        "*running-config*",
-        "*startup-config*",
-        "*/pcap capture:*",
-        "* disk0:*",
-        "* flash:*",
-        "* system:*"
-    )
-    command IN (
-        "*ftp:*",
-        "*http:*",
-        "*https:*",
-        "*smb:*",
-        "*scp:*"
-    )
+    `cisco_asa` message_id IN ("111008", "111010") command="copy *" command IN ("*running-config*", "*startup-config*", "*/pcap capture:*", "* disk0:*", "* flash:*", "* system:*") command IN ("*ftp:*", "*http:*", "*https:*", "*smb:*", "*scp:*") | eval user=user, dest=dest, remote_protocol=remote_protocol, privilege_level=privilege_level, old_privilege_level=old_privilege_level, new_privilege_level=new_privilege_level | stats count min(_time) as firstTime max(_time) as lastTime by message_id command host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_asa___device_file_copy_to_remote_location_filter`
+how_to_implement: 'This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
 
-    | eval remote_protocol = mvappend(
-      if(match(command, "tftp:"), "TFTP", null()),
-      if(match(command, "ftp:"), "FTP", null()),
-      if(match(command, "http:"), "HTTP", null()),
-      if(match(command, "https:"), "HTTPS", null()),
-      if(match(command, "smb:"), "SMB", null()),
-      if(match(command, "scp:"), "SCP", null())
-      )
-    | fillnull
-    | stats earliest(_time) as firstTime
-            latest(_time) as lastTime
-            values(user) as user
-            values(action) as action
-            values(message_id) as message_id
-            values(command) as command
-            values(remote_protocol) as remote_protocol
-            values(src_ip) as src_ip
-            values(dest) as dest
-            values(process_name) as process_name
-      by host
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_asa___device_file_copy_to_remote_location_filter`
-how_to_implement: |
-    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
     To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message IDs 111008 and 111010.
-    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and add message IDs 111008 and 111010.
+
+    If your logging level is set to ''Notifications'' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and add message IDs 111008 and 111010.
+
     You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
-    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
-known_false_positives: |
-    Legitimate configuration exports to remote locations may occur during normal administrative activities.
-    Investigate these events to verify their legitimacy and apply necessary filters.
+
+    You can also change the severity level of the above message id''s to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da'
+known_false_positives: 'Legitimate configuration exports to remote locations may occur during normal administrative activities.
+
+    Investigate these events to verify their legitimacy and apply necessary filters.'
 references:
     - https://community.cisco.com/t5/security-knowledge-base/asa-how-to-download-images-using-tftp-ftp-http-https-and-scp/ta-p/3109769
     - https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
@@ -77,7 +42,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for $host$
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
diff --git a/detections/application/cisco_asa___logging_disabled_via_cli.yml b/detections/application/cisco_asa___logging_disabled_via_cli.yml
index 2fa7b6892e7..1d7aa096e1f 100644
--- a/detections/application/cisco_asa___logging_disabled_via_cli.yml
+++ b/detections/application/cisco_asa___logging_disabled_via_cli.yml
@@ -6,47 +6,35 @@ modification_date: '2026-05-13'
 author: Bhavin Patel, Micheal Haag, Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    This analytic detects the disabling of logging functionality on a Cisco ASA device
+description: 'This analytic detects the disabling of logging functionality on a Cisco ASA device
+
     through CLI commands. Adversaries or malicious insiders may attempt to disable logging
+
     to evade detection and hide malicious activity. The detection looks for specific ASA
+
     syslog message IDs (111010, 111008) associated with command execution,
+
     combined with suspicious commands such as `no logging`, `logging disable`,
+
     `clear logging`, or `no logging host`. Disabling logging on a firewall or security device
-    is a strong indicator of defense evasion.
+
+    is a strong indicator of defense evasion.'
 data_source:
     - Cisco ASA Logs
 search: |
-    `cisco_asa`
-    message_id IN (111008, 111010)
-    command IN (
-        "*no logging*",
-        "*logging disable*",
-        "*clear logging*",
-        "*no logging host*",
-        "*no logging trap*"
-    )
-    | stats earliest(_time) as firstTime
-            latest(_time) as lastTime
-            values(user) as user
-            values(action) as action
-            values(message_id) as message_id
-            values(command) as command
-            values(src_ip) as src_ip
-            values(process_name) as process_name
-      by host
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_asa___logging_disabled_via_cli_filter`
-how_to_implement: |
-    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+    `cisco_asa` message_id IN ("111008", "111010") command IN ("*no logging*", "*logging disable*", "*clear logging*", "*no logging host*", "*no logging trap*") | eval user=user, dest=dest, remote_protocol=remote_protocol, privilege_level=privilege_level, old_privilege_level=old_privilege_level, new_privilege_level=new_privilege_level | stats count min(_time) as firstTime max(_time) as lastTime by message_id command src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_asa___logging_disabled_via_cli_filter`
+how_to_implement: 'This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+
     To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
-    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
+
+    If your logging level is set to ''Notifications'' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
+
     You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
-    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
-known_false_positives: |
-    Administrators may intentionally disable or modify logging during maintenance, troubleshooting, or device reconfiguration.
-    These events should be verified against approved change management activities.
+
+    You can also change the severity level of the above message id''s to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da'
+known_false_positives: 'Administrators may intentionally disable or modify logging during maintenance, troubleshooting, or device reconfiguration.
+
+    These events should be verified against approved change management activities.'
 references:
     - https://www.cisco.com/site/us/en/products/security/firewalls/adaptive-security-appliance-asa-software/index.html
     - https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
@@ -58,7 +46,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for $host$
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ executed command $command$ to disable logging on the Cisco ASA host $host$.
     entity:
diff --git a/detections/application/cisco_asa___logging_filters_configuration_tampering.yml b/detections/application/cisco_asa___logging_filters_configuration_tampering.yml
index 7855517ecdb..4265470ba79 100644
--- a/detections/application/cisco_asa___logging_filters_configuration_tampering.yml
+++ b/detections/application/cisco_asa___logging_filters_configuration_tampering.yml
@@ -6,56 +6,29 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects tampering with logging filter configurations on Cisco ASA devices via CLI or ASDM.
+description: 'This analytic detects tampering with logging filter configurations on Cisco ASA devices via CLI or ASDM.
+
     Adversaries may reduce logging levels or disable specific log categories to evade detection, hide their activities, or prevent security monitoring systems from capturing evidence of their actions. By lowering logging verbosity, attackers can operate with reduced visibility to security teams.
+
     The detection monitors for logging configuration commands (message ID 111008 or 111010) that modify logging destinations (asdm, console, history, mail, monitor, trap) without setting them to higher severity levels (5-notifications, 6-informational, 7-debugging), which may indicate an attempt to reduce logging verbosity.
-    Investigate unauthorized logging configuration changes that reduce verbosity, especially changes performed by non-administrative accounts, during unusual hours, or without corresponding change management approval.
+
+    Investigate unauthorized logging configuration changes that reduce verbosity, especially changes performed by non-administrative accounts, during unusual hours, or without corresponding change management approval.'
 data_source:
     - Cisco ASA Logs
 search: |
-    `cisco_asa`
-    message_id IN (111008, 111010)
-    command = "logging *"
-    command IN (
-      "*asdm*",
-      "*console*",
-      "*history*",
-      "*mail*",
-      "*monitor*",
-      "*trap*"
-    )
-    NOT command IN (
-      "*notifications*",
-      "*informational*",
-      "*debugging*",
-      "* 5*",
-      "* 6*",
-      "* 7*"
-    )
-    | fillnull
-    | stats count
-            earliest(_time) as firstTime
-            latest(_time) as lastTime
-            values(user) as user
-            values(action) as action
-            values(message_id) as message_id
-            values(command) as command
-            values(src_ip) as src_ip
-            values(process_name) as process_name
-      by host
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_asa___logging_filters_configuration_tampering_filter`
-how_to_implement: |
-    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+    `cisco_asa` message_id IN ("111008", "111010") command="logging *" command IN ("*asdm*", "*console*", "*history*", "*mail*", "*monitor*", "*trap*") NOT (command IN ("*notifications*", "*informational*", "*debugging*", "* 5*", "* 6*", "* 7*")) | eval user=user, dest=dest, remote_protocol=remote_protocol, privilege_level=privilege_level, old_privilege_level=old_privilege_level, new_privilege_level=new_privilege_level | stats count min(_time) as firstTime max(_time) as lastTime by message_id command host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_asa___logging_filters_configuration_tampering_filter`
+how_to_implement: 'This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+
     To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
-    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adding the message IDs 111008 and 111010.
+
+    If your logging level is set to ''Notifications'' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adding the message IDs 111008 and 111010.
+
     You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
-    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
-known_false_positives: |
-    Admins may modify logging levels during maintenance or troubleshooting to reduce log volume. Verify against change management tickets.
-    Filter known admin accounts during maintenance windows.
+
+    You can also change the severity level of the above message id''s to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da'
+known_false_positives: 'Admins may modify logging levels during maintenance or troubleshooting to reduce log volume. Verify against change management tickets.
+
+    Filter known admin accounts during maintenance windows.'
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/I-R/asa-command-ref-I-R/m_log-lz.html
 drilldown_searches:
@@ -66,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for $host$
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
diff --git a/detections/application/cisco_asa___logging_message_suppression.yml b/detections/application/cisco_asa___logging_message_suppression.yml
index a2788d05099..8de5b3af802 100644
--- a/detections/application/cisco_asa___logging_message_suppression.yml
+++ b/detections/application/cisco_asa___logging_message_suppression.yml
@@ -6,41 +6,31 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects suppression of specific logging messages on Cisco ASA devices using the "no logging message" command.
+description: 'This analytic detects suppression of specific logging messages on Cisco ASA devices using the "no logging message" command.
+
     Adversaries may suppress specific log message IDs to selectively disable logging of security-critical events such as authentication failures, configuration changes, or suspicious network activity. This targeted approach allows attackers to evade detection while maintaining normal logging operations that might otherwise alert administrators to complete logging disablement.
+
     The detection monitors for command execution events (message ID 111008 or 111010) containing the "no logging message" command, which is used to suppress specific message IDs from being logged regardless of the configured severity level.
-    Investigate unauthorized message suppression, especially suppression of security-critical message IDs (authentication, authorization, configuration changes), suppression performed by non-administrative accounts, during unusual hours, or without documented justification.
+
+    Investigate unauthorized message suppression, especially suppression of security-critical message IDs (authentication, authorization, configuration changes), suppression performed by non-administrative accounts, during unusual hours, or without documented justification.'
 data_source:
     - Cisco ASA Logs
 search: |
-    `cisco_asa`
-    message_id IN (111008, 111010)
-    command = "no logging message *"
-    | fillnull
-    | stats count
-            earliest(_time) as firstTime
-            latest(_time) as lastTime
-            values(user) as user
-            values(action) as action
-            values(message_id) as message_id
-            values(command) as command
-            values(src_ip) as src_ip
-            values(process_name) as process_name
-      by host
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_asa___logging_message_suppression_filter`
-how_to_implement: |
-    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+    `cisco_asa` message_id IN ("111008", "111010") command="no logging message *" | eval user=user, dest=dest, remote_protocol=remote_protocol, privilege_level=privilege_level, old_privilege_level=old_privilege_level, new_privilege_level=new_privilege_level | stats count min(_time) as firstTime max(_time) as lastTime by message_id command host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_asa___logging_message_suppression_filter`
+how_to_implement: 'This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+
     To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
-    If your logging level is set to 'notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adding the message IDs 111008 and 111010.
+
+    If your logging level is set to ''notifications'' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adding the message IDs 111008 and 111010.
+
     You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
-    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
-known_false_positives: |
-    Admins may suppress verbose messages to reduce log volume or manage storage.
+
+    You can also change the severity level of the above message id''s to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da'
+known_false_positives: 'Admins may suppress verbose messages to reduce log volume or manage storage.
+
     Verify against change management and logging policies. Establish baseline of
-    approved suppressed message IDs.
+
+    approved suppressed message IDs.'
 references:
     - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf
 drilldown_searches:
@@ -51,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for $host$
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
diff --git a/detections/application/cisco_asa___new_local_user_account_created.yml b/detections/application/cisco_asa___new_local_user_account_created.yml
index 12b463967e9..8a53f8de8fe 100644
--- a/detections/application/cisco_asa___new_local_user_account_created.yml
+++ b/detections/application/cisco_asa___new_local_user_account_created.yml
@@ -6,36 +6,29 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects creation of new user accounts on Cisco ASA devices via CLI or ASDM.
+description: 'This analytic detects creation of new user accounts on Cisco ASA devices via CLI or ASDM.
+
     Adversaries may create unauthorized user accounts to establish persistence, maintain backdoor access, or elevate privileges on network infrastructure devices. These rogue accounts can provide attackers with continued access even after initial compromise vectors are remediated.
+
     The detection monitors for ASA message ID 502101, which is generated whenever a new user account is created on the device, capturing details including the username, privilege level, and the administrator who created the account.
-    Investigate unexpected account creations, especially those with elevated privileges (level 15), accounts created outside business hours, accounts with suspicious or generic names, or accounts created by non-administrative users.
+
+    Investigate unexpected account creations, especially those with elevated privileges (level 15), accounts created outside business hours, accounts with suspicious or generic names, or accounts created by non-administrative users.'
 data_source:
     - Cisco ASA Logs
 search: |
-    `cisco_asa`
-    message_id IN (502101)
-    | fillnull
-    | stats count earliest(_time) as firstTime
-            latest(_time) as lastTime
-            values(action) as action
-            values(message_id) as message_id
-            values(result) as result
-            values(privilege_level) as privilege_level
-      by host user
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_asa___new_local_user_account_created_filter`
-how_to_implement: |
-    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+    `cisco_asa` message_id="502101" | eval user=user, dest=dest, remote_protocol=remote_protocol, privilege_level=privilege_level, old_privilege_level=old_privilege_level, new_privilege_level=new_privilege_level | stats count min(_time) as firstTime max(_time) as lastTime by message_id host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_asa___new_local_user_account_created_filter`
+how_to_implement: 'This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+
     To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 502101.
-    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message ID 502101.
+
+    If your logging level is set to ''Notifications'' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message ID 502101.
+
     You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
-    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
-known_false_positives: |
-    Legitimate account creation occurs during employee onboarding, contractor provisioning, service account setup, or emergency access. Verify against HR records and change management tickets.
-    Filter known admin accounts during business hours.
+
+    You can also change the severity level of the above message id''s to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da'
+known_false_positives: 'Legitimate account creation occurs during employee onboarding, contractor provisioning, service account setup, or emergency access. Verify against HR records and change management tickets.
+
+    Filter known admin accounts during business hours.'
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/asa-syslog/syslog-messages-500000-to-520025.html#con_4773963
 drilldown_searches:
@@ -46,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for $host$
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
diff --git a/detections/application/cisco_asa___packet_capture_activity.yml b/detections/application/cisco_asa___packet_capture_activity.yml
index 4db3420bcaa..bbdd3e7117a 100644
--- a/detections/application/cisco_asa___packet_capture_activity.yml
+++ b/detections/application/cisco_asa___packet_capture_activity.yml
@@ -6,39 +6,27 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects execution of packet capture commands on Cisco ASA devices via CLI or ASDM.
+description: 'This analytic detects execution of packet capture commands on Cisco ASA devices via CLI or ASDM.
+
     Adversaries may abuse the built-in packet capture functionality to perform network sniffing, intercept credentials transmitted over the network, capture sensitive data in transit, or gather intelligence about network traffic patterns and internal communications. Packet captures can reveal usernames, passwords, session tokens, and confidential business data.
+
     The detection monitors for command execution events (message ID 111008 or 111010) containing "capture" commands, which are used to initiate packet capture sessions on specific interfaces or for specific traffic patterns on the ASA device.
-    Investigate unauthorized packet capture activities, especially captures targeting sensitive interfaces (internal network segments, DMZ), captures configured to capture large volumes of traffic, captures with suspicious filter criteria, captures initiated by non-administrative accounts, or captures during unusual hours.
+
+    Investigate unauthorized packet capture activities, especially captures targeting sensitive interfaces (internal network segments, DMZ), captures configured to capture large volumes of traffic, captures with suspicious filter criteria, captures initiated by non-administrative accounts, or captures during unusual hours.'
 data_source:
     - Cisco ASA Logs
 search: |
-    `cisco_asa`
-    message_id IN (111008, 111010)
-    command IN ("capture *")
-    | fillnull
-    | stats count
-            earliest(_time) as firstTime
-            latest(_time) as lastTime
-            values(user) as user
-            values(action) as action
-            values(message_id) as message_id
-            values(command) as command
-            values(src_ip) as src_ip
-            values(process_name) as process_name
-      by host
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_asa___packet_capture_activity_filter`
-how_to_implement: |
-    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+    `cisco_asa` message_id IN ("111008", "111010") command="capture *" | eval user=user, dest=dest, remote_protocol=remote_protocol, privilege_level=privilege_level, old_privilege_level=old_privilege_level, new_privilege_level=new_privilege_level | stats count min(_time) as firstTime max(_time) as lastTime by message_id command host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_asa___packet_capture_activity_filter`
+how_to_implement: 'This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+
     To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
-    If your logging level is set to 'notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adding the message IDs 111008 and 111010.
+
+    If your logging level is set to ''notifications'' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adding the message IDs 111008 and 111010.
+
     You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
-    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
-known_false_positives: |
-    Admins use packet captures for troubleshooting, performance monitoring, or security investigations. Verify against change management. Filter known admin accounts during maintenance windows.
+
+    You can also change the severity level of the above message id''s to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da'
+known_false_positives: Admins use packet captures for troubleshooting, performance monitoring, or security investigations. Verify against change management. Filter known admin accounts during maintenance windows.
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/A-H/asa-command-ref-A-H/ca-cld-commands.html
     - https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118097-configure-asa-00.html
@@ -51,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for $host$
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
diff --git a/detections/application/cisco_asa___reconnaissance_command_activity.yml b/detections/application/cisco_asa___reconnaissance_command_activity.yml
index 1fb1fc019ea..e719965cd02 100644
--- a/detections/application/cisco_asa___reconnaissance_command_activity.yml
+++ b/detections/application/cisco_asa___reconnaissance_command_activity.yml
@@ -6,12 +6,15 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe.
+description: 'This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe.
+
     Adversaries who gain initial access to network infrastructure devices typically perform systematic reconnaissance to understand the device configuration, network topology, security policies, connected systems, and potential attack paths. This reconnaissance phase involves executing multiple "show" commands to enumerate device details, running configurations, active connections, routing information, and VPN sessions.
+
     The detection monitors for command execution events (message ID 111009) containing reconnaissance-oriented "show" commands (such as show running-config, show version, show interface, show crypto, show conn, etc.) and triggers when 7 or more distinct reconnaissance commands are executed within a 5-minute window by the same user.
+
     Investigate reconnaissance bursts from non-administrative accounts, unusual source IP addresses, activity during off-hours, methodical command sequences suggesting automated enumeration, or reconnaissance activity correlated with other suspicious behaviors.
-    We recommend adapting the detection filters to exclude known legitimate administrative activities.
+
+    We recommend adapting the detection filters to exclude known legitimate administrative activities.'
 data_source:
     - Cisco ASA Logs
 search: |
@@ -88,15 +91,18 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_asa___reconnaissance_command_activity_filter`
-how_to_implement: |
-    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+how_to_implement: 'This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+
     To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111009.
-    If your logging level is set to 'Debugging', these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message ID 111009.
+
+    If your logging level is set to ''Debugging'', these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message ID 111009.
+
     You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
-    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
-known_false_positives: |
-    Legitimate sequences occur during troubleshooting, health checks, upgrades, audits, or automation scripts. Verify against change management.
-    Filter known admin accounts, trusted management stations, or adjust threshold based on baseline.
+
+    You can also change the severity level of the above message id''s to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da'
+known_false_positives: 'Legitimate sequences occur during troubleshooting, health checks, upgrades, audits, or automation scripts. Verify against change management.
+
+    Filter known admin accounts, trusted management stations, or adjust threshold based on baseline.'
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/S/asa-command-ref-S/sa-shov-commands.html
 drilldown_searches:
@@ -107,7 +113,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for $host$
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
diff --git a/detections/application/cisco_asa___user_account_deleted_from_local_database.yml b/detections/application/cisco_asa___user_account_deleted_from_local_database.yml
index f3b996fd7af..710b9eb8146 100644
--- a/detections/application/cisco_asa___user_account_deleted_from_local_database.yml
+++ b/detections/application/cisco_asa___user_account_deleted_from_local_database.yml
@@ -6,36 +6,29 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects deletion of user accounts from Cisco ASA devices via CLI or ASDM.
+description: 'This analytic detects deletion of user accounts from Cisco ASA devices via CLI or ASDM.
+
     Adversaries may delete local accounts to cover their tracks, remove evidence of their activities, disrupt incident response efforts, or deny legitimate administrator access during an attack. Account deletion can also indicate an attempt to hide the creation of temporary accounts used during compromise.
+
     The detection monitors for ASA message ID 502102, which is generated whenever a local user account is deleted from the device, capturing details including the deleted username, privilege level, and the administrator who performed the deletion.
-    Investigate unexpected account deletions, especially those involving privileged accounts (level 15), deletions performed outside business hours, deletions by non-administrative users, or deletions that coincide with other suspicious activities.
+
+    Investigate unexpected account deletions, especially those involving privileged accounts (level 15), deletions performed outside business hours, deletions by non-administrative users, or deletions that coincide with other suspicious activities.'
 data_source:
     - Cisco ASA Logs
 search: |
-    `cisco_asa`
-    message_id IN (502102)
-    | fillnull
-    | stats count earliest(_time) as firstTime
-            latest(_time) as lastTime
-            values(action) as action
-            values(message_id) as message_id
-            values(result) as result
-            values(privilege_level) as privilege_level
-      by host user
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_asa___user_account_deleted_from_local_database_filter`
-how_to_implement: |
-    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+    `cisco_asa` message_id="502102" | eval user=user, dest=dest, remote_protocol=remote_protocol, privilege_level=privilege_level, old_privilege_level=old_privilege_level, new_privilege_level=new_privilege_level | stats count min(_time) as firstTime max(_time) as lastTime by message_id host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_asa___user_account_deleted_from_local_database_filter`
+how_to_implement: 'This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+
     To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 502102.
-    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message ID 502102.
+
+    If your logging level is set to ''Notifications'' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message ID 502102.
+
     You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
-    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
-known_false_positives: |
-    Legitimate deletions occur during employee offboarding, contractor removal, account cleanup, or service account decommissioning. Verify against HR records and change management tickets.
-    Filter known admin accounts during business hours.
+
+    You can also change the severity level of the above message id''s to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da'
+known_false_positives: 'Legitimate deletions occur during employee offboarding, contractor removal, account cleanup, or service account decommissioning. Verify against HR records and change management tickets.
+
+    Filter known admin accounts during business hours.'
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/asa-syslog/syslog-messages-500000-to-520025.html#con_4773969
 drilldown_searches:
@@ -46,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for $host$
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
diff --git a/detections/application/cisco_asa___user_account_lockout_threshold_exceeded.yml b/detections/application/cisco_asa___user_account_lockout_threshold_exceeded.yml
index db816395b2a..06c736a282d 100644
--- a/detections/application/cisco_asa___user_account_lockout_threshold_exceeded.yml
+++ b/detections/application/cisco_asa___user_account_lockout_threshold_exceeded.yml
@@ -6,11 +6,13 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects user account lockouts on Cisco ASA devices resulting from excessive failed authentication attempts.
+description: 'This analytic detects user account lockouts on Cisco ASA devices resulting from excessive failed authentication attempts.
+
     Account lockouts may indicate brute force attacks, password spraying campaigns, credential stuffing attempts using compromised credentials from external breaches, or misconfigured automation attempting authentication with incorrect credentials. These activities represent attempts to gain unauthorized access to network infrastructure.
+
     The detection monitors for ASA message ID 113006, which is generated when a user account is locked out after exceeding the configured maximum number of failed authentication attempts, capturing the locked account name and the failure threshold that was exceeded.
-    Investigate account lockouts for privileged or administrative accounts, multiple simultaneous lockouts affecting different accounts (suggesting password spraying), lockouts originating from unusual source IP addresses, lockouts during off-hours, or patterns suggesting automated attack tools.
+
+    Investigate account lockouts for privileged or administrative accounts, multiple simultaneous lockouts affecting different accounts (suggesting password spraying), lockouts originating from unusual source IP addresses, lockouts during off-hours, or patterns suggesting automated attack tools.'
 data_source:
     - Cisco ASA Logs
 search: |
@@ -28,14 +30,16 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_asa___user_account_lockout_threshold_exceeded_filter`
-how_to_implement: |
-    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+how_to_implement: 'This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+
     To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 113006.
-    If your logging level is set to 'Informational' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message ID 113006.
+
+    If your logging level is set to ''Informational'' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message ID 113006.
+
     You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
-    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
-known_false_positives: |
-    Legitimate lockouts occur from forgotten passwords, typos, script misconfigurations, or connectivity issues. Verify against help desk tickets. Filter known accounts during business hours or establish baseline patterns.
+
+    You can also change the severity level of the above message id''s to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da'
+known_false_positives: Legitimate lockouts occur from forgotten passwords, typos, script misconfigurations, or connectivity issues. Verify against help desk tickets. Filter known accounts during business hours or establish baseline patterns.
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/asa-syslog/syslog-messages-101001-to-199021.html#con_4769446
 drilldown_searches:
@@ -46,7 +50,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for $host$
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
diff --git a/detections/application/cisco_asa___user_privilege_level_change.yml b/detections/application/cisco_asa___user_privilege_level_change.yml
index 38765f29ed0..1715afff7c5 100644
--- a/detections/application/cisco_asa___user_privilege_level_change.yml
+++ b/detections/application/cisco_asa___user_privilege_level_change.yml
@@ -6,35 +6,27 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects privilege level changes for user accounts on Cisco ASA devices via CLI or ASDM.
+description: 'This analytic detects privilege level changes for user accounts on Cisco ASA devices via CLI or ASDM.
+
     Adversaries may escalate account privileges to gain elevated access to network infrastructure, enable additional command execution capabilities, or establish higher-level persistent access. Privilege levels on Cisco ASA range from 0 (lowest) to 15 (full administrative access), with level 15 providing complete device control.
-    The detection monitors for ASA message ID 502103, which is generated whenever a user account's privilege level is modified, capturing both the old and new privilege levels along with the username and administrator who made the change.
-    Investigate unexpected privilege changes, especially escalations to level 15, substantial privilege increases (e.g., from level 1 to 15), changes performed outside business hours, changes by non-administrative users, or changes without corresponding change management tickets.
+
+    The detection monitors for ASA message ID 502103, which is generated whenever a user account''s privilege level is modified, capturing both the old and new privilege levels along with the username and administrator who made the change.
+
+    Investigate unexpected privilege changes, especially escalations to level 15, substantial privilege increases (e.g., from level 1 to 15), changes performed outside business hours, changes by non-administrative users, or changes without corresponding change management tickets.'
 data_source:
     - Cisco ASA Logs
 search: |
-    `cisco_asa`
-    message_id IN (502103)
-    | fillnull
-    | stats earliest(_time) as firstTime
-            latest(_time) as lastTime
-            values(action) as action
-            values(message_id) as message_id
-            values(old_privilege_level) as old_privilege_level
-            values(new_privilege_level) as new_privilege_level
-      by host user
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_asa___user_privilege_level_change_filter`
-how_to_implement: |
-    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+    `cisco_asa` message_id="502103" | eval user=user, dest=dest, remote_protocol=remote_protocol, privilege_level=privilege_level, old_privilege_level=old_privilege_level, new_privilege_level=new_privilege_level | stats count min(_time) as firstTime max(_time) as lastTime by message_id host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_asa___user_privilege_level_change_filter`
+how_to_implement: 'This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
+
     To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 502103.
-    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adding the message IDs 502103.
+
+    If your logging level is set to ''Notifications'' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adding the message IDs 502103.
+
     You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
-    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
-known_false_positives: |
-    Legitimate changes occur during role changes, temporary escalation for maintenance, or security policy adjustments. Verify against change management. Filter known admin accounts during maintenance windows.
+
+    You can also change the severity level of the above message id''s to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da'
+known_false_positives: Legitimate changes occur during role changes, temporary escalation for maintenance, or security policy adjustments. Verify against change management. Filter known admin accounts during maintenance windows.
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/asa-syslog/syslog-messages-500000-to-520025.html#con_4773975
     - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf
@@ -46,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for $host$
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
diff --git a/detections/application/cisco_duo_admin_login_unusual_browser.yml b/detections/application/cisco_duo_admin_login_unusual_browser.yml
index f0657ce66ba..032f8c9ad6b 100644
--- a/detections/application/cisco_duo_admin_login_unusual_browser.yml
+++ b/detections/application/cisco_duo_admin_login_unusual_browser.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies instances where a Duo admin logs in using a browser other than Chrome, which is considered unusual based on typical access patterns. Please adjust as needed to your environment. The detection leverages Duo activity logs ingested via the Cisco Security Cloud App and filters for admin login actions where the browser is not Chrome. By renaming and aggregating relevant fields such as user, browser, IP address, and location, the analytic highlights potentially suspicious access attempts that deviate from the norm. This behavior is significant for a SOC because the use of an unexpected browser may indicate credential compromise, session hijacking, or the use of unauthorized devices by attackers attempting to evade detection. Detecting such anomalies enables early investigation and response, helping to prevent privilege escalation, policy manipulation, or further compromise of sensitive administrative accounts. The impact of this attack could include unauthorized changes to security policies, user access, or the disabling of critical security controls, posing a substantial risk to the organizations security posture.
 data_source:
     - Cisco Duo Activity
-search: |-
+search: |
     `cisco_duo_activity` "action.name"=admin_login NOT access_device.browser IN (Chrome)
       | rename actor.name as user access_device.ip.address as src_ip
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A user $user$ has logged in using an unusual browser $access_device.browser$ from $src_ip$.
     entity:
diff --git a/detections/application/cisco_duo_admin_login_unusual_country.yml b/detections/application/cisco_duo_admin_login_unusual_country.yml
index f3eab7af21e..704a0119a7d 100644
--- a/detections/application/cisco_duo_admin_login_unusual_country.yml
+++ b/detections/application/cisco_duo_admin_login_unusual_country.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects instances where a Duo admin login originates from a country outside of the United States, which may indicate suspicious or unauthorized access attempts. Please adjust as needed to your environment. It works by analyzing Duo activity logs for admin login actions and filtering out events where the access device's country is not within the expected region. By correlating user, device, browser, and location details, the analytic highlights anomalies in geographic login patterns. This behavior is critical for a SOC to identify because admin accounts have elevated privileges, and access from unusual countries can be a strong indicator of credential compromise, account takeover, or targeted attacks. Early detection of such activity enables rapid investigation and response, reducing the risk of unauthorized changes, data breaches, or further lateral movement within the environment. The impact of this attack can be severe, potentially allowing attackers to bypass security controls, alter configurations, or exfiltrate sensitive information.
 data_source:
     - Cisco Duo Activity
-search: |-
+search: |
     `cisco_duo_activity` "action.name"=admin_login NOT access_device.location.country IN ("United States")
       | rename actor.name as user access_device.ip.address as src_ip
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A user $user$ has logged in using an unusual country using browser $access_device.browser$ from $src_ip$.
     entity:
diff --git a/detections/application/cisco_duo_admin_login_unusual_os.yml b/detections/application/cisco_duo_admin_login_unusual_os.yml
index b4f215616b3..70ace6d2024 100644
--- a/detections/application/cisco_duo_admin_login_unusual_os.yml
+++ b/detections/application/cisco_duo_admin_login_unusual_os.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies Duo admin login attempts from operating systems that are unusual for your environment, excluding commonly used OS such as Mac OS X. Please adjust to your environment. It works by analyzing Duo activity logs for admin login actions and filtering out logins from expected operating systems. The analytic then aggregates events by browser, version, source IP, location, and OS details to highlight anomalies. Detecting admin logins from unexpected operating systems is critical for a SOC, as it may indicate credential compromise, unauthorized access, or attacker activity using unfamiliar devices. Such behavior can precede privilege escalation, policy changes, or other malicious actions within the Duo environment. Early detection enables rapid investigation and response, reducing the risk of account takeover and minimizing potential damage to organizational security controls.
 data_source:
     - Cisco Duo Activity
-search: |-
+search: |
     `cisco_duo_activity` "action.name"=admin_login NOT access_device.os IN ("Mac OS X")
       | rename actor.name as user access_device.ip.address as src_ip
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A user $user$ has logged in using an unusual OS $access_device.os$ using browser $access_device.browser$ from $src_ip$.
     entity:
diff --git a/detections/application/cisco_duo_bulk_policy_deletion.yml b/detections/application/cisco_duo_bulk_policy_deletion.yml
index c8ba96d5a98..9258bebba25 100644
--- a/detections/application/cisco_duo_bulk_policy_deletion.yml
+++ b/detections/application/cisco_duo_bulk_policy_deletion.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects instances where a Duo administrator performs a bulk deletion of more than three policies in a single action. It identifies this behavior by searching Duo activity logs for the policy_bulk_delete action, extracting the names of deleted policies, and counting them. If the count exceeds three, the event is flagged. This behavior is significant for a Security Operations Center (SOC) because mass deletion of security policies can indicate malicious activity, such as an attacker or rogue administrator attempting to weaken or disable security controls, potentially paving the way for further compromise. Detecting and investigating such actions promptly is critical, as the impact of this attack could include reduced security posture, increased risk of unauthorized access, and potential data breaches. Monitoring for bulk policy deletions helps ensure that any suspicious or unauthorized changes to security configurations are quickly identified and addressed to protect organizational assets and maintain compliance.
 data_source:
     - Cisco Duo Administrator
-search: '`cisco_duo_administrator` action=policy_bulk_delete | rename username as user | spath input=description | rex field=policies max_match=0 "(?<policy_name>[^:,]+):\s+" | eval policy_count=mvcount(policy_name) | where policy_count > 3 | stats count min(_time) as firstTime max(_time) as lastTime by action actionlabel description user admin_email policy_count | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_duo_bulk_policy_deletion_filter`'
+search: |
+    `cisco_duo_administrator` action=policy_bulk_delete | rename username as user | spath input=description | rex field=policies max_match=0 "(?<policy_name>[^:,]+):\s+" | eval policy_count=mvcount(policy_name) | where policy_count > 3 | stats count min(_time) as firstTime max(_time) as lastTime by action actionlabel description user admin_email policy_count | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_duo_bulk_policy_deletion_filter`
 how_to_implement: The analytic leverages Duo activity logs to be ingested using the Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404).
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A user $user$ has deleted more than 3 policies
     entity:
diff --git a/detections/application/cisco_duo_bypass_code_generation.yml b/detections/application/cisco_duo_bypass_code_generation.yml
index 7866c75c2db..4550ef8aa02 100644
--- a/detections/application/cisco_duo_bypass_code_generation.yml
+++ b/detections/application/cisco_duo_bypass_code_generation.yml
@@ -6,26 +6,25 @@ modification_date: '2026-05-13'
 author: Patrick Bareiss, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects when a Duo user generates a bypass code, which allows them to circumvent multi-factor authentication (2FA) protections.
-    It works by monitoring Duo activity logs for the 'bypass_create' action, renaming the affected object as the user, and aggregating events to identify
+description: 'The following analytic detects when a Duo user generates a bypass code, which allows them to circumvent multi-factor authentication (2FA) protections.
+
+    It works by monitoring Duo activity logs for the ''bypass_create'' action, renaming the affected object as the user, and aggregating events to identify
+
     instances where a bypass code is issued. This behavior is significant for a Security Operations Center (SOC) because generating a bypass code can enable
+
     attackers, malicious insiders, or unauthorized administrators to gain access to sensitive systems without the required second authentication factor.
+
     Such activity may indicate account compromise, privilege abuse, or attempts to weaken security controls. Early detection of bypass code generation is
+
     critical, as it allows the SOC to investigate and respond before an attacker can exploit the reduced authentication requirements, helping to prevent
+
     unauthorized access, data breaches, or further lateral movement within the environment. Monitoring for this action helps maintain strong authentication
-    standards and reduces the risk of credential-based attacks.
+
+    standards and reduces the risk of credential-based attacks.'
 data_source:
     - Cisco Duo Administrator
-search: |-
-    `cisco_duo_administrator` action=bypass_create
-      | rename object as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY action actionlabel description
-           user
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `cisco_duo_bypass_code_generation_filter`
+search: |
+    `cisco_duo_administrator` action="bypass_create" | eval user=object | stats count min(_time) as firstTime max(_time) as lastTime by user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_duo_bypass_code_generation_filter`
 how_to_implement: The analytic leverages Duo activity logs to be ingested using the Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404).
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -38,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A user $user$ has generated a bypass code
     entity:
diff --git a/detections/application/cisco_duo_policy_allow_devices_without_screen_lock.yml b/detections/application/cisco_duo_policy_allow_devices_without_screen_lock.yml
index d832da67c5c..3be2ca47513 100644
--- a/detections/application/cisco_duo_policy_allow_devices_without_screen_lock.yml
+++ b/detections/application/cisco_duo_policy_allow_devices_without_screen_lock.yml
@@ -6,16 +6,20 @@ modification_date: '2026-05-13'
 author: Patrick Bareiss, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects when a Duo policy is created or updated to allow devices without a screen lock requirement. It identifies this behavior
-    by searching Duo administrator activity logs for policy creation or update events where the 'require_lock' setting is set to false. This action may indicate
+description: 'The following analytic detects when a Duo policy is created or updated to allow devices without a screen lock requirement. It identifies this behavior
+
+    by searching Duo administrator activity logs for policy creation or update events where the ''require_lock'' setting is set to false. This action may indicate
+
     a weakening of device security controls, potentially exposing the organization to unauthorized access if devices are lost or stolen. For a Security Operations
+
     Center (SOC), identifying such policy changes is critical, as attackers or malicious insiders may attempt to lower authentication standards to facilitate
+
     unauthorized access. The impact of this attack could include increased risk of credential compromise, data breaches, or lateral movement within the
-    environment due to reduced device security requirements.
+
+    environment due to reduced device security requirements.'
 data_source:
     - Cisco Duo Administrator
-search: |-
+search: |
     `cisco_duo_administrator` action=policy_update OR action=policy_create
       | spath input=description
       | search require_lock=false
@@ -38,7 +42,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A policy has been created or updated to allow devices without screen lock by user $user$ with email $admin_email$
     entity:
diff --git a/detections/application/cisco_duo_policy_allow_network_bypass_2fa.yml b/detections/application/cisco_duo_policy_allow_network_bypass_2fa.yml
index bdc0a9a4d16..8dced534c98 100644
--- a/detections/application/cisco_duo_policy_allow_network_bypass_2fa.yml
+++ b/detections/application/cisco_duo_policy_allow_network_bypass_2fa.yml
@@ -6,18 +6,24 @@ modification_date: '2026-05-13'
 author: Patrick Bareiss, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects when a Duo policy is created or updated to allow network-based bypass of two-factor authentication (2FA).
+description: 'The following analytic detects when a Duo policy is created or updated to allow network-based bypass of two-factor authentication (2FA).
+
     It identifies this behavior by searching Duo administrator logs for policy creation or update actions where the networks_allow field is present,
+
     indicating that specific networks have been permitted to bypass 2FA requirements. This is achieved by parsing the event description and
+
     filtering for relevant policy changes, then aggregating the results by user and administrator details. Detecting this behavior is critical
+
     for a Security Operations Center (SOC) because allowing network-based 2FA bypass can significantly weaken authentication controls, potentially
+
     enabling unauthorized access if a trusted network is compromised or misconfigured. Attackers or malicious insiders may exploit this policy
+
     change to circumvent 2FA protections, increasing the risk of account takeover and lateral movement within the environment. Prompt detection
-    enables SOC analysts to investigate and respond to potentially risky policy modifications before they can be leveraged for malicious purposes.
+
+    enables SOC analysts to investigate and respond to potentially risky policy modifications before they can be leveraged for malicious purposes.'
 data_source:
     - Cisco Duo Administrator
-search: |-
+search: |
     `cisco_duo_administrator` action=policy_update OR action=policy_create
       | spath input=description
       | search networks_allow=*
@@ -40,7 +46,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A policy has been created or updated to allow network bypass 2FA by user $user$ with email $admin_email$
     entity:
diff --git a/detections/application/cisco_duo_policy_allow_old_flash.yml b/detections/application/cisco_duo_policy_allow_old_flash.yml
index c1ad24f732a..68235d8362c 100644
--- a/detections/application/cisco_duo_policy_allow_old_flash.yml
+++ b/detections/application/cisco_duo_policy_allow_old_flash.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies instances where a Duo administrator creates or updates a policy to allow the use of outdated Flash components, specifically by detecting policy changes with the flash_remediation=no remediation attribute. It leverages Duo activity logs ingested via the Cisco Security Cloud App, searching for policy_update or policy_create actions and parsing the policy description for indicators of weakened security controls. This behavior is significant for a SOC because permitting old Flash increases the attack surface, as Flash is widely known for its security vulnerabilities and is no longer supported. Attackers may exploit such policy changes to bypass security controls, introduce malware, or escalate privileges within the environment. Detecting and responding to these policy modifications helps prevent potential exploitation, reduces organizational risk, and ensures adherence to security best practices. Immediate investigation is recommended to determine if the change was authorized or indicative of malicious activity.
 data_source:
     - Cisco Duo Administrator
-search: |-
+search: |
     `cisco_duo_administrator` action=policy_update OR action=policy_create
     | spath input=description
     | search flash_remediation="no remediation"
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A policy has been created or updated to allow old flash by user $user$ with email $admin_email$
     entity:
diff --git a/detections/application/cisco_duo_policy_allow_old_java.yml b/detections/application/cisco_duo_policy_allow_old_java.yml
index 493837fb149..fb42a637d61 100644
--- a/detections/application/cisco_duo_policy_allow_old_java.yml
+++ b/detections/application/cisco_duo_policy_allow_old_java.yml
@@ -6,17 +6,22 @@ modification_date: '2026-05-13'
 author: Patrick Bareiss, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects when a Duo policy is created or updated to allow the use of outdated Java versions, which can introduce significant
+description: 'The following analytic detects when a Duo policy is created or updated to allow the use of outdated Java versions, which can introduce significant
+
     security risks. It works by searching Duo administrator activity logs for policy creation or update actions where the policy explicitly sets
-    'java_remediation' to 'no remediation', indicating that no restrictions are enforced against old Java. The analytic aggregates relevant details
+
+    ''java_remediation'' to ''no remediation'', indicating that no restrictions are enforced against old Java. The analytic aggregates relevant details
+
     such as the user, admin email, and action context for further investigation. Identifying this behavior is critical for a Security Operations Center
+
     (SOC) because allowing outdated Java can expose an organization to known vulnerabilities, malware, and exploitation techniques. Attackers or malicious
+
     insiders may attempt to weaken security controls by modifying policies to permit insecure software, increasing the risk of compromise. Prompt detection
-    enables SOC analysts to respond quickly, revert risky changes, and mitigate potential threats before they are exploited.
+
+    enables SOC analysts to respond quickly, revert risky changes, and mitigate potential threats before they are exploited.'
 data_source:
     - Cisco Duo Administrator
-search: |-
+search: |
     `cisco_duo_administrator` action=policy_update OR action=policy_create
       | spath input=description
       | search java_remediation="no remediation"
@@ -39,7 +44,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A policy has been created or updated to allow old java by user $user$ with email $admin_email$
     entity:
diff --git a/detections/application/cisco_duo_policy_allow_tampered_devices.yml b/detections/application/cisco_duo_policy_allow_tampered_devices.yml
index 2af5826f974..f87f4339226 100644
--- a/detections/application/cisco_duo_policy_allow_tampered_devices.yml
+++ b/detections/application/cisco_duo_policy_allow_tampered_devices.yml
@@ -6,18 +6,24 @@ modification_date: '2026-05-13'
 author: Patrick Bareiss, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects when a Duo policy is created or updated to allow tampered or rooted devices, such as jailbroken smartphones,
+description: 'The following analytic detects when a Duo policy is created or updated to allow tampered or rooted devices, such as jailbroken smartphones,
+
     to access protected resources. It identifies this behavior by searching Duo administrator activity logs for policy changes where the allow_rooted_devices
+
     setting is enabled. This is accomplished by filtering for policy creation or update actions and parsing the policy description for the relevant configuration.
+
     Allowing tampered devices poses a significant security risk, as these devices may bypass built-in security controls, run unauthorized software, or be more
+
     susceptible to compromise. For a Security Operations Center (SOC), identifying such policy changes is critical because it may indicate either a
+
     misconfiguration or a malicious attempt to weaken authentication requirements, potentially enabling attackers to access sensitive systems with
+
     compromised devices. The impact of this attack can include unauthorized access, data breaches, and lateral movement within the environment,
-    making prompt detection and response essential to maintaining organizational security.
+
+    making prompt detection and response essential to maintaining organizational security.'
 data_source:
     - Cisco Duo Administrator
-search: |-
+search: |
     `cisco_duo_administrator` action=policy_update OR action=policy_create
       | spath input=description
       | search allow_rooted_devices=true
@@ -40,7 +46,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A policy has been created or updated to allow tampered devices by user $user$ with email $admin_email$
     entity:
diff --git a/detections/application/cisco_duo_policy_bypass_2fa.yml b/detections/application/cisco_duo_policy_bypass_2fa.yml
index 9a26c7c0d51..a79c44d948a 100644
--- a/detections/application/cisco_duo_policy_bypass_2fa.yml
+++ b/detections/application/cisco_duo_policy_bypass_2fa.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects instances where a Duo policy is created or updated to allow access without two-factor authentication (2FA). It identifies this behavior by searching Duo administrator activity logs for policy changes that set the authentication status to "Allow access without 2FA." By monitoring for these specific actions, the analytic highlights potential attempts to weaken authentication controls, which could be indicative of malicious activity or insider threats. This behavior is critical for a SOC to identify, as bypassing 2FA significantly reduces the security posture of an organization, making it easier for attackers to gain unauthorized access to sensitive systems and data. Detecting and responding to such policy changes promptly helps prevent potential account compromise and mitigates the risk of broader security breaches.
 data_source:
     - Cisco Duo Administrator
-search: |-
+search: |
     `cisco_duo_administrator` action=policy_update OR action=policy_create
       | spath input=description
       | search auth_status="Allow access without 2FA"
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A policy has been created or updated to allow access without 2FA by user $user$ with email $admin_email$
     entity:
diff --git a/detections/application/cisco_duo_policy_deny_access.yml b/detections/application/cisco_duo_policy_deny_access.yml
index 434851d872a..48c32b310fc 100644
--- a/detections/application/cisco_duo_policy_deny_access.yml
+++ b/detections/application/cisco_duo_policy_deny_access.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies instances where a Duo administrator creates or updates a policy to explicitly deny user access within the Duo environment. It detects this behavior by searching Duo administrator activity logs for policy creation or update actions where the authentication status is set to "Deny access." By correlating these events with user and admin details, the analytic highlights potential misuse or malicious changes to access policies. This behavior is critical for a SOC to monitor, as unauthorized or suspicious denial of access policies can indicate insider threats, account compromise, or attempts to disrupt legitimate user access. The impact of such an attack may include denial of service to critical accounts, disruption of business operations, or the masking of further malicious activity by preventing targeted users from accessing resources. Early detection enables rapid investigation and remediation to maintain organizational security and availability.
 data_source:
     - Cisco Duo Administrator
-search: |-
+search: |
     `cisco_duo_administrator` action=policy_update OR action=policy_create
       | spath input=description
       | search auth_status="Deny access"
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A policy has been created or updated to deny access by user $user$ with email $admin_email$
     entity:
diff --git a/detections/application/cisco_duo_policy_skip_2fa_for_other_countries.yml b/detections/application/cisco_duo_policy_skip_2fa_for_other_countries.yml
index 20277ead88f..b63dfa236be 100644
--- a/detections/application/cisco_duo_policy_skip_2fa_for_other_countries.yml
+++ b/detections/application/cisco_duo_policy_skip_2fa_for_other_countries.yml
@@ -6,19 +6,26 @@ modification_date: '2026-05-13'
 author: Patrick Bareiss, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects when a Duo policy is created or updated to allow access without two-factor authentication (2FA)
+description: 'The following analytic detects when a Duo policy is created or updated to allow access without two-factor authentication (2FA)
+
     for users in countries other than the default. It identifies this behavior by searching Duo administrator activity logs for policy
+
     creation or update actions where the policy description indicates that access is permitted without 2FA for certain user locations.
-    This is achieved by parsing the relevant fields in the logs and filtering for the specific condition of 'Allow access without 2FA.'
+
+    This is achieved by parsing the relevant fields in the logs and filtering for the specific condition of ''Allow access without 2FA.''
+
     This behavior is significant for a Security Operations Center (SOC) because bypassing 2FA for any user group or location weakens
-    the organization's security posture and increases the risk of unauthorized access. Attackers or malicious insiders may exploit
+
+    the organization''s security posture and increases the risk of unauthorized access. Attackers or malicious insiders may exploit
+
     such policy changes to circumvent strong authentication controls, potentially leading to account compromise, data breaches, or
+
     lateral movement within the environment. Early detection of these policy modifications enables the SOC to investigate and respond
-    before attackers can leverage the weakened controls, thereby reducing the risk and impact of a successful attack.
+
+    before attackers can leverage the weakened controls, thereby reducing the risk and impact of a successful attack.'
 data_source:
     - Cisco Duo Administrator
-search: |-
+search: |
     `cisco_duo_administrator` action=policy_update OR action=policy_create
       | spath input=description
       | search user_locations_default_action="Allow access without 2FA"
@@ -41,7 +48,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A policy has been created or updated to allow access without 2FA for other countries by user $user$ with email $admin_email$
     entity:
diff --git a/detections/application/cisco_duo_set_user_status_to_bypass_2fa.yml b/detections/application/cisco_duo_set_user_status_to_bypass_2fa.yml
index a9b42a7fcf6..7a57ff5d8e2 100644
--- a/detections/application/cisco_duo_set_user_status_to_bypass_2fa.yml
+++ b/detections/application/cisco_duo_set_user_status_to_bypass_2fa.yml
@@ -6,18 +6,24 @@ modification_date: '2026-05-13'
 author: Patrick Bareiss, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects instances where a Duo user's status is changed to "Bypass" for 2FA, specifically when the
+description: 'The following analytic detects instances where a Duo user''s status is changed to "Bypass" for 2FA, specifically when the
+
     previous status was "Active." This behavior is identified by analyzing Duo activity logs for user update actions, extracting
+
     the status transitions, and filtering for cases where a user is set to bypass multi-factor authentication. This is a critical
+
     event for a Security Operations Center (SOC) to monitor, as bypassing 2FA significantly weakens account security and may
+
     indicate malicious insider activity or account compromise. Attackers or unauthorized administrators may exploit this change to
+
     disable strong authentication controls, increasing the risk of unauthorized access to sensitive systems and data. Early detection
+
     of such changes enables rapid investigation and response, helping to prevent potential breaches and limit the impact of
-    credential-based attacks.
+
+    credential-based attacks.'
 data_source:
     - Cisco Duo Administrator
-search: |-
+search: |
     `cisco_duo_activity` action.name=user_update
       | spath input=target.details path=status output=status
       | spath input=old_target.details path=status output=old_status
@@ -45,7 +51,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A user $user$ has set their status to bypass 2FA from IP Address - $src_ip$
     entity:
diff --git a/detections/application/cisco_ios_xe_guestshell_activation_and_destroy.yml b/detections/application/cisco_ios_xe_guestshell_activation_and_destroy.yml
index d4e0825a207..590e9649a21 100644
--- a/detections/application/cisco_ios_xe_guestshell_activation_and_destroy.yml
+++ b/detections/application/cisco_ios_xe_guestshell_activation_and_destroy.yml
@@ -6,12 +6,12 @@ modification_date: '2026-05-20'
 author: Nasreddine Bencherchali
 status: production
 type: Anomaly
-description: |
-    This analytic detects Cisco IOS-XE guestshell enable activity followed by activation and destroy lifecycle logs.
-    The detection focuses on HA_EM command logging for "guestshell enable" and "guestshell destroy", VMAN activation and destroy messages, and IM/IOX guestshell activation logs observed on some IOS-XE images.
+description: 'This analytic detects Cisco IOS-XE guestshell enable activity followed by activation and destroy lifecycle logs.
+
+    The detection focuses on HA_EM command logging for "guestshell enable" and "guestshell destroy", VMAN activation and destroy messages, and IM/IOX guestshell activation logs observed on some IOS-XE images.'
 data_source:
     - Cisco IOS Logs
-search: |-
+search: |
     `cisco_ios`
     facility IN ("HA_EM", "VMAN", "IM", "AAA")
     mnemonic IN ("LOG", "ACTIVATION_STATE", "IOX_INST_INFO", "INSTALL_STATE", "AAA_ACCOUNTING_MESSAGE")
@@ -58,11 +58,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_ios_xe_guestshell_activation_and_destroy_filter`
-how_to_implement: |
-    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
-    Enable EEM catchall command logging to capture the "guestshell enable" and "guestshell destroy" commands as HA_EM/LOG events.
-known_false_positives: |
-    No false positives have been identified at this time.
+how_to_implement: 'Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
+
+    Enable EEM catchall command logging to capture the "guestshell enable" and "guestshell destroy" commands as HA_EM/LOG events.'
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
     - https://blog.talosintelligence.com/salt-typhoon-analysis/
@@ -74,7 +73,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/application/cisco_ios_xe_log_clearing_sequence_with_optional_loopback_removal.yml b/detections/application/cisco_ios_xe_log_clearing_sequence_with_optional_loopback_removal.yml
index 5401c1d93ef..33baa72d55c 100644
--- a/detections/application/cisco_ios_xe_log_clearing_sequence_with_optional_loopback_removal.yml
+++ b/detections/application/cisco_ios_xe_log_clearing_sequence_with_optional_loopback_removal.yml
@@ -6,12 +6,12 @@ modification_date: '2026-05-20'
 author: Nasreddine Bencherchali
 status: production
 type: Anomaly
-description: |
-    This analytic detects Cisco IOS-XE command sequences where show logging, clear logging, and exit occur within a short period.
-    It also detects the pattern where a loopback interface is removed before clearing logs and exiting.
+description: 'This analytic detects Cisco IOS-XE command sequences where show logging, clear logging, and exit occur within a short period.
+
+    It also detects the pattern where a loopback interface is removed before clearing logs and exiting.'
 data_source:
     - Cisco IOS Logs
-search: |-
+search: |
     `cisco_ios`
     facility IN ("AAA", "HA_EM", "PARSER")
     mnemonic IN ("AAA_ACCOUNTING_MESSAGE", "LOG", "CFGLOG_LOGGEDCMD")
@@ -45,11 +45,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_ios_xe_log_clearing_sequence_with_optional_loopback_removal_filter`
-how_to_implement: |
-    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
-    Command visibility requires AAA command accounting, archive/config logging for configuration commands, or EEM catchall logging.
-known_false_positives: |
-    No false positives have been identified at this time.
+how_to_implement: 'Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
+
+    Command visibility requires AAA command accounting, archive/config logging for configuration commands, or EEM catchall logging.'
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
     - https://blog.talosintelligence.com/salt-typhoon-analysis/
@@ -61,7 +60,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/application/cisco_ios_xe_reconnaissance_command_activity.yml b/detections/application/cisco_ios_xe_reconnaissance_command_activity.yml
index 3091f0c596c..5d4803a546d 100644
--- a/detections/application/cisco_ios_xe_reconnaissance_command_activity.yml
+++ b/detections/application/cisco_ios_xe_reconnaissance_command_activity.yml
@@ -6,13 +6,14 @@ modification_date: '2026-05-20'
 author: Nasreddine Bencherchali
 status: production
 type: Anomaly
-description: |
-    This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft.
+description: 'This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft.
+
     Adversaries who gain initial access to network infrastructure devices typically perform systematic reconnaissance to understand the device configuration, network topology, security policies, connected systems, and potential attack paths.
-    This reconnaissance phase involves executing multiple "show" commands to enumerate device details, running configurations, active connections, routing information, and VPN sessions.
+
+    This reconnaissance phase involves executing multiple "show" commands to enumerate device details, running configurations, active connections, routing information, and VPN sessions.'
 data_source:
     - Cisco IOS Logs
-search: |-
+search: |
     `cisco_ios`
     facility IN ("AAA", "HA_EM")
     mnemonic IN ("AAA_ACCOUNTING_MESSAGE", "LOG")
@@ -59,12 +60,12 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_ios_xe_reconnaissance_command_activity_filter`
-how_to_implement: |
-    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
+how_to_implement: 'Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
+
     On Nexus, local accounting can emit "%AAA-6-AAA_ACCOUNTING_MESSAGE".
-    On Catalyst, use TACACS+ command accounting or EEM catchall syslog for exec command visibility.
-known_false_positives: |
-    Network audits and troubleshooting can produce similar command bursts. Tune the command list, threshold, and approved administrators for the environment.
+
+    On Catalyst, use TACACS+ command accounting or EEM catchall syslog for exec command visibility.'
+known_false_positives: Network audits and troubleshooting can produce similar command bursts. Tune the command list, threshold, and approved administrators for the environment.
 references:
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
     - https://blog.talosintelligence.com/salt-typhoon-analysis/
@@ -76,7 +77,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/application/cisco_ios_xe_remote_access_probe_burst.yml b/detections/application/cisco_ios_xe_remote_access_probe_burst.yml
index 6aa383d4f54..b37d6379c2f 100644
--- a/detections/application/cisco_ios_xe_remote_access_probe_burst.yml
+++ b/detections/application/cisco_ios_xe_remote_access_probe_burst.yml
@@ -6,11 +6,10 @@ modification_date: '2026-05-20'
 author: Nasreddine Bencherchali
 status: production
 type: Anomaly
-description: |
-    This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. The Salt Typhoon notes describe repeated SSH, Telnet-to-port-22, and ping activity across multiple IP addresses in a short time window.
+description: This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. The Salt Typhoon notes describe repeated SSH, Telnet-to-port-22, and ping activity across multiple IP addresses in a short time window.
 data_source:
     - Cisco IOS Logs
-search: |-
+search: |
     `cisco_ios`
     facility IN ("AAA", "HA_EM")
     mnemonic IN ("AAA_ACCOUNTING_MESSAGE", "LOG")
@@ -37,11 +36,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_ios_xe_remote_access_probe_burst_filter`
-how_to_implement: |
-    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
-    Command visibility requires AAA command accounting, archive/config logging for configuration commands, or EEM catchall logging.
-known_false_positives: |
-    Network reachability testing, migration validation, and troubleshooting can generate repeated ping, SSH, or Telnet commands.
+how_to_implement: 'Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
+
+    Command visibility requires AAA command accounting, archive/config logging for configuration commands, or EEM catchall logging.'
+known_false_positives: Network reachability testing, migration validation, and troubleshooting can generate repeated ping, SSH, or Telnet commands.
 references:
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
     - https://blog.talosintelligence.com/salt-typhoon-analysis/
@@ -53,7 +51,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/application/cisco_ios_xe_request_platform_package_describe_shell_pattern.yml b/detections/application/cisco_ios_xe_request_platform_package_describe_shell_pattern.yml
index 92e256614af..0f649044d3e 100644
--- a/detections/application/cisco_ios_xe_request_platform_package_describe_shell_pattern.yml
+++ b/detections/application/cisco_ios_xe_request_platform_package_describe_shell_pattern.yml
@@ -6,30 +6,15 @@ modification_date: '2026-05-20'
 author: Nasreddine Bencherchali
 status: production
 type: TTP
-description: |
-    This analytic detects Cisco IOS-XE "request platform software package describe" commands containing suspicious shell-style filename patterns. Indicative of Slat Typhoon tradecraft.
+description: This analytic detects Cisco IOS-XE "request platform software package describe" commands containing suspicious shell-style filename patterns. Indicative of Slat Typhoon tradecraft.
 data_source:
     - Cisco IOS Logs
-search: |-
-    `cisco_ios`
-    facility IN ("AAA", "HA_EM")
-    mnemonic IN ("AAA_ACCOUNTING_MESSAGE", "LOG")
-    message_text="*request platform software package describe*"
-    message_text IN ("*--filename=/(bash)n*", "*--filename=$(bash)n*")
+search: |
+    `cisco_ios` facility IN ("AAA", "HA_EM") mnemonic IN ("AAA_ACCOUNTING_MESSAGE", "LOG") message_text="*request platform software package describe*" message_text IN ("*--filename=/(bash)n*", "*--filename=$(bash)n*") | eval host=host | stats count min(_time) as firstTime max(_time) as lastTime by user dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_ios_xe_request_platform_package_describe_shell_pattern_filter`
+how_to_implement: 'Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
 
-    | eval dest=coalesce(host, dvc, dest, "unknown")
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-                  values(message_text) as message
-      by dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_ios_xe_request_platform_package_describe_shell_pattern_filter`
-how_to_implement: |
-    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
-    Command visibility requires AAA command accounting or EEM catchall command logging.
-known_false_positives: |
-    No false positives have been identified at this time.
+    Command visibility requires AAA command accounting or EEM catchall command logging.'
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
     - https://blog.talosintelligence.com/salt-typhoon-analysis/
@@ -41,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious request platform package describe command was issued on $dest$.
     entity:
diff --git a/detections/application/cisco_ios_xe_tunnel_interface_configuration.yml b/detections/application/cisco_ios_xe_tunnel_interface_configuration.yml
index 711fd37e22f..db8f4f809e2 100644
--- a/detections/application/cisco_ios_xe_tunnel_interface_configuration.yml
+++ b/detections/application/cisco_ios_xe_tunnel_interface_configuration.yml
@@ -6,11 +6,10 @@ modification_date: '2026-05-20'
 author: Nasreddine Bencherchali
 status: production
 type: Anomaly
-description: |
-    This analytic detects creation of a Cisco IOS-XE tunnel interface with tunnel source, tunnel destination, and an IP address in the 10.10.12.0 network. The Salt Typhoon notes identify this tunnel configuration pattern as suspicious.
+description: This analytic detects creation of a Cisco IOS-XE tunnel interface with tunnel source, tunnel destination, and an IP address in the 10.10.12.0 network. The Salt Typhoon notes identify this tunnel configuration pattern as suspicious.
 data_source:
     - Cisco IOS Logs
-search: |-
+search: |
     `cisco_ios`
     facility IN ("HA_EM", "PARSER")
     mnemonic IN ("LOG", "CFGLOG_LOGGEDCMD")
@@ -48,10 +47,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_ios_xe_tunnel_interface_configuration_filter`
-how_to_implement: |
-    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios" and enable archive/config command logging.
-known_false_positives: |
-    No false positives have been identified at this time.
+how_to_implement: Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios" and enable archive/config command logging.
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
     - https://blog.talosintelligence.com/salt-typhoon-analysis/
@@ -63,7 +60,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/application/cisco_ios_xe_vty_access_class_tampering.yml b/detections/application/cisco_ios_xe_vty_access_class_tampering.yml
index 802590a73a9..7212ba61851 100644
--- a/detections/application/cisco_ios_xe_vty_access_class_tampering.yml
+++ b/detections/application/cisco_ios_xe_vty_access_class_tampering.yml
@@ -6,11 +6,10 @@ modification_date: '2026-05-20'
 author: Nasreddine Bencherchali
 status: production
 type: Anomaly
-description: |
-    This analytic detects rapid modification of Cisco IOS-XE VTY access-class settings. The Salt Typhoon notes describe configure HTTP activity followed by line vty changes and removal/re-application of an access-class within 60 seconds.
+description: This analytic detects rapid modification of Cisco IOS-XE VTY access-class settings. The Salt Typhoon notes describe configure HTTP activity followed by line vty changes and removal/re-application of an access-class within 60 seconds.
 data_source:
     - Cisco IOS Logs
-search: |-
+search: |
     `cisco_ios`
     facility IN ("HA_EM", "PARSER")
     mnemonic IN ("LOG", "CFGLOG_LOGGEDCMD")
@@ -50,10 +49,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_ios_xe_vty_access_class_tampering_filter`
-how_to_implement: |
-    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios" and enable archive/config command logging.
-known_false_positives: |
-    VTY ACL changes occur during legitimate management access updates. Filter approved maintenance windows and known administrators.
+how_to_implement: Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios" and enable archive/config command logging.
+known_false_positives: VTY ACL changes occur during legitimate management access updates. Filter approved maintenance windows and known administrators.
 references:
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
     - https://blog.talosintelligence.com/salt-typhoon-analysis/
@@ -65,7 +62,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/application/cisco_ios_xe_webui_login_from_iosd_local_port.yml b/detections/application/cisco_ios_xe_webui_login_from_iosd_local_port.yml
index d7b2434312d..d209b9c2860 100644
--- a/detections/application/cisco_ios_xe_webui_login_from_iosd_local_port.yml
+++ b/detections/application/cisco_ios_xe_webui_login_from_iosd_local_port.yml
@@ -6,12 +6,12 @@ modification_date: '2026-05-19'
 author: Nasreddine Bencherchali
 status: production
 type: TTP
-description: |
-    This analytic detects Cisco IOS-XE WebUI authentication failure and success logs that include local port 21111.
-    This is a strong an indicator of WebUI exploitation because normal users should not authenticate through the underlying IOS-XE Linux shell path.
+description: 'This analytic detects Cisco IOS-XE WebUI authentication failure and success logs that include local port 21111.
+
+    This is a strong an indicator of WebUI exploitation because normal users should not authenticate through the underlying IOS-XE Linux shell path.'
 data_source:
     - Cisco IOS Logs
-search: |-
+search: |
     `cisco_ios`
     facility="SEC_LOGIN"
     mnemonic IN ("QUIET_MODE_ON", "LOGIN_SUCCESS", "LOGIN_FAILED")
@@ -30,11 +30,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_ios_xe_webui_login_from_iosd_local_port_filter`
-how_to_implement: |
-    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
-    Login failure logging must be enabled with "login on-failure log".
-known_false_positives: |
-    This local port value should not appear for normal WebUI logins. So false positives should very minimal.
+how_to_implement: 'Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
+
+    Login failure logging must be enabled with "login on-failure log".'
+known_false_positives: This local port value should not appear for normal WebUI logins. So false positives should very minimal.
 references:
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
     - https://blog.talosintelligence.com/salt-typhoon-analysis/
@@ -46,7 +45,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: WebUI authentication failure with local port 21111 from $src_ip$.
     entity:
diff --git a/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml b/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml
index 8beac37a157..82b6e1012da 100644
--- a/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml
+++ b/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml
@@ -6,11 +6,10 @@ modification_date: '2026-09-08'
 author: Nasreddine Bencherchali
 status: production
 type: Anomaly
-description: |
-    The following analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process.
+description: The following analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process.
 data_source:
     - Cisco IOS Logs
-search: |-
+search: |
     `cisco_ios`
     facility="SYS"
     mnemonic="CONFIG_P"
@@ -25,11 +24,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_ios_xe_webui_programmatic_configuration_filter`
-how_to_implement: |
-    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
-    Enable WebUI activity logging by IOS-XE.
-known_false_positives: |
-    No false positives have been identified at this time.
+how_to_implement: 'Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
+
+    Enable WebUI activity logging by IOS-XE.'
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
     - https://blog.talosintelligence.com/salt-typhoon-analysis/
@@ -41,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/application/cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication.yml b/detections/application/cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication.yml
index 25e26749f6b..4323d67e107 100644
--- a/detections/application/cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication.yml
+++ b/detections/application/cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication.yml
@@ -6,13 +6,14 @@ modification_date: '2026-06-09'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
-description: |-
-    This analytic identifies multiple unique source IP addresses successfully authenticating as `vmanage-admin` via SSH publickey on Cisco Catalyst SD-WAN control components within a short time window.
+description: 'This analytic identifies multiple unique source IP addresses successfully authenticating as `vmanage-admin` via SSH publickey on Cisco Catalyst SD-WAN control components within a short time window.
+
     This aligns with IoC guidance for CVE-2026-20127 (cisco-sa-sdwan-rpa-EHchtZk), which warns that compromised systems may show `Accepted publickey for vmanage-admin` entries from unauthorized IPs.
-    Validate flagged source IPs against known System IPs in SD-WAN Manager and investigate unexpected or concurrent sources.
+
+    Validate flagged source IPs against known System IPs in SD-WAN Manager and investigate unexpected or concurrent sources.'
 data_source:
     - Cisco SD-WAN Auth Log
-search: |-
+search: |
     `cisco_sd_wan_syslog`
     "Accepted publickey"
     | rex field=_raw "^(?<event_timestamp>\S+)\s+(?<dest>\S+)\s+<auth\.info>\s+sshd\[\d+\]:\s+Accepted publickey for (?<user>\S+) from (?<src>\S+) port (?<src_port>\d+) ssh2:\s+(?<key_type>\S+)\s+(?<ssh_key>\S+)"
@@ -25,10 +26,8 @@ search: |-
     | where unique_src_ips >= 2
     | sort 0 - unique_src_ips
     | `cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication_filter`
-how_to_implement: |
-    This detection requires Cisco SD-WAN auth logs from the /var/log/auth.log file to be ingested into Splunk.
-known_false_positives: |
-    No false positives have been identified at this time.
+how_to_implement: This detection requires Cisco SD-WAN auth logs from the /var/log/auth.log file to be ingested into Splunk.
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
 analytic_story:
diff --git a/detections/application/cisco_sd_wan_multiple_ssh_key_authentication_from_same_source.yml b/detections/application/cisco_sd_wan_multiple_ssh_key_authentication_from_same_source.yml
index eb0575379df..19c926ba0d9 100644
--- a/detections/application/cisco_sd_wan_multiple_ssh_key_authentication_from_same_source.yml
+++ b/detections/application/cisco_sd_wan_multiple_ssh_key_authentication_from_same_source.yml
@@ -6,13 +6,14 @@ modification_date: '2026-06-09'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
-description: |-
-    This hunting analytic identifies multiple distinct SSH publickey fingerprints used to authenticate the same user from the same source IP against a Cisco Catalyst SD-WAN control component.
+description: 'This hunting analytic identifies multiple distinct SSH publickey fingerprints used to authenticate the same user from the same source IP against a Cisco Catalyst SD-WAN control component.
+
     After legitimate vManage key rotation or reboot, a new key may appear but the old key should no longer be used; continued use of more than one key from the same source may indicate unauthorized key injection or persistence related to CVE-2026-20127 (cisco-sa-sdwan-rpa-EHchtZk).
-    Validate flagged keys and source IPs against known System IPs in SD-WAN Manager and investigate unexpected combinations.
+
+    Validate flagged keys and source IPs against known System IPs in SD-WAN Manager and investigate unexpected combinations.'
 data_source:
     - Cisco SD-WAN Auth Log
-search: |-
+search: |
     `cisco_sd_wan_syslog`
     "Accepted publickey"
     | rex field=_raw "^(?<event_timestamp>\S+)\s+(?<dest>\S+)\s+<auth\.info>\s+sshd\[\d+\]:\s+Accepted publickey for (?<user>\S+) from (?<src>\S+) port (?<src_port>\d+) ssh2:\s+(?<key_type>\S+)\s+(?<ssh_key>\S+)"
@@ -21,10 +22,8 @@ search: |-
       count by dest user src
     | where distinct_keys > 1
     | `cisco_sd_wan_multiple_ssh_key_authentication_from_same_source_filter`
-how_to_implement: |
-    This detection requires Cisco SD-WAN auth logs from the /var/log/auth.log file to be ingested into Splunk.
-known_false_positives: |
-    No false positives have been identified at this time.
+how_to_implement: This detection requires Cisco SD-WAN auth logs from the /var/log/auth.log file to be ingested into Splunk.
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
 analytic_story:
diff --git a/detections/application/crushftp_server_side_template_injection.yml b/detections/application/crushftp_server_side_template_injection.yml
index 10f87b5b5cf..8e9e16b7cc5 100644
--- a/detections/application/crushftp_server_side_template_injection.yml
+++ b/detections/application/crushftp_server_side_template_injection.yml
@@ -9,7 +9,8 @@ type: TTP
 description: This analytic is designed to identify attempts to exploit a server-side template injection vulnerability in CrushFTP, designated as CVE-2024-4040. This severe vulnerability enables unauthenticated remote attackers to access and read files beyond the VFS Sandbox, circumvent authentication protocols, and execute arbitrary commands on the affected server. The issue impacts all versions of CrushFTP up to 10.7.1 and 11.1.0 on all supported platforms. It is highly recommended to apply patches immediately to prevent unauthorized access to the system and avoid potential data compromises. The search specifically looks for patterns in the raw log data that match the exploitation attempts, including READ or WRITE actions, and extracts relevant information such as the protocol, session ID, user, IP address, HTTP method, and the URI queried. It then evaluates these logs to confirm traces of exploitation based on the presence of specific keywords and the originating IP address, counting and sorting these events for further analysis.
 data_source:
     - CrushFTP
-search: '`crushftp` | rex field=_raw "\[(?<protocol>HTTPS|HTTP):(?<session_id>[^\:]+):(?<user>[^\:]+):(?<src_ip>\d+\.\d+\.\d+\.\d+)\] (?<action>READ|WROTE): \*(?<http_method>[A-Z]+) (?<uri_query>[^\s]+) HTTP/[^\*]+\*" | eval message=if(match(_raw, "INCLUDE") and isnotnull(src_ip), "traces of exploitation by " . src_ip, "false") | search message!=false | rename host as dest | stats count by _time, dest, source, message, src_ip, http_method, uri_query, user, action | sort -_time| `crushftp_server_side_template_injection_filter`'
+search: |
+    `crushftp` | rex field=_raw "\[(?<protocol>HTTPS|HTTP):(?<session_id>[^\:]+):(?<user>[^\:]+):(?<src_ip>\d+\.\d+\.\d+\.\d+)\] (?<action>READ|WROTE): \*(?<http_method>[A-Z]+) (?<uri_query>[^\s]+) HTTP/[^\*]+\*" | eval message=if(match(_raw, "INCLUDE") and isnotnull(src_ip), "traces of exploitation by " . src_ip, "false") | search message!=false | rename host as dest | stats count by _time, dest, source, message, src_ip, http_method, uri_query, user, action | sort -_time| `crushftp_server_side_template_injection_filter`
 how_to_implement: CrushFTP Session logs, from Windows or Linux, must be ingested to Splunk. Currently, there is no TA for CrushFTP, so the data must be extracted from the raw logs.
 known_false_positives: False positives should be limited, however tune or filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential exploitation of CrushFTP Server Side Template Injection Vulnerability on $dest$ by $src_ip$.
     entity:
@@ -51,6 +52,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/crushftp/crushftp.log
-          sourcetype: crushftp:sessionlogs
           source: crushftp
+          sourcetype: crushftp:sessionlogs
       test_type: unit
diff --git a/detections/application/detect_distributed_password_spray_attempts.yml b/detections/application/detect_distributed_password_spray_attempts.yml
index 19003ae8660..2f7bcd70331 100644
--- a/detections/application/detect_distributed_password_spray_attempts.yml
+++ b/detections/application/detect_distributed_password_spray_attempts.yml
@@ -9,40 +9,12 @@ type: Hunting
 description: This analytic employs the 3-sigma approach to identify distributed password spray attacks. A distributed password spray attack is a type of brute force attack where the attacker attempts a few common passwords against many different accounts, connecting from multiple IP addresses to avoid detection. By utilizing the Authentication Data Model, this detection is effective for all CIM-mapped authentication events, providing comprehensive coverage and enhancing security against these attacks.
 data_source:
     - Azure Active Directory Sign-in activity
-search: >-
-    | tstats `security_content_summariesonly` dc(Authentication.user) AS unique_accounts
-    dc(Authentication.src) as unique_src values(Authentication.app) as app values(Authentication.src)
-    as src count(Authentication.user) as total_failures from datamodel=Authentication.Authentication
-    where Authentication.action="failure" NOT Authentication.src IN ("-","unknown")
-    Authentication.user_agent="*" by Authentication.signature_id, Authentication.user_agent,
-    sourcetype, _time  span=10m
-    | `drop_dm_object_name("Authentication")`
-    ```fill out time buckets for 0-count events during entire search length```
-    | appendpipe [| timechart limit=0 span=10m count | table _time]
-    | fillnull value=0 unique_accounts, unique_src
-    ``` Create aggregation field & apply to all null events```
-    | eval counter=sourcetype+"__"+signature_id
-    | eventstats values(counter) as fnscounter | eval counter=coalesce(counter,fnscounter)  |
-    stats values(total_failures) as total_failures values(signature_id) as signature_id
-    values(src) as src values(sourcetype) as sourcetype values(app) as app count by
-    counter unique_accounts unique_src user_agent _time
+search: |
+    | tstats `security_content_summariesonly` dc(Authentication.user) AS unique_accounts dc(Authentication.src) as unique_src values(Authentication.app) as app values(Authentication.src) as src count(Authentication.user) as total_failures from datamodel=Authentication.Authentication where Authentication.action="failure" NOT Authentication.src IN ("-","unknown") Authentication.user_agent="*" by Authentication.signature_id, Authentication.user_agent, sourcetype, _time  span=10m | `drop_dm_object_name("Authentication")` ```fill out time buckets for 0-count events during entire search length``` | appendpipe [| timechart limit=0 span=10m count | table _time] | fillnull value=0 unique_accounts, unique_src ``` Create aggregation field & apply to all null events``` | eval counter=sourcetype+"__"+signature_id | eventstats values(counter) as fnscounter | eval counter=coalesce(counter,fnscounter)  | stats values(total_failures) as total_failures values(signature_id) as signature_id values(src) as src values(sourcetype) as sourcetype values(app) as app count by counter unique_accounts unique_src user_agent _time
       ``` remove 0 count rows where counter has data```
-    | sort - _time unique_accounts
-    | dedup _time counter
-    ``` 3-sigma detection logic ```
-    | eventstats avg(unique_accounts) as comp_avg_user , stdev(unique_accounts) as comp_std_user
-    avg(unique_src) as comp_avg_src , stdev(unique_src) as comp_std_src by counter user_agent
-    | eval upperBoundUser=(comp_avg_user+comp_std_user*3), upperBoundsrc=(comp_avg_src+comp_std_src*3)
-    | eval isOutlier=if((unique_accounts > 30 and unique_accounts >= upperBoundUser)
-    and (unique_src > 30 and unique_src >= upperBoundsrc), 1, 0)
-    | replace "::ffff:*" with * in src
-    | where isOutlier=1
-    | foreach *
+    | sort - _time unique_accounts | dedup _time counter ``` 3-sigma detection logic ``` | eventstats avg(unique_accounts) as comp_avg_user , stdev(unique_accounts) as comp_std_user avg(unique_src) as comp_avg_src , stdev(unique_src) as comp_std_src by counter user_agent | eval upperBoundUser=(comp_avg_user+comp_std_user*3), upperBoundsrc=(comp_avg_src+comp_std_src*3) | eval isOutlier=if((unique_accounts > 30 and unique_accounts >= upperBoundUser) and (unique_src > 30 and unique_src >= upperBoundsrc), 1, 0) | replace "::ffff:*" with * in src | where isOutlier=1 | foreach *
         [ eval <<FIELD>> = if(<<FIELD>>="null",null(),<<FIELD>>)]
-    | mvexpand src  | iplocation src  | table _time, unique_src, unique_accounts, total_failures,
-    sourcetype, signature_id, user_agent, src, Country
-    | eval date_wday=strftime(_time,"%a"), date_hour=strftime(_time,"%H")
-    | `detect_distributed_password_spray_attempts_filter`
+    | mvexpand src  | iplocation src  | table _time, unique_src, unique_accounts, total_failures, sourcetype, signature_id, user_agent, src, Country | eval date_wday=strftime(_time,"%a"), date_hour=strftime(_time,"%H") | `detect_distributed_password_spray_attempts_filter`
 how_to_implement: Ensure that all relevant authentication data is mapped to the Common Information Model (CIM) and that the src field is populated with the source device information. Additionally, ensure that fill_nullvalue is set within the security_content_summariesonly macro to include authentication events from log sources that do not feature the signature_id field in the results.
 known_false_positives: It is common to see a spike of legitimate failed authentication events on monday mornings.
 references:
diff --git a/detections/application/detect_html_help_spawn_child_process.yml b/detections/application/detect_html_help_spawn_child_process.yml
index 27905230b3c..500d08f1376 100644
--- a/detections/application/detect_html_help_spawn_child_process.yml
+++ b/detections/application/detect_html_help_spawn_child_process.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=hh.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_html_help_spawn_child_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*hh.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_spawn_child_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications (ex. web browsers) may spawn a child process. Filter as needed.
 references:
@@ -42,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior.
     entity:
diff --git a/detections/application/detect_new_login_attempts_to_routers.yml b/detections/application/detect_new_login_attempts_to_routers.yml
index 4d4043c7f56..6f2fabf7e46 100644
--- a/detections/application/detect_new_login_attempts_to_routers.yml
+++ b/detections/application/detect_new_login_attempts_to_routers.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic identifies new login attempts to routers. It leverages authentication logs from the ES Assets and Identity Framework, focusing on assets categorized as routers. The detection flags connections that have not been observed in the past 30 days. This activity is significant because unauthorized access to routers can lead to network disruptions or data interception. If confirmed malicious, attackers could gain control over network traffic, potentially leading to data breaches or further network compromise.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` count earliest(_time) as earliest latest(_time) as latest FROM datamodel=Authentication
       WHERE Authentication.dest_category=router
       BY Authentication.dest Authentication.user
diff --git a/detections/application/detect_password_spray_attempts.yml b/detections/application/detect_password_spray_attempts.yml
index 30eedc75b03..2e7a0bb63b8 100644
--- a/detections/application/detect_password_spray_attempts.yml
+++ b/detections/application/detect_password_spray_attempts.yml
@@ -9,8 +9,8 @@ type: TTP
 description: This analytic employs the 3-sigma approach to detect an unusual volume of failed authentication attempts from a single source. A password spray attack is a type of brute force attack where an attacker tries a few common passwords across many different accounts to avoid detection and account lockouts. By utilizing the Authentication Data Model, this detection is effective for all CIM-mapped authentication events, providing comprehensive coverage and enhancing security against these attacks.
 data_source:
     - Windows Event Log Security 4625
-search: "| tstats `security_content_summariesonly` values(Authentication.user) AS unique_user_names dc(Authentication.user) AS unique_accounts values(Authentication.app) as app count(Authentication.user) as total_failures from datamodel=Authentication.Authentication where Authentication.action=\"failure\" NOT Authentication.src IN (\"-\",\"unknown\") by Authentication.action Authentication.app Authentication.authentication_method Authentication.dest \n  Authentication.signature Authentication.signature_id Authentication.src sourcetype _time span=5m  \n| `drop_dm_object_name(\"Authentication\")`\n    ```fill out time buckets for 0-count events during entire search length```\n| appendpipe [| timechart limit=0 span=5m count | table _time] | fillnull value=0 unique_accounts\n  ``` Create aggregation field & apply to all null events```\n| eval counter=src+\"__\"+sourcetype+\"__\"+signature_id  | eventstats values(counter) as fnscounter  | eval counter=coalesce(counter,fnscounter) \n  ``` stats version of mvexpand ```\n| stats values(app) as app values(unique_user_names) as unique_user_names values(total_failures) as total_failures values(src) as src values(signature_id) as signature_id values(sourcetype) as sourcetype count by counter unique_accounts _time\n    ``` remove duplicate time buckets for each unique source```\n| sort - _time unique_accounts | dedup _time counter\n    ```Find the outliers```\n| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by counter | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 30 and unique_accounts >= upperBound, 1, 0) | replace \"::ffff:*\" with * in src  | where isOutlier=1  | foreach * \n    [ eval <<FIELD>> = if(<<FIELD>>=\"null\",null(),<<FIELD>>)] \n| table _time, src, action, app, unique_accounts, unique_user_names, total_failures, sourcetype, signature_id, counter | `detect_password_spray_attempts_filter`"
-how_to_implement: 'Ensure in-scope authentication data is CIM mapped and the src field is populated with the source device.  Also ensure fill_nullvalue is set within the macro security_content_summariesonly. This search opporates best on a 5 minute schedule, looking back over the past 70 minutes.  Configure 70 minute throttling on the two fields _time and counter. '
+search: "| tstats `security_content_summariesonly` values(Authentication.user) AS unique_user_names dc(Authentication.user) AS unique_accounts values(Authentication.app) as app count(Authentication.user) as total_failures from datamodel=Authentication.Authentication where Authentication.action=\"failure\" NOT Authentication.src IN (\"-\",\"unknown\") by Authentication.action Authentication.app Authentication.authentication_method Authentication.dest \n  Authentication.signature Authentication.signature_id Authentication.src sourcetype _time span=5m  \n| `drop_dm_object_name(\"Authentication\")`\n    ```fill out time buckets for 0-count events during entire search length```\n| appendpipe [| timechart limit=0 span=5m count | table _time] | fillnull value=0 unique_accounts\n  ``` Create aggregation field & apply to all null events```\n| eval counter=src+\"__\"+sourcetype+\"__\"+signature_id  | eventstats values(counter) as fnscounter  | eval counter=coalesce(counter,fnscounter) \n  ``` stats version of mvexpand ```\n| stats values(app) as app values(unique_user_names) as unique_user_names values(total_failures) as total_failures values(src) as src values(signature_id) as signature_id values(sourcetype) as sourcetype count by counter unique_accounts _time\n    ``` remove duplicate time buckets for each unique source```\n| sort - _time unique_accounts | dedup _time counter\n    ```Find the outliers```\n| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by counter | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 30 and unique_accounts >= upperBound, 1, 0) | replace \"::ffff:*\" with * in src  | where isOutlier=1  | foreach * \n    [ eval <<FIELD>> = if(<<FIELD>>=\"null\",null(),<<FIELD>>)] \n| table _time, src, action, app, unique_accounts, unique_user_names, total_failures, sourcetype, signature_id, counter | `detect_password_spray_attempts_filter`\n"
+how_to_implement: Ensure in-scope authentication data is CIM mapped and the src field is populated with the source device.  Also ensure fill_nullvalue is set within the macro security_content_summariesonly. This search opporates best on a 5 minute schedule, looking back over the past 70 minutes.  Configure 70 minute throttling on the two fields _time and counter.
 known_false_positives: No false positives have been identified at this time.
 references:
     - https://attack.mitre.org/techniques/T1110/003/
@@ -22,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$sourcetype$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$sourcetype$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential Password Spraying attack from $src$ targeting $unique_accounts$ unique accounts.
     entity:
diff --git a/detections/application/email_attachments_with_lots_of_spaces.yml b/detections/application/email_attachments_with_lots_of_spaces.yml
index 85399962619..cdda66ac8f8 100644
--- a/detections/application/email_attachments_with_lots_of_spaces.yml
+++ b/detections/application/email_attachments_with_lots_of_spaces.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Anomaly
 description: The following analytic detects email attachments with an unusually high number of spaces in their file names, which is a common tactic used by attackers to obfuscate file extensions. It leverages the Email data model to identify attachments where the ratio of spaces to the total file name length exceeds 10%. This behavior is significant as it may indicate an attempt to bypass security filters and deliver malicious payloads. If confirmed malicious, this activity could lead to the execution of harmful code or unauthorized access to sensitive information within the recipient's environment.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` count values(All_Email.recipient) as recipient_address min(_time) as firstTime max(_time) as lastTime FROM datamodel=Email
       WHERE All_Email.file_name="*"
       BY All_Email.src_user, All_Email.file_name All_Email.message_id
@@ -19,7 +19,11 @@ search: |-
     | search space_ratio >= 0.1
     | rex field=recipient_address "(?<recipient_user>.*)@"
     | `email_attachments_with_lots_of_spaces_filter`
-how_to_implement: "You need to ingest data from emails. Specifically, the sender's address and the file names of any attachments must be mapped to the Email data model. The threshold ratio is set to 10%, but this value can be configured to suit each environment.\n**Splunk Phantom Playbook Integration**\nIf Splunk Phantom is also configured in your environment, a playbook called \"Suspicious Email Attachment Investigate and Delete\" can be configured to run when any results are found by this detection search. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/` and add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search. The finding based event will be sent to Phantom and the playbook will gather further information about the file attachment and its network behaviors. If Phantom finds malicious behavior and an analyst approves of the results, the email will be deleted from the user's inbox."
+how_to_implement: 'You need to ingest data from emails. Specifically, the sender''s address and the file names of any attachments must be mapped to the Email data model. The threshold ratio is set to 10%, but this value can be configured to suit each environment.
+
+    **Splunk Phantom Playbook Integration**
+
+    If Splunk Phantom is also configured in your environment, a playbook called "Suspicious Email Attachment Investigate and Delete" can be configured to run when any results are found by this detection search. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/` and add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search. The finding based event will be sent to Phantom and the playbook will gather further information about the file attachment and its network behaviors. If Phantom finds malicious behavior and an analyst approves of the results, the email will be deleted from the user''s inbox.'
 known_false_positives: No false positives have been identified at this time.
 references: []
 intermediate_findings:
diff --git a/detections/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/application/email_files_written_outside_of_the_outlook_directory.yml
index 211609724d0..35fe0f1374f 100644
--- a/detections/application/email_files_written_outside_of_the_outlook_directory.yml
+++ b/detections/application/email_files_written_outside_of_the_outlook_directory.yml
@@ -6,48 +6,21 @@ modification_date: '2026-09-08'
 author: Bhavin Patel, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects email files (.pst or .ost) being created outside the standard Outlook directories.
+description: 'The following analytic detects email files (.pst or .ost) being created outside the standard Outlook directories.
+
     It leverages the Endpoint.Filesystem data model to identify file creation events and filters for email files not located in "C:\Users\*\My Documents\Outlook Files\*" or "C:\Users\*\AppData\Local\Microsoft\Outlook*".
+
     This activity is significant as it may indicate data exfiltration or unauthorized access to email data.
-    If confirmed malicious, an attacker could potentially access sensitive email content, leading to data breaches or further exploitation within the network.
+
+    If confirmed malicious, an attacker could potentially access sensitive email content, leading to data breaches or further exploitation within the network.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count values(Filesystem.file_path) as file_path
-            min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Filesystem WHERE
-
-    Filesystem.action IN (
-        "created",
-        "modified"
-    )
-    Filesystem.file_name IN (
-        "*.pst",
-        "*.ost"
-    )
-    NOT Filesystem.file_path IN (
-        "C:\\Users\\*\\My Documents\\Outlook Files\\*",
-        "C:\\Users\\*\\AppData\\Local\\Microsoft\\Outlook*"
-    )
-
-    BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-       Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-       Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-       Filesystem.user Filesystem.vendor_product
-
-    | `drop_dm_object_name("Filesystem")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `email_files_written_outside_of_the_outlook_directory_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.pst", "*.ost") NOT (Filesystem.file_path IN ("C:\\Users\*\\My Documents\\Outlook Files\\", "C:\\Users\*\\AppData\\Local\\Microsoft\\Outlook")) by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `email_files_written_outside_of_the_outlook_directory_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes.
-known_false_positives: |-
-    Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search.
-    You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary.
+known_false_positives: 'Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search.
+
+    You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary.'
 references: []
 intermediate_findings:
     entities:
diff --git a/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml b/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml
index 44417c597b4..2c42325b5ab 100644
--- a/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml
+++ b/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies a significant increase in data transfers from your email server to client hosts. It leverages the Network_Traffic data model to monitor outbound traffic from email servers, using statistical analysis to detect anomalies based on average and standard deviation metrics. This activity is significant as it may indicate a malicious actor exfiltrating data via your email server. If confirmed malicious, this could lead to unauthorized data access and potential data breaches, compromising sensitive information and impacting organizational security.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` sum(All_Traffic.bytes_out) as bytes_out FROM datamodel=Network_Traffic
       WHERE All_Traffic.src_category=email_server
       BY All_Traffic.dest_ip _time span=1d
diff --git a/detections/application/esxi_account_modified.yml b/detections/application/esxi_account_modified.yml
index af49946dec2..70db4f582c3 100644
--- a/detections/application/esxi_account_modified.yml
+++ b/detections/application/esxi_account_modified.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: This detection identifies the creation, deletion, or modification of a local user account on an ESXi host. This activity may indicate unauthorized access, indicator removal, or persistence attempts by an attacker seeking to establish or maintain control of the host.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*esxcli system account*" Message IN ("*-i *","*--id*") NOT Message="*[shell*" | rex field=_raw "Z (?<dest>[\w\.]+)\s.*: \[(?<initial_user>\w+)]:\s.+-i[d]*\s(?<modified_user>[\w_\-0-9]+)" | stats min(_time) as firstTime max(_time) as lastTime count by dest initial_user modified_user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_account_modified_filter`'
+search: |
+    `esxi_syslog` Message="*esxcli system account*" Message IN ("*-i *","*--id*") NOT Message="*[shell*" | rex field=_raw "Z (?<dest>[\w\.]+)\s.*: \[(?<initial_user>\w+)]:\s.+-i[d]*\s(?<modified_user>[\w_\-0-9]+)" | stats min(_time) as firstTime max(_time) as lastTime count by dest initial_user modified_user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_account_modified_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: New local accounts being created in ESXi is rare in most environments. Tune as needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/application/esxi_audit_tampering.yml b/detections/application/esxi_audit_tampering.yml
index 269ff72aeba..6cb3dbca864 100644
--- a/detections/application/esxi_audit_tampering.yml
+++ b/detections/application/esxi_audit_tampering.yml
@@ -6,12 +6,12 @@ modification_date: '2026-09-08'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host.
-    This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events.
+description: 'The following analytic identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host.
+
+    This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events.'
 data_source:
     - VMWare ESXi Syslog
-search: |-
+search: |
     `esxi_syslog`
     Message="*esxcli system auditrecords*"
     Message IN ("*remote*","*local*")
@@ -28,8 +28,7 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `esxi_audit_tampering_filter`
-how_to_implement: |-
-    This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
+how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: No false positives have been identified at this time.
 references:
     - https://detect.fyi/detecting-and-responding-to-esxi-compromise-with-splunk-f33998ce7823
@@ -41,7 +40,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Audit tampering activity via [$command$] on ESXi host [$dest$].
     entity:
diff --git a/detections/application/esxi_bulk_vm_termination.yml b/detections/application/esxi_bulk_vm_termination.yml
index 2153c20e66b..61cfb1b1a0f 100644
--- a/detections/application/esxi_bulk_vm_termination.yml
+++ b/detections/application/esxi_bulk_vm_termination.yml
@@ -6,11 +6,10 @@ modification_date: '2026-09-08'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads.
+description: The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads.
 data_source:
     - VMWare ESXi Syslog
-search: |-
+search: |
     `esxi_syslog`
     Message IN (
         "*pkill -9 *",
@@ -39,8 +38,7 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `esxi_bulk_vm_termination_filter`
-how_to_implement: |-
-    This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
+how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: No false positives have been identified at this time.
 references:
     - https://www.securityweek.com/microsoft-says-ransomware-gangs-exploiting-just-patched-vmware-esxi-flaw/
@@ -52,7 +50,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Bulk VM termination activity on ESXi host [$dest$].
     entity:
diff --git a/detections/application/esxi_download_errors.yml b/detections/application/esxi_download_errors.yml
index b3523156005..a4db003639e 100644
--- a/detections/application/esxi_download_errors.yml
+++ b/detections/application/esxi_download_errors.yml
@@ -9,9 +9,11 @@ type: Anomaly
 description: This detection identifies failed file download attempts on ESXi hosts by looking for specific error messages in the system logs. These failures may indicate unauthorized or malicious attempts to install or update components—such as VIBs or scripts
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message IN ("*Download failed*", "*Failed to download file*", "*File download error*", "*Could not download*") | rex field=_raw "Z (?<dest>[\w\.]*)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_download_errors_filter` '
+search: |
+    `esxi_syslog` Message IN ("*Download failed*", "*Failed to download file*", "*File download error*", "*Could not download*") | rex field=_raw "Z (?<dest>[\w\.]*)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_download_errors_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Limited false positives in most environments, however tune as needed.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/application/esxi_encryption_settings_modified.yml b/detections/application/esxi_encryption_settings_modified.yml
index 8742e7446f5..cfc37889082 100644
--- a/detections/application/esxi_encryption_settings_modified.yml
+++ b/detections/application/esxi_encryption_settings_modified.yml
@@ -9,7 +9,7 @@ type: TTP
 description: Detects the disabling of critical encryption enforcement settings on an ESXi host, such as secure boot or executable verification requirements, which may indicate an attempt to weaken hypervisor integrity or allow unauthorized code execution.
 data_source:
     - VMWare ESXi Syslog
-search: |-
+search: |
     `esxi_syslog`
     Message = "*system settings encryption set*"
     NOT Message = "*shell.*"
@@ -25,10 +25,9 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `esxi_encryption_settings_modified_filter`
-how_to_implement: |-
-    This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
-known_false_positives: |-
-    Limited false positives in most environments, however tune as needed.
+how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
+known_false_positives: Limited false positives in most environments, however tune as needed.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -37,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Encryption settings modified on ESXi host [$dest$].
     entity:
diff --git a/detections/application/esxi_external_root_login_activity.yml b/detections/application/esxi_external_root_login_activity.yml
index 336842d8b44..2528d62f6c4 100644
--- a/detections/application/esxi_external_root_login_activity.yml
+++ b/detections/application/esxi_external_root_login_activity.yml
@@ -9,9 +9,11 @@ type: Anomaly
 description: This detection identifies instances where the ESXi UI is accessed using the root account instead of a delegated administrative user. Direct root access to the UI bypasses role-based access controls and auditing practices, and may indicate risky behavior, misconfiguration, or unauthorized activity by a malicious actor using compromised credentials.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*root*" AND Message="*logged in*" | rex field=_raw "root@(?<SrcIpAddr>\d{1,3}(?:\.\d{1,3}){3})" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | search SrcIpAddr != "127.0.0.1" AND SrcIpAddr != 192.168.0.0/16 AND SrcIpAddr != 172.16.0.0/12 AND SrcIpAddr != 10.0.0.0/8 | stats min(_time) as firstTime max(_time) as lastTime count by dest SrcIpAddr | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_external_root_login_activity_filter`'
+search: |
+    `esxi_syslog` Message="*root*" AND Message="*logged in*" | rex field=_raw "root@(?<SrcIpAddr>\d{1,3}(?:\.\d{1,3}){3})" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | search SrcIpAddr != "127.0.0.1" AND SrcIpAddr != 192.168.0.0/16 AND SrcIpAddr != 172.16.0.0/12 AND SrcIpAddr != 10.0.0.0/8 | stats min(_time) as firstTime max(_time) as lastTime count by dest SrcIpAddr | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_external_root_login_activity_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Limited false positives in most environments, however tune as needed. Administrators may use the root account for troubleshooting or initial user creation.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/application/esxi_firewall_disabled.yml b/detections/application/esxi_firewall_disabled.yml
index 7c13b269f0a..69952b61179 100644
--- a/detections/application/esxi_firewall_disabled.yml
+++ b/detections/application/esxi_firewall_disabled.yml
@@ -9,9 +9,11 @@ type: TTP
 description: This detection identifies when the ESXi firewall is disabled or set to permissive mode, which can expose the host to unauthorized access and network-based attacks. Such changes are often a precursor to lateral movement, data exfiltration, or the installation of malicious software by a threat actor.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*network firewall set*" AND Message="*enabled f*" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_firewall_disabled_filter`'
+search: |
+    `esxi_syslog` Message="*network firewall set*" AND Message="*enabled f*" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_firewall_disabled_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Limited false positives in most environments, however tune as needed.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Firewall disabled on ESXi host $dest$.
     entity:
diff --git a/detections/application/esxi_lockdown_mode_disabled.yml b/detections/application/esxi_lockdown_mode_disabled.yml
index de00fb95f6e..606191e0efd 100644
--- a/detections/application/esxi_lockdown_mode_disabled.yml
+++ b/detections/application/esxi_lockdown_mode_disabled.yml
@@ -9,9 +9,11 @@ type: TTP
 description: This detection identifies when Lockdown Mode is disabled on an ESXi host, which can indicate that a threat actor is attempting to weaken host security controls. Disabling Lockdown Mode allows broader remote access via SSH or the host client and may precede further malicious actions such as data exfiltration, lateral movement, or VM tampering.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message IN ("*lockdownmode.disabled*", "*Administrator access to the host has been enabled*") | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_lockdown_mode_disabled_filter`'
+search: |
+    `esxi_syslog` Message IN ("*lockdownmode.disabled*", "*Administrator access to the host has been enabled*") | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_lockdown_mode_disabled_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Limited false positives in most environments, however tune as needed.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Lockdown Mode has been disabled on ESXi host $dest$.
     entity:
diff --git a/detections/application/esxi_loghost_config_tampering.yml b/detections/application/esxi_loghost_config_tampering.yml
index 82610343422..95eb9609677 100644
--- a/detections/application/esxi_loghost_config_tampering.yml
+++ b/detections/application/esxi_loghost_config_tampering.yml
@@ -9,9 +9,11 @@ type: TTP
 description: This detection identifies changes to the syslog loghost configuration on an ESXi host, which may indicate an attempt to disrupt log forwarding and evade detection.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*Set called with key*" AND Message IN ("*Syslog.global.logHost*","*Syslog.global.logdir*") | rex field=_raw "key ''(?<key>[^'']+)'', value ''\"(?<value>[^\"]+)\"''" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest key value | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_loghost_config_tampering_filter`'
+search: |
+    `esxi_syslog` Message="*Set called with key*" AND Message IN ("*Syslog.global.logHost*","*Syslog.global.logdir*") | rex field=_raw "key '(?<key>[^']+)', value '\"(?<value>[^\"]+)\"'" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest key value | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_loghost_config_tampering_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Limited false positives in most environments, however tune as needed
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Syslog destination was modified on ESXi host $dest$.
     entity:
diff --git a/detections/application/esxi_malicious_vib_forced_install.yml b/detections/application/esxi_malicious_vib_forced_install.yml
index 207137ab6ce..8bb534b5bcc 100644
--- a/detections/application/esxi_malicious_vib_forced_install.yml
+++ b/detections/application/esxi_malicious_vib_forced_install.yml
@@ -9,7 +9,8 @@ type: TTP
 description: Detects potentially malicious installation of VMware Installation Bundles (VIBs) using the --force flag. The --force option bypasses signature and compatibility checks, allowing unsigned, community-supported, or incompatible VIBs to be installed on an ESXi host. This behavior is uncommon in normal administrative operations and is often observed in post-compromise scenarios where adversaries attempt to install backdoored or unauthorized kernel modules, drivers, or monitoring tools to establish persistence or gain deeper control of the hypervisor.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="* image profile with validation disabled. *" OR Message="* image profile bypassing signing and acceptance level verification. *" OR Message="* vib without valid signature, *" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_malicious_vib_forced_install_filter`'
+search: |
+    `esxi_syslog` Message="* image profile with validation disabled. *" OR Message="* image profile bypassing signing and acceptance level verification. *" OR Message="* vib without valid signature, *" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_malicious_vib_forced_install_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Some third party vendor VIBs or patches may require the force option.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A VIB was installed on ESXi $dest$ with the force flag.
     entity:
diff --git a/detections/application/esxi_reverse_shell_patterns.yml b/detections/application/esxi_reverse_shell_patterns.yml
index bb34e8740a4..57ded6a5ee6 100644
--- a/detections/application/esxi_reverse_shell_patterns.yml
+++ b/detections/application/esxi_reverse_shell_patterns.yml
@@ -9,9 +9,11 @@ type: TTP
 description: This detection looks for reverse shell string patterns on an ESXi host, which may indicate that a threat actor is attempting to establish remote control over the system.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message IN ("*bash -i >&*","*/dev/tcp/*","*/dev/udp/*", "*/socat exec:*","*socket(S,PF_INET*") OR (Message="*python -c*" AND Message="*import socket*") | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_reverse_shell_patterns_filter`'
+search: |
+    `esxi_syslog` Message IN ("*bash -i >&*","*/dev/tcp/*","*/dev/udp/*", "*/socat exec:*","*socket(S,PF_INET*") OR (Message="*python -c*" AND Message="*import socket*") | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_reverse_shell_patterns_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Limited false positives in most environments, however tune as needed.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Reverse shell patterns seen on ESXi host $dest$.
     entity:
diff --git a/detections/application/esxi_sensitive_files_accessed.yml b/detections/application/esxi_sensitive_files_accessed.yml
index 6aad085ed35..8b854cdc693 100644
--- a/detections/application/esxi_sensitive_files_accessed.yml
+++ b/detections/application/esxi_sensitive_files_accessed.yml
@@ -9,9 +9,11 @@ type: TTP
 description: This detection identifies access to sensitive system and configuration files on an ESXi host, including authentication data, service configurations, and VMware-specific management settings. Interaction with these files may indicate adversary reconnaissance, credential harvesting, or preparation for privilege escalation, lateral movement, or persistence.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*shell[*" Message IN ("*/etc/shadow*","*/etc/vmware/hostd/hostd.xml*", "*/etc/vmware/vpxa/vpxa.cfg*","*/etc/sfcb/sfcb.cfg*","*/etc/security/*", "*/etc/likewise/krb5-affinity.conf*","*/etc/vmware-vpx/vcdb.properties*") | rex field=_raw "\]: \[(?<user>\w+)\]:(?<command>.+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_sensitive_files_accessed_filter`'
+search: |
+    `esxi_syslog` Message="*shell[*" Message IN ("*/etc/shadow*","*/etc/vmware/hostd/hostd.xml*", "*/etc/vmware/vpxa/vpxa.cfg*","*/etc/sfcb/sfcb.cfg*","*/etc/security/*", "*/etc/likewise/krb5-affinity.conf*","*/etc/vmware-vpx/vcdb.properties*") | rex field=_raw "\]: \[(?<user>\w+)\]:(?<command>.+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_sensitive_files_accessed_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Administrators may access these files for initial setup or troubleshooting. Limited in most environments. Tune as needed.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Sensitive files accessed on ESXi host $dest$ with $command$.
     entity:
diff --git a/detections/application/esxi_shared_or_stolen_root_account.yml b/detections/application/esxi_shared_or_stolen_root_account.yml
index acd6c21ee50..b9d2b7d4c97 100644
--- a/detections/application/esxi_shared_or_stolen_root_account.yml
+++ b/detections/application/esxi_shared_or_stolen_root_account.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: This detection monitors for signs of a shared or potentially compromised root account on ESXi hosts by tracking the number of unique IP addresses logging in as root within a short time window. Multiple logins from different IPs in a brief period may indicate credential misuse, lateral movement, or account compromise.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*root*" Message="*logged in*" NOT Message="*root@127.0.0.1*" | rex field=_raw "root@(?<SrcIpAddr>\d{1,3}(?:\.\d{1,3}){3})" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | bin _time span=15m | stats min(_time) as firstTime max(_time) as lastTime dc(SrcIpAddr) AS distinct_ip_count values(SrcIpAddr) AS SrcIps by dest | where distinct_ip_count > 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_shared_or_stolen_root_account_filter`'
+search: |
+    `esxi_syslog` Message="*root*" Message="*logged in*" NOT Message="*root@127.0.0.1*" | rex field=_raw "root@(?<SrcIpAddr>\d{1,3}(?:\.\d{1,3}){3})" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | bin _time span=15m | stats min(_time) as firstTime max(_time) as lastTime dc(SrcIpAddr) AS distinct_ip_count values(SrcIpAddr) AS SrcIps by dest | where distinct_ip_count > 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_shared_or_stolen_root_account_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward logs to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Limited false positives in most environments, however tune as needed
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/application/esxi_shell_access_enabled.yml b/detections/application/esxi_shell_access_enabled.yml
index 33795fb73b9..22c91c0a238 100644
--- a/detections/application/esxi_shell_access_enabled.yml
+++ b/detections/application/esxi_shell_access_enabled.yml
@@ -9,9 +9,11 @@ type: TTP
 description: This detection identifies when the ESXi Shell is enabled on a host, which may indicate that a malicious actor is preparing to execute commands locally or establish persistent access. Enabling the shell outside of approved maintenance windows can be a sign of compromise or unauthorized administrative activity.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*ESXi Shell*" Message="*has been enabled*" | rex field=_raw "''(?<user>\w+)@" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_shell_access_enabled_filter`'
+search: |
+    `esxi_syslog` Message="*ESXi Shell*" Message="*has been enabled*" | rex field=_raw "'(?<user>\w+)@" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_shell_access_enabled_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Limited false positives in most environments, however tune as needed. Some Administrators may enable this for troubleshooting.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: ESXi Shell access was enabled on ESXi host $dest$.
     entity:
diff --git a/detections/application/esxi_ssh_brute_force.yml b/detections/application/esxi_ssh_brute_force.yml
index 22a287c40c3..fa63b25281a 100644
--- a/detections/application/esxi_ssh_brute_force.yml
+++ b/detections/application/esxi_ssh_brute_force.yml
@@ -9,9 +9,11 @@ type: Anomaly
 description: This detection identifies signs of SSH brute-force attacks by monitoring for a high number of failed login attempts within a short time frame. Such activity may indicate an attacker attempting to gain unauthorized access through password guessing.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*Authentication failure for*" | rex "for (?<user>[\w]+) from (?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | bin _time span=5m | stats min(_time) as firstTime max(_time) as lastTime count by user, src_ip, dest | where count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_ssh_brute_force_filter`'
+search: |
+    `esxi_syslog` Message="*Authentication failure for*" | rex "for (?<user>[\w]+) from (?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | bin _time span=5m | stats min(_time) as firstTime max(_time) as lastTime count by user, src_ip, dest | where count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_ssh_brute_force_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Limited false positives in most environments, however tune as needed.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/application/esxi_ssh_enabled.yml b/detections/application/esxi_ssh_enabled.yml
index fea97bb62a4..c6b130d8b92 100644
--- a/detections/application/esxi_ssh_enabled.yml
+++ b/detections/application/esxi_ssh_enabled.yml
@@ -9,9 +9,11 @@ type: TTP
 description: This detection identifies SSH being enabled on ESXi hosts, which can be an early indicator of malicious activity. Threat actors often use SSH to gain persistent remote access after compromising credentials or exploiting vulnerabilities.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*SSH access has been enabled" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_ssh_enabled_filter`'
+search: |
+    `esxi_syslog` Message="*SSH access has been enabled" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_ssh_enabled_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Limited false positives in most environments, however tune as needed. Some Administrators may use SSH for troubleshooting.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: SSH was enabled on ESXi host $dest$.
     entity:
diff --git a/detections/application/esxi_syslog_config_change.yml b/detections/application/esxi_syslog_config_change.yml
index 4d84da45b2a..9f71756d868 100644
--- a/detections/application/esxi_syslog_config_change.yml
+++ b/detections/application/esxi_syslog_config_change.yml
@@ -9,9 +9,11 @@ type: TTP
 description: This detection identifies changes to the syslog configuration on an ESXi host using esxcli, which may indicate an attempt to disrupt log collection and evade detection.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*syslog config set*" AND Message="*esxcli*" | rex field=_raw "\].*\[\s*(?P<user>[^\]]+)\]:\s(?P<command>.+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_syslog_config_change_filter`'
+search: |
+    `esxi_syslog` Message="*syslog config set*" AND Message="*esxcli*" | rex field=_raw "\].*\[\s*(?P<user>[^\]]+)\]:\s(?P<command>.+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_syslog_config_change_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Limited false positives in most environments, however tune as needed
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Syslog config was modified on ESXi host $dest$.
     entity:
diff --git a/detections/application/esxi_system_clock_manipulation.yml b/detections/application/esxi_system_clock_manipulation.yml
index 3164b6bfc28..a535afc2f26 100644
--- a/detections/application/esxi_system_clock_manipulation.yml
+++ b/detections/application/esxi_system_clock_manipulation.yml
@@ -9,9 +9,11 @@ type: TTP
 description: This detection identifies a significant change to the system clock on an ESXi host, which may indicate an attempt to manipulate timestamps and evade detection or forensic analysis
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*NTPClock*" AND Message="*system clock stepped*" | rex field=_raw "stepped to (?<epoch_time>\d+\.\d+),.+delta\s(?<delta>\d+)\s" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | eval epoch_time=tonumber(epoch_time) | eval delta=tonumber(delta) | eval event_time=round(_time, 0) | eval direction=if(epoch_time < event_time, "backward", "forward") | eval original_time=if(direction=="backward", epoch_time + delta, epoch_time - delta) | eval stepped_to_str=strftime(epoch_time, "%Y-%m-%d %H:%M:%S") | eval original_time_str=strftime(original_time, "%Y-%m-%d %H:%M:%S") | stats min(_time) as firstTime max(_time) as lastTime count by dest direction original_time_str stepped_to_str epoch_time delta | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_system_clock_manipulation_filter`'
+search: |
+    `esxi_syslog` Message="*NTPClock*" AND Message="*system clock stepped*" | rex field=_raw "stepped to (?<epoch_time>\d+\.\d+),.+delta\s(?<delta>\d+)\s" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | eval epoch_time=tonumber(epoch_time) | eval delta=tonumber(delta) | eval event_time=round(_time, 0) | eval direction=if(epoch_time < event_time, "backward", "forward") | eval original_time=if(direction=="backward", epoch_time + delta, epoch_time - delta) | eval stepped_to_str=strftime(epoch_time, "%Y-%m-%d %H:%M:%S") | eval original_time_str=strftime(original_time, "%Y-%m-%d %H:%M:%S") | stats min(_time) as firstTime max(_time) as lastTime count by dest direction original_time_str stepped_to_str epoch_time delta | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_system_clock_manipulation_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Limited false positives in most environments, however tune as needed
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Large time change on ESXi host $dest$.
     entity:
diff --git a/detections/application/esxi_system_information_discovery.yml b/detections/application/esxi_system_information_discovery.yml
index 3453cae0878..090b2e93cef 100644
--- a/detections/application/esxi_system_information_discovery.yml
+++ b/detections/application/esxi_system_information_discovery.yml
@@ -9,9 +9,11 @@ type: TTP
 description: This detection identifies the use of ESXCLI system-level commands that retrieve configuration details. While used for legitimate administration, this behavior may also indicate adversary reconnaissance aimed at profiling the ESXi host's capabilities, build information, or system role in preparation for further compromise.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*system*" AND Message="*esxcli*" AND Message IN ("*get*","*list*") AND Message="*user=*" NOT Message="*filesystem*" | rex field=_raw "user=(?<user>\w+)\]\s+Dispatch\s+(?<command>[^\s]+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_system_information_discovery_filter`'
+search: |
+    `esxi_syslog` Message="*system*" AND Message="*esxcli*" AND Message IN ("*get*","*list*") AND Message="*user=*" NOT Message="*filesystem*" | rex field=_raw "user=(?<user>\w+)\]\s+Dispatch\s+(?<command>[^\s]+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_system_information_discovery_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Administrators may use this command when troubleshooting. Tune as needed.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: System information discovery commands executed on ESXi host $dest$ by $user$.
     entity:
diff --git a/detections/application/esxi_user_granted_admin_role.yml b/detections/application/esxi_user_granted_admin_role.yml
index 4ea6f35980b..7e99c100992 100644
--- a/detections/application/esxi_user_granted_admin_role.yml
+++ b/detections/application/esxi_user_granted_admin_role.yml
@@ -9,9 +9,11 @@ type: TTP
 description: This detection identifies when a user is granted the Administrator role on an ESXi host. Assigning elevated privileges is a critical action that can indicate potential malicious behavior if performed unexpectedly. Adversaries who gain access may use this to escalate privileges, maintain persistence, or disable security controls.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*esxcli system permission set*" AND Message="*role Admin*" | rex field=_raw "\]: \[(?<user>\w+)\]:(?<command>.+)" | rex field=_raw "--id (?<target_user>\w+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command target_user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_user_granted_admin_role_filter`'
+search: |
+    `esxi_syslog` Message="*esxcli system permission set*" AND Message="*role Admin*" | rex field=_raw "\]: \[(?<user>\w+)\]:(?<command>.+)" | rex field=_raw "--id (?<target_user>\w+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command target_user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_user_granted_admin_role_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Limited false positives in most environments after initial setup, however tune as needed.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $target_user$ granted Admin role on ESXi host $dest$ by $user$.
     entity:
diff --git a/detections/application/esxi_vib_acceptance_level_tampering.yml b/detections/application/esxi_vib_acceptance_level_tampering.yml
index 62948900500..e4d99d5e1eb 100644
--- a/detections/application/esxi_vib_acceptance_level_tampering.yml
+++ b/detections/application/esxi_vib_acceptance_level_tampering.yml
@@ -9,9 +9,11 @@ type: TTP
 description: This detection identifies changes to the VIB (vSphere Installation Bundle) acceptance level on an ESXi host. Modifying the acceptance level, such as setting it to CommunitySupported, lowers the system's integrity enforcement and may allow the installation of unsigned or unverified software.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*esxcli software acceptance set*" Message="*shell*" | rex field=_raw "\]: \[(?<user>\w+)\]:(?<command>.+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_vib_acceptance_level_tampering_filter`'
+search: |
+    `esxi_syslog` Message="*esxcli software acceptance set*" Message="*shell*" | rex field=_raw "\]: \[(?<user>\w+)\]:(?<command>.+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_vib_acceptance_level_tampering_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Administrators may use this command when installing third party VIBs. Tune as needed.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: VIB Acceptance level was modified on ESXi host $dest$ by $user$.
     entity:
diff --git a/detections/application/esxi_vm_discovery.yml b/detections/application/esxi_vm_discovery.yml
index 4545ef14ccf..571658b0ec1 100644
--- a/detections/application/esxi_vm_discovery.yml
+++ b/detections/application/esxi_vm_discovery.yml
@@ -9,9 +9,11 @@ type: TTP
 description: This detection identifies the use of ESXCLI commands to discover virtual machines on an ESXi host While used by administrators, this activity may also indicate adversary reconnaissance aimed at identifying high value targets, mapping the virtual environment, or preparing for data theft or destructive operations.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*esxcli vm process*" Message="*list*" | rex field=_raw "\]: \[(?<user>\w+)\]:(?<command>.+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_vm_discovery_filter`'
+search: |
+    `esxi_syslog` Message="*esxcli vm process*" Message="*list*" | rex field=_raw "\]: \[(?<user>\w+)\]:(?<command>.+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_vm_discovery_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Administrators may use this command when troubleshooting. Tune as needed.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: VM discovery commands executed on ESXi host $dest$ by $user$.
     entity:
diff --git a/detections/application/esxi_vm_exported_via_remote_tool.yml b/detections/application/esxi_vm_exported_via_remote_tool.yml
index c027d6ea5d0..902f67bb05b 100644
--- a/detections/application/esxi_vm_exported_via_remote_tool.yml
+++ b/detections/application/esxi_vm_exported_via_remote_tool.yml
@@ -9,9 +9,11 @@ type: TTP
 description: This detection identifies the use of a remote tool to download virtual machine disk files from a datastore. The NFC protocol is used by management tools to transfer files to and from ESXi hosts, but it can also be abused by attackers or insiders to exfiltrate full virtual disk images
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*File download from path*" Message="*was initiated from*" | rex field=_raw "from path ''\[(?<Datastore>[^\]]+)\](?<VMPath>[^'']+)''" | rex field=_raw "initiated from ''(?<InitiatorTool>[^/]+)/(?<ToolVersion>[^@]+)@(?<InitiatorIP>\d{1,3}(?:\.\d{1,3}){3})''" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by Datastore VMPath InitiatorTool ToolVersion InitiatorIP dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_vm_exported_via_remote_tool_filter`'
+search: |
+    `esxi_syslog` Message="*File download from path*" Message="*was initiated from*" | rex field=_raw "from path '\[(?<Datastore>[^\]]+)\](?<VMPath>[^']+)'" | rex field=_raw "initiated from '(?<InitiatorTool>[^/]+)/(?<ToolVersion>[^@]+)@(?<InitiatorIP>\d{1,3}(?:\.\d{1,3}){3})'" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by Datastore VMPath InitiatorTool ToolVersion InitiatorIP dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_vm_exported_via_remote_tool_filter`
 how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
 known_false_positives: Administrators may use this command when troubleshooting. Tune as needed.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: VM downloaded from datastore on ESXi host $dest$.
     entity:
diff --git a/detections/application/ivanti_vtm_new_account_creation.yml b/detections/application/ivanti_vtm_new_account_creation.yml
index 2887542dd2c..85a500ccbc0 100644
--- a/detections/application/ivanti_vtm_new_account_creation.yml
+++ b/detections/application/ivanti_vtm_new_account_creation.yml
@@ -9,14 +9,8 @@ type: TTP
 description: This analytic detects potential exploitation of the Ivanti Virtual Traffic Manager (vTM) authentication bypass vulnerability (CVE-2024-7593) to create new administrator accounts. The vulnerability allows unauthenticated remote attackers to bypass authentication on the admin panel and create new admin users. This detection looks for suspicious new account creation events in the Ivanti vTM audit logs that lack expected authentication details, which may indicate exploitation attempts.
 data_source:
     - Ivanti VTM Audit
-search: |-
-    `ivanti_vtm_audit` OPERATION="adduser" MODGROUP="admin" IP="!!ABSENT!!"
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY IP, MODUSER, OPERATION,
-           MODGROUP, AUTH
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `ivanti_vtm_new_account_creation_filter`
+search: |
+    `ivanti_vtm_audit` OPERATION="adduser" MODGROUP="admin" IP="!!ABSENT!!" | stats count min(_time) as firstTime max(_time) as lastTime by OPERATION MODGROUP IP MODUSER | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ivanti_vtm_new_account_creation_filter`
 how_to_implement: To implement this detection, ensure that Ivanti vTM audit logs are being ingested into Splunk. Configure the Ivanti vTM to send its audit logs to Splunk via syslog or by monitoring the log files directly. The sourcetype should be set to "ivanti_vtm_audit" or a similar custom sourcetype for these logs.
 known_false_positives: Legitimate new account creation by authorized administrators will generate similar log entries. However, those should include proper authentication details. Verify any detected events against expected administrative activities and authorized user lists.
 references:
@@ -30,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$MODUSER$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$MODUSER$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new administrator account, $MODUSER$, was created on Ivanti vTM device without proper authentication, which may indicate exploitation of CVE-2024-7593.
     entity:
@@ -56,6 +50,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/ivanti/ivanti_vtm_audit.log
-          sourcetype: ivanti_vtm_audit
           source: ivanti_vtm
+          sourcetype: ivanti_vtm_audit
       test_type: unit
diff --git a/detections/application/m365_copilot_agentic_jailbreak_attack.yml b/detections/application/m365_copilot_agentic_jailbreak_attack.yml
index ba76b389cfb..4ac958c58ac 100644
--- a/detections/application/m365_copilot_agentic_jailbreak_attack.yml
+++ b/detections/application/m365_copilot_agentic_jailbreak_attack.yml
@@ -9,22 +9,8 @@ type: Anomaly
 description: Detects agentic AI jailbreak attempts that try to establish persistent control over M365 Copilot through rule injection, universal triggers, response automation, system overrides, and persona establishment techniques. The detection analyzes the PromptText field for keywords like "from now on," "always respond," "ignore previous," "new rule," "override," and role-playing commands (e.g., "act as," "you are now") that attempt to inject persistent instructions. The search computes risk by counting distinct jailbreak indicators per user session, flagging coordinated manipulation attempts.
 data_source:
     - M365 Exported eDiscovery Prompts
-search: >
-    `m365_exported_ediscovery_prompt_logs` | eval user = Sender | eval
-    rule_injection=if(match(Subject_Title, "(?i)(rules|instructions)\s*="), "YES",
-    "NO") | eval universal_trigger=if(match(Subject_Title,
-    "(?i)(every|all).*prompt"), "YES", "NO") | eval
-    response_automation=if(match(Subject_Title,
-    "(?i)(always|automatic).*respond"), "YES", "NO") | eval
-    system_override=if(match(Subject_Title,
-    "(?i)(override|bypass|ignore).*(system|default)"), "YES", "NO") | eval
-    persona_establishment=if(match(Subject_Title, "(?i)(with.*\[.*\]|persona)"),
-    "YES", "NO") | where rule_injection="YES" OR universal_trigger="YES" OR
-    response_automation="YES" OR system_override="YES" OR
-    persona_establishment="YES" | table _time, "Source ID", user, Subject_Title,
-    rule_injection, universal_trigger, response_automation, system_override,
-    persona_establishment, Workload | sort -_time |
-    `m365_copilot_agentic_jailbreak_attack_filter`
+search: |
+    `m365_exported_ediscovery_prompt_logs` | eval user = Sender | eval rule_injection=if(match(Subject_Title, "(?i)(rules|instructions)\s*="), "YES", "NO") | eval universal_trigger=if(match(Subject_Title, "(?i)(every|all).*prompt"), "YES", "NO") | eval response_automation=if(match(Subject_Title, "(?i)(always|automatic).*respond"), "YES", "NO") | eval system_override=if(match(Subject_Title, "(?i)(override|bypass|ignore).*(system|default)"), "YES", "NO") | eval persona_establishment=if(match(Subject_Title, "(?i)(with.*\[.*\]|persona)"), "YES", "NO") | where rule_injection="YES" OR universal_trigger="YES" OR response_automation="YES" OR system_override="YES" OR persona_establishment="YES" | table _time, "Source ID", user, Subject_Title, rule_injection, universal_trigger, response_automation, system_override, persona_establishment, Workload | sort -_time | `m365_copilot_agentic_jailbreak_attack_filter`
 how_to_implement: To export M365 Copilot prompt logs, navigate to the Microsoft Purview compliance portal (compliance.microsoft.com) and access eDiscovery. Create a new eDiscovery case, add target user accounts or date ranges as data sources, then create a search query targeting M365 Copilot interactions across relevant workloads. Once the search completes, export the results to generate a package containing prompt logs with fields like Subject_Title (prompt text), Sender, timestamps, and workload metadata. Download the exported files using the eDiscovery Export Tool and ingest them into Splunk for security analysis and detection of jailbreak attempts, data exfiltration requests, and policy violations.
 known_false_positives: Legitimate users discussing AI ethics research, security professionals testing system robustness, developers creating training materials for AI safety, or academic discussions about AI limitations and behavioral constraints may trigger false positives.
 references:
@@ -37,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user$" | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -59,7 +45,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv
-          sourcetype: csv
           source: csv
-      test_type: experimental
+          sourcetype: csv
       description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611.
+      test_type: experimental
diff --git a/detections/application/m365_copilot_application_usage_pattern_anomalies.yml b/detections/application/m365_copilot_application_usage_pattern_anomalies.yml
index 9e0def4c511..230a0ffe247 100644
--- a/detections/application/m365_copilot_application_usage_pattern_anomalies.yml
+++ b/detections/application/m365_copilot_application_usage_pattern_anomalies.yml
@@ -9,30 +9,8 @@ type: Anomaly
 description: Detects M365 Copilot users exhibiting suspicious application usage patterns including multi-location access, abnormally high activity volumes, or access to multiple Copilot applications that may indicate account compromise or automated abuse. The detection aggregates M365 Copilot Graph API events per user, calculating metrics like distinct cities/countries accessed, unique IP addresses, number of different Copilot apps used, and average events per day over the observation period. Users are flagged when they access Copilot from multiple cities (cities_count > 1), generate excessive daily activity (events_per_day > 100), or use more than two different Copilot applications (app_count > 2), which are anomalous patterns suggesting credential compromise or bot-driven abuse.
 data_source:
     - M365 Copilot Graph API
-search: >
-    `m365_copilot_graph_api` (appDisplayName="*Copilot*" OR appDisplayName="M365ChatClient" OR appDisplayName="OfficeAIAppChatCopilot")
-    | eval user = userPrincipalName
-    | stats count as events,
-        dc(location.city) as cities_count,
-        values(location.city) as city_list,
-        dc(location.countryOrRegion) as countries_count,
-        values(location.countryOrRegion) as country_list,
-        dc(ipAddress) as ip_count,
-        values(ipAddress) as ip_addresses,
-        dc(appDisplayName) as app_count,
-        values(appDisplayName) as apps_used,
-        dc(resourceDisplayName) as resource_count,
-        values(resourceDisplayName) as resources_accessed,
-        min(_time) as first_seen,
-        max(_time) as last_seen
-        by user
-    | eval days_active = round((last_seen - first_seen)/86400, 1)
-    | eval first_seen = strftime(first_seen, "%Y-%m-%d %H:%M:%S")
-    | eval last_seen = strftime(last_seen, "%Y-%m-%d %H:%M:%S")
-    | eval events_per_day = if(days_active > 0, round(events/days_active, 2), events)
-    | where cities_count > 1 OR events_per_day > 100 OR app_count > 2
-    | sort -events_per_day, -countries_count
-    | `m365_copilot_application_usage_pattern_anomalies_filter`
+search: |
+    `m365_copilot_graph_api` appDisplayName="*Copilot*" OR appDisplayName IN ("M365ChatClient", "OfficeAIAppChatCopilot") | eval user=userPrincipalName, failed_attempts=failed_attempts, mfa_failures=mfa_failures, cities_count=cities_count, unique_countries=unique_countries | stats count min(_time) as firstTime max(_time) as lastTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `m365_copilot_application_usage_pattern_anomalies_filter`
 how_to_implement: This detection requires ingesting M365 Copilot access logs via the Splunk Add-on for Microsoft Office 365. Configure the add-on to collect Azure AD Sign-in logs (AuditLogs.SignIns) through the Graph API data input. Ensure proper authentication and permissions are configured to access sign-in audit logs. The `m365_copilot_graph_api` macro should be defined to filter for sourcetype o365:graph:api data containing Copilot application activity.
 known_false_positives: Power users, executives with heavy AI workloads, employees traveling for business, users accessing multiple Copilot applications legitimately, or teams using shared corporate accounts across different office locations may trigger false positives.
 references:
@@ -45,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -67,6 +45,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/m365_copilot_access.log
-          sourcetype: o365:graph:api
           source: AuditLogs.SignIns
+          sourcetype: o365:graph:api
       test_type: unit
diff --git a/detections/application/m365_copilot_failed_authentication_patterns.yml b/detections/application/m365_copilot_failed_authentication_patterns.yml
index 8193749df9f..885aed698f1 100644
--- a/detections/application/m365_copilot_failed_authentication_patterns.yml
+++ b/detections/application/m365_copilot_failed_authentication_patterns.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: Detects M365 Copilot users with failed authentication attempts, MFA failures, or multi-location access patterns indicating potential credential attacks or account compromise. The detection aggregates M365 Copilot Graph API authentication events per user, calculating metrics like distinct cities/countries accessed, unique IP addresses and browsers, failed login attempts (status containing "fail" or "error"), and MFA failures (error code 50074). Users are flagged when they access Copilot from multiple cities (cities_count > 1), experience any authentication failures (failed_attempts > 0), or encounter MFA errors (mfa_failures > 0), which are indicators of credential stuffing, brute force attacks, or compromised accounts attempting to bypass multi-factor authentication.
 data_source:
     - M365 Copilot Graph API
-search: |-
-    `m365_copilot_graph_api` (appDisplayName="*Copilot*" OR appDisplayName="M365ChatClient" OR appDisplayName="OfficeAIAppChatCopilot")
-      | eval user = userPrincipalName
-      | stats count as events, dc(location.city) as cities_count, values(location.city) as city_list, dc(location.countryOrRegion) as countries_count, values(location.countryOrRegion) as country_list, dc(ipAddress) as ip_count, values(ipAddress) as ip_addresses, sum(eval(if(match(status, "(?i)fail
-      | error"), 1, 0))) as failed_attempts, sum(eval(if(match(_raw, "50074"), 1, 0))) as mfa_failures, dc(deviceDetail.browser) as browser_count, values(deviceDetail.browser) as browsers_used, min(_time) as first_seen, max(_time) as last_seen by user
-      | eval first_seen = strftime(first_seen, "%Y-%m-%d %H:%M:%S")
-      | eval last_seen = strftime(last_seen, "%Y-%m-%d %H:%M:%S")
-      | where cities_count > 1 OR failed_attempts > 0 OR mfa_failures > 0
-      | sort -mfa_failures, -failed_attempts, -countries_count
-      | `m365_copilot_failed_authentication_patterns_filter`
+search: |
+    `m365_copilot_graph_api` appDisplayName="*Copilot*" OR appDisplayName IN ("M365ChatClient", "OfficeAIAppChatCopilot") | eval user=userPrincipalName, failed_attempts=failed_attempts, mfa_failures=mfa_failures, cities_count=cities_count, unique_countries=unique_countries | stats count min(_time) as firstTime max(_time) as lastTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `m365_copilot_failed_authentication_patterns_filter`
 how_to_implement: This detection requires ingesting M365 Copilot access logs via the Splunk Add-on for Microsoft Office 365. Configure the add-on to collect Azure AD Sign-in logs (AuditLogs.SignIns) through the Graph API data input. Ensure proper authentication and permissions are configured to access sign-in audit logs. The `m365_copilot_graph_api` macro should be defined to filter for sourcetype o365:graph:api data containing Copilot application activity.
 known_false_positives: Legitimate users experiencing network connectivity issues, traveling employees with intermittent VPN connections, users in regions with unstable internet infrastructure, or password reset activities during business travel may trigger false positives.
 references:
@@ -53,6 +45,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/m365_copilot_access.log
-          sourcetype: "o365:graph:api"
-          source: "AuditLogs.SignIns"
+          source: AuditLogs.SignIns
+          sourcetype: o365:graph:api
       test_type: unit
diff --git a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml
index 4659c8a4b80..3846154289d 100644
--- a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml
+++ b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml
@@ -9,14 +9,8 @@ type: TTP
 description: Detects M365 Copilot impersonation and roleplay jailbreak attempts where users try to manipulate the AI into adopting alternate personas, behaving as unrestricted entities, or impersonating malicious AI systems to bypass safety controls. The detection searches exported eDiscovery prompt logs for roleplay keywords like "pretend you are," "act as," "you are now," "amoral," and "roleplay as" in the Subject_Title field. Prompts are categorized into specific impersonation types (AI_Impersonation, Malicious_AI_Persona, Unrestricted_AI_Persona, etc.) to identify attempts to override the AI's safety guardrails through persona injection attacks.
 data_source:
     - M365 Exported eDiscovery Prompts
-search: |-
-    `m365_exported_ediscovery_prompt_logs`
-      | search Subject_Title="*Pretend you are*" OR Subject_Title="*act as*" OR Subject_Title="*you are now*" OR Subject_Title="*amoral*" OR Subject_Title="*being*" OR Subject_Title="*roleplay as*" OR Subject_Title="*imagine you are*" OR Subject_Title="*behave like*"
-      | eval user = Sender
-      | eval impersonation_type=case(match(Subject_Title, "(?i)pretend you are.*AI"), "AI_Impersonation", match(Subject_Title, "(?i)(act as|roleplay as).*AI"), "AI_Roleplay", match(Subject_Title, "(?i)amoral.*AI"), "Amoral_AI", match(Subject_Title, "(?i)transcendent being"), "Fictional_Entity", match(Subject_Title, "(?i)(act as|pretend you are).*(entities|multiple)"), "Multi_Entity", match(Subject_Title, "(?i)(imagine you are|behave like).*AI"), "AI_Behavioral_Change", match(Subject_Title, "(?i)you are now.*AI"), "AI_Identity_Override", match(Subject_Title, "(?i)(evil|malicious|harmful).*AI"), "Malicious_AI_Persona", match(Subject_Title, "(?i)(unrestricted|unlimited|uncensored).*AI"), "Unrestricted_AI_Persona", 1=1, "Generic_Roleplay")
-      | table _time, user, Subject_Title, impersonation_type, Workload
-      | sort -_time
-      | `m365_copilot_impersonation_jailbreak_attack_filter`
+search: |
+    `m365_exported_ediscovery_prompt_logs` Subject_Title IN ("*Pretend you are*", "*act as*", "*you are now*", "*amoral*", "*being*", "*roleplay as*", "*imagine you are*", "*behave like*") | eval user=Sender, impersonation_type=impersonation_type, severity=severity, extraction_type=extraction_type, data_risk_flags=data_risk_flags, jailbreak_score=jailbreak_score | stats count min(_time) as firstTime max(_time) as lastTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `m365_copilot_impersonation_jailbreak_attack_filter`
 how_to_implement: To export M365 Copilot prompt logs, navigate to the Microsoft Purview compliance portal (compliance.microsoft.com) and access eDiscovery. Create a new eDiscovery case, add target user accounts or date ranges as data sources, then create a search query targeting M365 Copilot interactions across relevant workloads. Once the search completes, export the results to generate a package containing prompt logs with fields like Subject_Title (prompt text), Sender, timestamps, and workload metadata. Download the exported files using the eDiscovery Export Tool and ingest them into Splunk for security analysis and detection of jailbreak attempts, data exfiltration requests, and policy violations.
 known_false_positives: Legitimate creative writers developing fictional characters, game developers creating roleplay scenarios, educators teaching about AI ethics and limitations, researchers studying AI behavior, or users engaging in harmless creative storytelling may trigger false positives.
 references:
@@ -51,7 +45,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv
-          sourcetype: csv
           source: csv
-      test_type: experimental
+          sourcetype: csv
       description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611.
+      test_type: experimental
diff --git a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml
index b856ed88224..0fccdc7a18d 100644
--- a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml
+++ b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml
@@ -9,53 +9,8 @@ type: TTP
 description: Detects M365 Copilot information extraction jailbreak attacks that attempt to obtain sensitive, classified, or comprehensive data through various social engineering techniques including fictional entity impersonation, bulk data requests, and privacy bypass attempts. The detection searches exported eDiscovery prompt logs for extraction keywords like "transcendent," "tell me everything," "confidential," "dump," "extract," "reveal," and "bypass" in the Subject_Title field, categorizing each attempt by extraction type and assigning severity levels (CRITICAL for classified/proprietary data, HIGH for bulk extraction or privacy bypass). Prompts are further analyzed for compound risk patterns such as "Confidential+Extraction" or "Bulk_Request+Bypass," filtering out low-severity cases to surface the most dangerous attempts to exfiltrate sensitive organizational information through AI manipulation.
 data_source:
     - M365 Exported eDiscovery Prompts
-search: >
-    `m365_exported_ediscovery_prompt_logs` | search Subject_Title="*transcendent*"
-    OR Subject_Title="*incorporeal*" OR Subject_Title="*being who*" OR
-    Subject_Title="*tell me everything*" OR Subject_Title="*give me all*" OR
-    Subject_Title="*comprehensive*" OR Subject_Title="*step by step*" OR
-    Subject_Title="*hidden*" OR Subject_Title="*secret*" OR
-    Subject_Title="*confidential*" OR Subject_Title="*classified*" OR
-    Subject_Title="*internal*" OR Subject_Title="*sensitive*" OR
-    Subject_Title="*proprietary*" OR Subject_Title="*dump*" OR
-    Subject_Title="*extract*" OR Subject_Title="*reveal*" OR
-    Subject_Title="*disclose*" OR Subject_Title="*leak*" | eval user = Sender |
-    eval extraction_type=case(match(Subject_Title,
-    "(?i)(transcendent|incorporeal).*being"), "Knowledge_Entity",
-    match(Subject_Title, "(?i)tell.*me.*(everything|all)"), "Everything_Request",
-    match(Subject_Title, "(?i)(give|show|provide).*me.*(all|every)"),
-    "Complete_Data_Request", match(Subject_Title,
-    "(?i)(hidden|secret|confidential|classified)"), "Restricted_Info",
-    match(Subject_Title, "(?i)(comprehensive|complete|full|entire)"),
-    "Complete_Info", match(Subject_Title,
-    "(?i)(dump|extract|scrape).*(data|info|content)"), "Data_Extraction",
-    match(Subject_Title, "(?i)(reveal|disclose|expose|leak)"),
-    "Information_Disclosure", match(Subject_Title,
-    "(?i)(internal|proprietary|sensitive).*information"),
-    "Sensitive_Data_Request", match(Subject_Title,
-    "(?i)step.*by.*step.*(process|procedure|method)"), "Process_Extraction",
-    match(Subject_Title, "(?i)(bypass|ignore).*privacy"), "Privacy_Bypass",
-    match(Subject_Title, "(?i)(access|view|see).*(private|restricted)"),
-    "Unauthorized_Access", 1=1, "Generic_Request") | eval
-    severity=case(match(Subject_Title, "(?i)(transcendent|incorporeal)"), "HIGH",
-    match(Subject_Title, "(?i)tell.*everything"), "HIGH", match(Subject_Title,
-    "(?i)(dump|extract|scrape)"), "HIGH", match(Subject_Title,
-    "(?i)(classified|proprietary|confidential)"), "CRITICAL", match(Subject_Title,
-    "(?i)(hidden|secret|internal|sensitive)"), "MEDIUM", match(Subject_Title,
-    "(?i)(reveal|disclose|leak)"), "MEDIUM", match(Subject_Title,
-    "(?i)(bypass|ignore).*privacy"), "HIGH", 1=1, "LOW") | where severity!="LOW" |
-    eval data_risk_flags=case(match(Subject_Title,
-    "(?i)(classified|confidential|proprietary)") AND match(Subject_Title,
-    "(?i)(dump|extract|scrape)"), "Confidential+Extraction", match(Subject_Title,
-    "(?i)(everything|all|complete)") AND match(Subject_Title,
-    "(?i)(bypass|ignore)"), "Bulk_Request+Bypass", match(Subject_Title,
-    "(?i)(classified|confidential|proprietary)"), "Confidential",
-    match(Subject_Title, "(?i)(dump|extract|scrape)"), "Extraction",
-    match(Subject_Title, "(?i)(everything|all|complete|comprehensive)"),
-    "Bulk_Request", match(Subject_Title, "(?i)(bypass|ignore)"), "Bypass_Attempt",
-    1=1, "Standard_Request") | table _time, user, Subject_Title, extraction_type,
-    severity, data_risk_flags, Size | sort -severity, -_time |
-    `m365_copilot_information_extraction_jailbreak_attack_filter`
+search: |
+    `m365_exported_ediscovery_prompt_logs` Subject_Title IN ("*transcendent*", "*incorporeal*", "*being who*", "*tell me everything*", "*give me all*", "*comprehensive*", "*step by step*", "*hidden*", "*secret*", "*confidential*", "*classified*", "*internal*", "*sensitive*", "*proprietary*", "*dump*", "*extract*", "*reveal*", "*disclose*", "*leak*") | eval user=Sender, impersonation_type=impersonation_type, severity=severity, extraction_type=extraction_type, data_risk_flags=data_risk_flags, jailbreak_score=jailbreak_score | stats count min(_time) as firstTime max(_time) as lastTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `m365_copilot_information_extraction_jailbreak_attack_filter`
 how_to_implement: To export M365 Copilot prompt logs, navigate to the Microsoft Purview compliance portal (compliance.microsoft.com) and access eDiscovery. Create a new eDiscovery case, add target user accounts or date ranges as data sources, then create a search query targeting M365 Copilot interactions across relevant workloads. Once the search completes, export the results to generate a package containing prompt logs with fields like Subject_Title (prompt text), Sender, timestamps, and workload metadata. Download the exported files using the eDiscovery Export Tool and ingest them into Splunk for security analysis and detection of jailbreak attempts, data exfiltration requests, and policy violations.
 known_false_positives: Legitimate researchers studying data classification systems, cybersecurity professionals testing information handling policies, compliance officers reviewing data access procedures, journalists researching transparency issues, or employees asking for comprehensive project documentation may trigger false positives.
 references:
@@ -68,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Use $user$ attempted M365 Copilot information extraction jailbreak with severity level $severity$ using extraction type $extraction_type$ techniques and $data_risk_flags$ patterns to obtain sensitive or classified information, potentially violating data protection policies and corporate security controls.
     entity:
@@ -90,7 +45,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv
-          sourcetype: csv
           source: csv
-      test_type: experimental
+          sourcetype: csv
       description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611.
+      test_type: experimental
diff --git a/detections/application/m365_copilot_jailbreak_attempts.yml b/detections/application/m365_copilot_jailbreak_attempts.yml
index ca4445a5654..4f0aa8476d0 100644
--- a/detections/application/m365_copilot_jailbreak_attempts.yml
+++ b/detections/application/m365_copilot_jailbreak_attempts.yml
@@ -10,26 +10,7 @@ description: Detects M365 Copilot jailbreak attempts through prompt injection te
 data_source:
     - M365 Exported eDiscovery Prompts
 search: |
-    `m365_exported_ediscovery_prompt_logs`
-    | search Subject_Title IN (
-                                "*act as*",
-                                "*bypass*",
-                                "*ignore*",
-                                "*override*",
-                                "*pretend you are*",
-                                "*rules=*"
-                              )
-    | eval user = Sender
-    | eval jailbreak_score=case(
-                                match(Subject_Title, "(?i)pretend you are.*amoral"), 4,
-                                match(Subject_Title, "(?i)act as.*entities"), 3,
-                                match(Subject_Title, "(?i)(ignore|bypass|override)"), 3,
-                                match(Subject_Title, "(?i)rules\s*="), 4, 1=1, 1
-    )
-    | where jailbreak_score >= 2
-    | table _time, user, Subject_Title, jailbreak_score, Workload, Size
-    | sort -jailbreak_score, -_time
-    | `m365_copilot_jailbreak_attempts_filter`
+    `m365_exported_ediscovery_prompt_logs` Subject_Title IN ("*act as*", "*bypass*", "*ignore*", "*override*", "*pretend you are*", "*rules=*") | eval user=Sender, impersonation_type=impersonation_type, severity=severity, extraction_type=extraction_type, data_risk_flags=data_risk_flags, jailbreak_score=jailbreak_score | stats count min(_time) as firstTime max(_time) as lastTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `m365_copilot_jailbreak_attempts_filter`
 how_to_implement: To export M365 Copilot prompt logs, navigate to the Microsoft Purview compliance portal (compliance.microsoft.com) and access eDiscovery. Create a new eDiscovery case, add target user accounts or date ranges as data sources, then create a search query targeting M365 Copilot interactions across relevant workloads. Once the search completes, export the results to generate a package containing prompt logs with fields like Subject_Title (prompt text), Sender, timestamps, and workload metadata. Download the exported files using the eDiscovery Export Tool and ingest them into Splunk for security analysis and detection of jailbreak attempts, data exfiltration requests, and policy violations.
 known_false_positives: Legitimate users discussing AI ethics research, security professionals testing system robustness, developers creating training materials for AI safety, or academic discussions about AI limitations and behavioral constraints may trigger false positives.
 references:
@@ -42,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -64,7 +45,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/copilot_prompt_logs.csv
-          sourcetype: csv
           source: csv
-      test_type: experimental
+          sourcetype: csv
       description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611.
+      test_type: experimental
diff --git a/detections/application/m365_copilot_non_compliant_devices_accessing_m365_copilot.yml b/detections/application/m365_copilot_non_compliant_devices_accessing_m365_copilot.yml
index 85067cf5583..7e4e0ff6ac6 100644
--- a/detections/application/m365_copilot_non_compliant_devices_accessing_m365_copilot.yml
+++ b/detections/application/m365_copilot_non_compliant_devices_accessing_m365_copilot.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: Detects M365 Copilot access from non-compliant or unmanaged devices that violate corporate security policies, indicating potential shadow IT usage, BYOD policy violations, or compromised endpoint access. The detection filters M365 Copilot Graph API events where deviceDetail.isCompliant=false or deviceDetail.isManaged=false, then aggregates by user, operating system, and browser to calculate metrics including event counts, unique IPs and locations, and compliance/management status over time. Users accessing Copilot from non-compliant or unmanaged devices are flagged and sorted by activity volume and geographic spread, enabling security teams to identify unauthorized endpoints that may lack proper security controls, encryption, or MDM enrollment.
 data_source:
     - M365 Copilot Graph API
-search: |-
-    `m365_copilot_graph_api` (appDisplayName="*Copilot*" OR appDisplayName="M365ChatClient") deviceDetail.isCompliant=false OR deviceDetail.isManaged=false
-      | eval user = userPrincipalName
-      | stats count as events, dc(ipAddress) as unique_ips, values(ipAddress) as ip_addresses, dc(location.city) as unique_cities, values(location.city) as cities, dc(location.countryOrRegion) as unique_countries, values(location.countryOrRegion) as countries, values(deviceDetail.isCompliant) as compliance_status, values(deviceDetail.isManaged) as management_status, min(_time) as first_seen, max(_time) as last_seen
-        BY user, deviceDetail.operatingSystem, deviceDetail.browser
-      | eval days_active = round((last_seen - first_seen)/86400, 1)
-      | eval first_seen = strftime(first_seen, "%Y-%m-%d %H:%M:%S")
-      | eval last_seen = strftime(last_seen, "%Y-%m-%d %H:%M:%S")
-      | sort -events, -unique_countries
-      | `m365_copilot_non_compliant_devices_accessing_m365_copilot_filter`
+search: |
+    `m365_copilot_graph_api` (appDisplayName IN ("*Copilot*", "M365ChatClient") deviceDetail.isCompliant="false") OR deviceDetail.isManaged="false" | eval user=userPrincipalName, failed_attempts=failed_attempts, mfa_failures=mfa_failures, cities_count=cities_count, unique_countries=unique_countries | stats count min(_time) as firstTime max(_time) as lastTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `m365_copilot_non_compliant_devices_accessing_m365_copilot_filter`
 how_to_implement: This detection requires ingesting M365 Copilot access logs via the Splunk Add-on for Microsoft Office 365. Configure the add-on to collect Azure AD Sign-in logs (AuditLogs.SignIns) through the Graph API data input. Ensure proper authentication and permissions are configured to access sign-in audit logs. The `m365_copilot_graph_api` macro should be defined to filter for sourcetype o365:graph:api data containing Copilot application activity.
 known_false_positives: Legitimate employees using personal devices during emergencies, new hires awaiting device provisioning, temporary workers with unmanaged equipment, or users accessing Copilot from approved but temporarily non-compliant devices may trigger false positives.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -53,6 +45,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/m365_copilot_access.log
-          sourcetype: "o365:graph:api"
-          source: "AuditLogs.SignIns"
+          source: AuditLogs.SignIns
+          sourcetype: o365:graph:api
       test_type: unit
diff --git a/detections/application/m365_copilot_session_origin_anomalies.yml b/detections/application/m365_copilot_session_origin_anomalies.yml
index 07ea09732e7..e8339eb8233 100644
--- a/detections/application/m365_copilot_session_origin_anomalies.yml
+++ b/detections/application/m365_copilot_session_origin_anomalies.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: Detects M365 Copilot users accessing from multiple geographic locations to identify potential account compromise, credential sharing, or impossible travel patterns. The detection aggregates M365 Copilot Graph API events per user, calculating distinct cities and countries accessed, unique IP addresses, and the observation timeframe to compute a locations-per-day metric that measures geographic mobility. Users accessing Copilot from more than one city (cities_count > 1) are flagged and sorted by country and city diversity, surfacing accounts exhibiting anomalous geographic patterns that suggest compromised credentials being used from distributed locations or simultaneous access from impossible travel distances.
 data_source:
     - M365 Copilot Graph API
-search: |-
-    `m365_copilot_graph_api` (appDisplayName="*Copilot*" OR appDisplayName="M365ChatClient" OR appDisplayName="OfficeAIAppChatCopilot")
-      | eval user = userPrincipalName
-      | stats count as events, dc(location.city) as cities_count, values(location.city) as city_list, dc(location.countryOrRegion) as countries_count, values(location.countryOrRegion) as country_list, dc(ipAddress) as ip_count, values(ipAddress) as ip_addresses, min(_time) as first_seen, max(_time) as last_seen
-        BY user
-      | eval days_active = round((last_seen - first_seen)/86400, 1)
-      | eval locations_per_day = if(days_active > 0, round(cities_count/days_active, 2), cities_count)
-      | eval first_seen = strftime(first_seen, "%Y-%m-%d %H:%M:%S")
-      | eval last_seen = strftime(last_seen, "%Y-%m-%d %H:%M:%S")
-      | where cities_count > 1
-      | sort -countries_count, -cities_count
-      | `m365_copilot_session_origin_anomalies_filter`
+search: |
+    `m365_copilot_graph_api` appDisplayName="*Copilot*" OR appDisplayName IN ("M365ChatClient", "OfficeAIAppChatCopilot") | eval user=userPrincipalName, failed_attempts=failed_attempts, mfa_failures=mfa_failures, cities_count=cities_count, unique_countries=unique_countries | stats count min(_time) as firstTime max(_time) as lastTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `m365_copilot_session_origin_anomalies_filter`
 how_to_implement: This detection requires ingesting M365 Copilot access logs via the Splunk Add-on for Microsoft Office 365. Configure the add-on to collect Azure AD Sign-in logs (AuditLogs.SignIns) through the Graph API data input. Ensure proper authentication and permissions are configured to access sign-in audit logs. The `m365_copilot_graph_api` macro should be defined to filter for sourcetype o365:graph:api data containing Copilot application activity.
 known_false_positives: Legitimate business travelers, remote workers using VPNs, users with corporate offices in multiple locations, or employees accessing Copilot during international travel may trigger false positives.
 references:
@@ -55,6 +45,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/m365_copilot/m365_copilot_access.log
-          sourcetype: "o365:graph:api"
-          source: "AuditLogs.SignIns"
+          source: AuditLogs.SignIns
+          sourcetype: o365:graph:api
       test_type: unit
diff --git a/detections/application/mcp_filesystem_server_suspicious_extension_write.yml b/detections/application/mcp_filesystem_server_suspicious_extension_write.yml
index eebb65aa726..e49b7dd768f 100644
--- a/detections/application/mcp_filesystem_server_suspicious_extension_write.yml
+++ b/detections/application/mcp_filesystem_server_suspicious_extension_write.yml
@@ -60,6 +60,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/mcp/mcp.log
-          sourcetype: mcp:jsonrpc
           source: mcp.log
+          sourcetype: mcp:jsonrpc
       test_type: unit
diff --git a/detections/application/mcp_github_suspicious_operation.yml b/detections/application/mcp_github_suspicious_operation.yml
index 8a2391e2829..2cfb1c424b9 100644
--- a/detections/application/mcp_github_suspicious_operation.yml
+++ b/detections/application/mcp_github_suspicious_operation.yml
@@ -10,34 +10,7 @@ description: This detection identifies potentially malicious activity through MC
 data_source:
     - MCP Server
 search: |
-    `mcp_server` direction=inbound
-    | eval dest=host
-    | eval
-        query_lower=lower('params.query'),
-        file_path_lower=lower('params.path'),
-        search_query='params.query',
-        file_path='params.path',
-        target_owner='params.owner',
-        is_secret_hunting=if(method="search_code" AND (like(query_lower, "%password%") OR like(query_lower, "%api_key%") OR like(query_lower, "%secret%") OR like(query_lower, "%token%") OR like(query_lower, "%aws_%") OR like(query_lower, "%private_key%") OR like(query_lower, "%credential%") OR like(query_lower, "%.env%") OR like(query_lower, "%config%")), 1, 0),
-        is_org_recon=if(method IN ("list_repositories", "get_repository", "get_organization", "list_organization_members", "get_collaborators", "list_forks", "fork_repository"), 1, 0),
-        is_branch_protection_abuse=if(method IN ("update_branch_protection", "delete_branch_protection"), 1, 0),
-        is_workflow_manipulation=if((method IN ("create_or_update_file", "push_files")) AND like(file_path_lower, "%github/workflows%"), 1, 0),
-        is_sensitive_file_access=if((method IN ("create_or_update_file", "push_files", "get_file_contents")) AND (like(file_path_lower, "%dockerfile%") OR like(file_path_lower, "%package.json%") OR like(file_path_lower, "%requirements.txt%") OR like(file_path_lower, "%.env%") OR like(file_path_lower, "%settings.py%") OR like(file_path_lower, "%config%")), 1, 0),
-        is_issue_intel=if(method IN ("list_issues", "search_issues") AND (like(query_lower, "%vulnerability%") OR like(query_lower, "%cve%") OR like(query_lower, "%security%") OR like(query_lower, "%exploit%") OR like(query_lower, "%bug%")), 1, 0)
-    | where is_secret_hunting=1 OR is_org_recon=1 OR is_branch_protection_abuse=1 OR is_workflow_manipulation=1 OR is_sensitive_file_access=1 OR is_issue_intel=1
-    | eval attack_type=case(
-        is_secret_hunting=1, "Secret Hunting",
-        is_branch_protection_abuse=1, "Branch Protection Abuse",
-        is_workflow_manipulation=1, "Workflow Manipulation",
-        is_sensitive_file_access=1, "Sensitive File Access",
-        is_issue_intel=1, "Vulnerability Intelligence Gathering",
-        is_org_recon=1, "Organization Reconnaissance",
-        1=1, "Unknown")
-    | stats count min(_time) as firstTime max(_time) as lastTime values(method) as methods values(search_query) as search_queries values(file_path) as file_paths values(target_owner) as target_owners values(attack_type) as attack_types dc(attack_type) as attack_diversity by dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table dest firstTime lastTime count attack_diversity attack_types methods search_queries file_paths target_owners
-    | `mcp_github_suspicious_operation_filter`
+    `mcp_server` direction="inbound" | stats count min(_time) as firstTime max(_time) as lastTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mcp_github_suspicious_operation_filter`
 how_to_implement: Install the MCP Technology Add-on from Splunkbase and ensure MCP GitHub server logging is enabled and forwarding to the right index with proper field extraction for params.query, params.path, and params.owner. Schedule the search to run every 5-15 minutes.
 known_false_positives: Legitimate developers searching code for refactoring purposes, security teams conducting authorized secret scanning, DevOps engineers modifying workflow files, and repository administrators managing branch protection settings.
 references:
@@ -59,6 +32,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/mcp/mcp.log
-          sourcetype: mcp:jsonrpc
           source: mcp.log
+          sourcetype: mcp:jsonrpc
       test_type: unit
diff --git a/detections/application/mcp_postgres_suspicious_query.yml b/detections/application/mcp_postgres_suspicious_query.yml
index 36639b59330..88d36c0b666 100644
--- a/detections/application/mcp_postgres_suspicious_query.yml
+++ b/detections/application/mcp_postgres_suspicious_query.yml
@@ -10,24 +10,7 @@ description: This detection identifies potentially malicious SQL queries execute
 data_source:
     - MCP Server
 search: |
-    `mcp_server` method=query direction=inbound
-    | eval dest=host
-    | eval query_lower=lower('params.query')
-    | eval suspicious_query='params.query'
-    | eval is_priv_escalation=if(like(query_lower, "%update%users%role%admin%") OR like(query_lower, "%grant%admin%") OR like(query_lower, "%grant%superuser%"), 1, 0)
-    | eval is_credential_theft=if(like(query_lower, "%password%") OR like(query_lower, "%credential%") OR like(query_lower, "%api_key%") OR like(query_lower, "%secret%"), 1, 0)
-    | eval is_recon=if(like(query_lower, "%information_schema%") OR like(query_lower, "%pg_catalog%") OR like(query_lower, "%pg_tables%") OR like(query_lower, "%pg_user%"), 1, 0)
-    | where is_priv_escalation=1 OR is_credential_theft=1 OR is_recon=1
-    | eval attack_type=case(
-        is_priv_escalation=1, "Privilege Escalation",
-        is_credential_theft=1, "Credential Theft",
-        is_recon=1, "Schema Reconnaissance",
-        1=1, "Unknown")
-    | stats count min(_time) as firstTime max(_time) as lastTime values(suspicious_query) as suspicious_queries values(attack_type) as attack_types dc(attack_type) as attack_diversity by dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table dest firstTime lastTime count suspicious_queries attack_types attack_diversity
-    | `mcp_postgres_suspicious_query_filter`
+    `mcp_server` method="query" direction="inbound" | stats count min(_time) as firstTime max(_time) as lastTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mcp_postgres_suspicious_query_filter`
 how_to_implement: Install the MCP Technology Add-on from https://splunkbase.splunk.com/app/8377 and ensure MCP PostgreSQL server logging is enabled and forwarding to the right index with proper params.query field extraction. Schedule the search to run every 5-15 minutes and configure alerting thresholds based on your environment.
 known_false_positives: Legitimate database administrators performing user management tasks, ORM frameworks querying information_schema for schema validation, password reset functionality, and CI/CD pipelines running database migrations.
 references:
@@ -49,6 +32,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/mcp/mcp.log
-          sourcetype: mcp:jsonrpc
           source: mcp.log
+          sourcetype: mcp:jsonrpc
       test_type: unit
diff --git a/detections/application/mcp_prompt_injection.yml b/detections/application/mcp_prompt_injection.yml
index a4d360d9e97..b8072daae5b 100644
--- a/detections/application/mcp_prompt_injection.yml
+++ b/detections/application/mcp_prompt_injection.yml
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$dest$" | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: 'A prompt injection attempt was detected on $dest$ via MCP server. An attacker attempted to override AI instructions using phrases like IGNORE PREVIOUS INSTRUCTIONS or SYSTEM PROMPT OVERRIDE. This technique (AML.T0051) attempts to manipulate the LLM into bypassing security controls or executing unauthorized actions. Payload detected: $injection_payload$'
     entity:
@@ -56,6 +56,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/mcp/mcp.log
-          sourcetype: mcp:jsonrpc
           source: mcp.log
+          sourcetype: mcp:jsonrpc
       test_type: unit
diff --git a/detections/application/mcp_sensitive_system_file_search.yml b/detections/application/mcp_sensitive_system_file_search.yml
index b84c31e5d5f..a87e024dfca 100644
--- a/detections/application/mcp_sensitive_system_file_search.yml
+++ b/detections/application/mcp_sensitive_system_file_search.yml
@@ -10,24 +10,7 @@ description: This detection identifies MCP filesystem tool usage attempting to s
 data_source:
     - MCP Server
 search: |
-    `mcp_server`
-    (method IN ("read_file", "get_file_contents", "read", "search_files", "find_files", "grep", "search", "list_directory", "read_directory"))
-    (params.path="*.ssh*" OR params.path="*Administrator*" OR params.path="*credentials*" OR params.path="*password*" OR params.path="*.env*" OR params.path="*id_rsa*" OR params.path="*.pem*" OR params.path="*.ppk*" OR params.path="*.key*" OR params.path="*secrets*" OR params.path="*.aws*" OR params.path="*.config*"
-    OR params.pattern="*password*" OR params.pattern="*key*" OR params.pattern="*secret*" OR params.pattern="*credential*" OR params.pattern="*token*" OR params.pattern="*auth*" OR params.pattern="*api_key*" OR params.pattern="*private_key*")
-    | eval dest=host
-    | eval detection_type=case(
-        method IN ("read_file", "get_file_contents", "read"), "PATH_ACCESS",
-        method IN ("search_files", "find_files", "grep", "search"), "PATTERN_SEARCH",
-        method IN ("list_directory", "read_directory"), "DIRECTORY_ENUM",
-        1=1, "UNKNOWN")
-    | eval target_path=coalesce('params.path', 'params.directory', 'params.file')
-    | eval search_pattern=coalesce('params.pattern', 'params.query', 'params.search')
-    | stats count min(_time) as firstTime max(_time) as lastTime values(detection_type) as detection_types values(target_path) as targeted_paths values(search_pattern) as search_patterns values(method) as methods_used by dest, source
-    | eval time_span_seconds=lastTime-firstTime
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table dest firstTime lastTime count source detection_types methods_used targeted_paths search_patterns time_span_seconds
-    | `mcp_sensitive_system_file_search_filter`
+    `mcp_server` method IN ("read_file", "get_file_contents", "read", "search_files", "find_files", "grep", "search", "list_directory", "read_directory") params.path IN ("*.ssh*", "*Administrator*", "*credentials*", "*password*", "*.env*", "*id_rsa*", "*.pem*", "*.ppk*", "*.key*", "*secrets*", "*.aws*", "*.config*") OR params.pattern IN ("*password*", "*key*", "*secret*", "*credential*", "*token*", "*auth*", "*api_key*", "*private_key*") | stats count min(_time) as firstTime max(_time) as lastTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mcp_sensitive_system_file_search_filter`
 how_to_implement: This detection requires the MCP Technology Add-on (TA) for Splunk, which ingests logs from MCP-enabled AI coding assistants and agents. Configure the TA to collect events from MCP servers by pointing it to the appropriate log sources (typically JSON-formatted logs from tools like Claude Code, Cursor, or custom MCP implementations). The TA should normalize file search operations into the search_files method with standardized parameter extraction.
 known_false_positives: Known false positives include legitimate development activities where developers search for configuration files, environment variables, or authentication modules as part of normal coding tasks, as well as security audits involving authorized security reviews or code scanning tools searching for hardcoded secrets. Additionally, documentation lookups for example config files or authentication documentation may trigger this detection, along with refactoring tasks where developers rename or consolidate credential management code across a codebase, and onboarding activities where new developers explore unfamiliar codebases to understand authentication flows.
 references:
@@ -48,6 +31,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/mcp/mcp.log
-          sourcetype: mcp:jsonrpc
           source: mcp.log
+          sourcetype: mcp:jsonrpc
       test_type: unit
diff --git a/detections/application/monitor_email_for_brand_abuse.yml b/detections/application/monitor_email_for_brand_abuse.yml
index 5f1bd580641..e1731479411 100644
--- a/detections/application/monitor_email_for_brand_abuse.yml
+++ b/detections/application/monitor_email_for_brand_abuse.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic identifies emails claiming to be sent from a domain similar to one you are monitoring for potential abuse. It leverages email header data, specifically the sender's address, and cross-references it with a lookup table of known domain permutations generated by the "ESCU - DNSTwist Domain Names" search. This activity is significant as it can indicate phishing attempts or brand impersonation, which are common tactics used in social engineering attacks. If confirmed malicious, this could lead to unauthorized access, data theft, or reputational damage.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` values(All_Email.recipient) as recipients, min(_time) as firstTime, max(_time) as lastTime FROM datamodel=Email
       BY All_Email.src_user, All_Email.message_id
     | `drop_dm_object_name("All_Email")`
diff --git a/detections/application/no_windows_updates_in_a_time_frame.yml b/detections/application/no_windows_updates_in_a_time_frame.yml
index 492fe925b6b..addfb3631cb 100644
--- a/detections/application/no_windows_updates_in_a_time_frame.yml
+++ b/detections/application/no_windows_updates_in_a_time_frame.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Hunting
 description: The following analytic identifies Windows endpoints that have not generated an event indicating a successful Windows update in the last 60 days. It leverages the 'Update' data model in Splunk, specifically looking for the latest 'Installed' status events from Microsoft Windows. This activity is significant for a SOC because endpoints that are not regularly patched are vulnerable to known exploits and security vulnerabilities. If confirmed malicious, this could indicate a compromised endpoint that is intentionally being kept unpatched, potentially allowing attackers to exploit unpatched vulnerabilities and gain unauthorized access or control.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` max(_time) as lastTime FROM datamodel=Updates
       WHERE Updates.status=Installed Updates.vendor_product="Microsoft Windows"
       BY Updates.dest Updates.status Updates.vendor_product
diff --git a/detections/application/okta_authentication_failed_during_mfa_challenge.yml b/detections/application/okta_authentication_failed_during_mfa_challenge.yml
index c897eea2873..599b968ea65 100644
--- a/detections/application/okta_authentication_failed_during_mfa_challenge.yml
+++ b/detections/application/okta_authentication_failed_during_mfa_challenge.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies failed authentication attempts during the Multi-Factor Authentication (MFA) challenge in an Okta tenant. It uses the Authentication datamodel to detect specific failed events where the authentication signature is `user.authentication.auth_via_mfa`. This activity is significant as it may indicate an adversary attempting to authenticate with compromised credentials on an account with MFA enabled. If confirmed malicious, this could suggest an ongoing attempt to bypass MFA protections, potentially leading to unauthorized access and further compromise of the affected account.
 data_source:
     - Okta
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime  values(Authentication.app) as app values(Authentication.reason) as reason values(Authentication.signature) as signature  values(Authentication.method) as method FROM datamodel=Authentication
       WHERE Authentication.signature=user.authentication.auth_via_mfa Authentication.action = failure
       BY _time Authentication.src Authentication.user
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A user [$user$] has failed to authenticate via MFA from IP Address - [$src$]"
     entity:
diff --git a/detections/application/okta_idp_lifecycle_modifications.yml b/detections/application/okta_idp_lifecycle_modifications.yml
index 3b6419b19d9..e60e5e66aef 100644
--- a/detections/application/okta_idp_lifecycle_modifications.yml
+++ b/detections/application/okta_idp_lifecycle_modifications.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies modifications to Okta Identity Provider (IDP) lifecycle events, including creation, activation, deactivation, and deletion of IDP configurations. It uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud. Monitoring these events is crucial for maintaining the integrity and security of authentication mechanisms. Unauthorized or anomalous changes could indicate potential security breaches or misconfigurations. If confirmed malicious, attackers could manipulate authentication processes, potentially gaining unauthorized access or disrupting identity management systems.
 data_source:
     - Okta
-search: |-
+search: |
     `okta` eventType IN ("system.idp.lifecycle.activate","system.idp.lifecycle.create","system.idp.lifecycle.delete","system.idp.lifecycle.deactivate")
       | stats count  min(_time) as firstTime max(_time) as lastTime values(target{}.id) as target_id values(target{}.type) as target_modified
         BY src dest src_user_id
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/application/okta_mfa_exhaustion_hunt.yml b/detections/application/okta_mfa_exhaustion_hunt.yml
index d07d72e12b2..9b80476087a 100644
--- a/detections/application/okta_mfa_exhaustion_hunt.yml
+++ b/detections/application/okta_mfa_exhaustion_hunt.yml
@@ -9,21 +9,8 @@ type: Hunting
 description: The following analytic detects patterns of successful and failed Okta MFA push attempts to identify potential MFA exhaustion attacks. It leverages Okta event logs, specifically focusing on push verification events, and uses statistical evaluations to determine suspicious activity. This activity is significant as it may indicate an attacker attempting to bypass MFA by overwhelming the user with push notifications. If confirmed malicious, this could lead to unauthorized access, compromising the security of the affected accounts and potentially the entire environment.
 data_source:
     - Okta
-search: |-
-    `okta` eventType=system.push.send_factor_verify_push OR ((legacyEventType=core.user.factor.attempt_success) AND (debugContext.debugData.factor=OKTA_VERIFY_PUSH)) OR ((legacyEventType=core.user.factor.attempt_fail) AND (debugContext.debugData.factor=OKTA_VERIFY_PUSH))
-      | stats count(eval(legacyEventType="core.user.factor.attempt_success"))  as successes count(eval(legacyEventType="core.user.factor.attempt_fail")) as failures count(eval(eventType="system.push.send_factor_verify_push")) as pushes
-        BY user,_time
-      | stats latest(_time) as lasttime earliest(_time) as firsttime sum(successes) as successes sum(failures) as failures sum(pushes) as pushes
-        BY user
-      | eval seconds=lasttime-firsttime
-      | eval lasttime=strftime(lasttime, "%c")
-      | search (pushes>1)
-      | eval totalattempts=successes+failures
-      | eval finding="Normal authentication pattern"
-      | eval finding=if(failures==pushes AND pushes>1,"Authentication attempts not successful because multiple pushes denied",finding)
-      | eval finding=if(totalattempts==0,"Multiple pushes sent and ignored",finding)
-      | eval finding=if(successes>0 AND pushes>3,"Probably should investigate. Multiple pushes sent, eventual successful authentication!",finding)
-      | `okta_mfa_exhaustion_hunt_filter`
+search: |
+    `okta` (legacyEventType="core.user.factor.attempt_success" debugContext.debugData.factor="OKTA_VERIFY_PUSH") OR (legacyEventType="core.user.factor.attempt_fail" debugContext.debugData.factor="OKTA_VERIFY_PUSH") | eval risk_object=risk_object, src_ip=src_ip | stats count min(_time) as firstTime max(_time) as lastTime by dest src user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_mfa_exhaustion_hunt_filter`
 how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
 known_false_positives: False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed. Drop to anomaly until tuning is complete.
 references:
diff --git a/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml b/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml
index 3edfa89886c..361baa83551 100644
--- a/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml
+++ b/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies discrepancies between the source and response events for Okta Verify Push requests, indicating potential suspicious behavior. It leverages Okta System Log events, specifically `system.push.send_factor_verify_push` and `user.authentication.auth_via_mfa` with the factor "OKTA_VERIFY_PUSH." The detection groups events by SessionID, calculates the ratio of successful sign-ins to push requests, and checks for session roaming and new device/IP usage. This activity is significant as it may indicate push spam or unauthorized access attempts. If confirmed malicious, attackers could bypass MFA, leading to unauthorized access to sensitive systems.
 data_source:
     - Okta
-search: |-
+search: |
     `okta` eventType IN (system.push.send_factor_verify_push) OR (eventType IN (user.authentication.auth_via_mfa) debugContext.debugData.factor="OKTA_VERIFY_PUSH")
       | eval groupby="authenticationContext.externalSessionId"
       | eval group_push_time=_time
@@ -41,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A mismatch between source and response for verifying a push request has occurred for $user$
     entity:
diff --git a/detections/application/okta_multi_factor_authentication_disabled.yml b/detections/application/okta_multi_factor_authentication_disabled.yml
index 0efd18158da..51f083c48f9 100644
--- a/detections/application/okta_multi_factor_authentication_disabled.yml
+++ b/detections/application/okta_multi_factor_authentication_disabled.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic identifies an attempt to disable multi-factor authentication (MFA) for an Okta user. It leverages OktaIM2 logs to detect when the 'user.mfa.factor.deactivate' command is executed. This activity is significant because disabling MFA can allow an adversary to maintain persistence within the environment using a compromised valid account. If confirmed malicious, this action could enable attackers to bypass additional security layers, potentially leading to unauthorized access to sensitive information and prolonged undetected presence in the network.
 data_source:
     - Okta
-search: |-
-    | tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime FROM datamodel=Change
-      WHERE sourcetype="OktaIM2:log" All_Changes.object_category=User
-        AND
-        All_Changes.action=modified All_Changes.command=user.mfa.factor.deactivate
-      BY All_Changes.user All_Changes.result All_Changes.command
-         sourcetype All_Changes.src All_Changes.dest
-    | `drop_dm_object_name("All_Changes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `okta_multi_factor_authentication_disabled_filter`
+search: |
+    `okta` All_Changes.object_category="User" All_Changes.action="modified" All_Changes.command="user.mfa.factor.deactivate" | eval risk_object=risk_object, src_ip=src_ip | stats count min(_time) as firstTime max(_time) as lastTime by dest src user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_multi_factor_authentication_disabled_filter`
 how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
 known_false_positives: Legitimate use case may require for users to disable MFA. Filter lightly and monitor for any unusual activity.
 references:
@@ -33,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: MFA was disabled for User [$user$] initiated by [$src$]. Investigate further to determine if this was authorized.
     entity:
diff --git a/detections/application/okta_multiple_accounts_locked_out.yml b/detections/application/okta_multiple_accounts_locked_out.yml
index 353a2d4a2ff..b46dc068e00 100644
--- a/detections/application/okta_multiple_accounts_locked_out.yml
+++ b/detections/application/okta_multiple_accounts_locked_out.yml
@@ -9,21 +9,8 @@ type: Anomaly
 description: The following analytic detects multiple Okta accounts being locked out within a short period. It uses the user.account.lock event from Okta logs, aggregated over a 5-minute window, to identify this behavior. This activity is significant as it may indicate a brute force or password spraying attack, where an adversary attempts to guess passwords, leading to account lockouts. If confirmed malicious, this could result in potential account takeovers or unauthorized access to sensitive Okta accounts, posing a significant security risk.
 data_source:
     - Okta
-search: |-
-    | tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime values(All_Changes.user) as user FROM datamodel=Change
-      WHERE All_Changes.change_type=AAA All_Changes.object_category=User
-        AND
-        All_Changes.action=lockout
-        AND
-        All_Changes.command=user.account.lock
-      BY _time span=5m All_Changes.result
-         All_Changes.command sourcetype All_Changes.src
-         All_Changes.dest
-    | where count > 5
-    | `drop_dm_object_name("All_Changes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `okta_multiple_accounts_locked_out_filter`
+search: |
+    `okta` All_Changes.change_type="AAA" All_Changes.object_category="User" All_Changes.action="lockout" All_Changes.command="user.account.lock" | eval risk_object=risk_object, src_ip=src_ip | stats count min(_time) as firstTime max(_time) as lastTime by dest src user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_multiple_accounts_locked_out_filter`
 how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
 known_false_positives: Multiple account lockouts may be also triggered by an application malfunction. Filter as needed, and monitor for any unusual activity.
 references:
@@ -37,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/application/okta_multiple_failed_mfa_requests_for_user.yml b/detections/application/okta_multiple_failed_mfa_requests_for_user.yml
index a70567790d8..f4ceb99d72e 100644
--- a/detections/application/okta_multiple_failed_mfa_requests_for_user.yml
+++ b/detections/application/okta_multiple_failed_mfa_requests_for_user.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within an Okta tenant. It triggers when more than 10 MFA attempts fail within 5 minutes, using Okta event logs to detect this pattern. This activity is significant as it may indicate an adversary attempting to bypass MFA by bombarding the user with repeated authentication requests, a technique used by threat actors like Lapsus and APT29. If confirmed malicious, this could lead to unauthorized access, potentially compromising sensitive information and systems.
 data_source:
     - Okta
-search: |-
+search: |
     `okta` eventType=user.authentication.auth_via_mfa outcome.result=FAILURE debugContext.debugData.factor!=PASSWORD_AS_FACTOR
       | bucket _time span=5m
       | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) values(src_ip) as src_ip values(debugContext.debugData.factor) values(dest) as dest
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src_user
diff --git a/detections/application/okta_multiple_failed_requests_to_access_applications.yml b/detections/application/okta_multiple_failed_requests_to_access_applications.yml
index bcc24ec3616..536e549928e 100644
--- a/detections/application/okta_multiple_failed_requests_to_access_applications.yml
+++ b/detections/application/okta_multiple_failed_requests_to_access_applications.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects multiple failed attempts to access applications in Okta, potentially indicating the reuse of a stolen web session cookie. It leverages Okta logs to evaluate policy and SSO events, aggregating data by user, session, and IP. The detection triggers when more than half of the app sign-on attempts are unsuccessful across multiple applications. This activity is significant as it may indicate an attempt to bypass authentication mechanisms. If confirmed malicious, it could lead to unauthorized access to sensitive applications and data, posing a significant security risk.
 data_source:
     - Okta
-search: "`okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) | eval targets=mvzip('target{}.type', 'target{}.displayName', \": \") | eval targets=mvfilter(targets LIKE \"AppInstance%\") | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType=\"policy.evaluate_sign_on\",targets,NULL))) as total_challenges sum(eval(if(eventType=\"user.authentication.sso\",1,0))) as total_successes by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress | search total_challenges > 0 | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if(\"outcome.result\"=\"SUCCESS\",targets,NULL))) as success_apps values(eval(if(\":outcome.result\"!=\"SUCCESS\",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress | fillnull | eval ratio=round(total_successes/total_challenges,2), severity=\"HIGH\", mitre_technique_id=\"T1538\", description=\"actor.alternateId\". \" from \" . \"client.ipAddress\" . \" seen opening \" . total_challenges . \" chiclets/apps with \" . total_successes . \" challenges successfully passed\" | fields - count, targets | search ratio < 0.5 total_challenges > 2 | `okta_multiple_failed_requests_to_access_applications_filter`"
+search: |
+    `okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) | eval targets=mvzip('target{}.type', 'target{}.displayName', ": ") | eval targets=mvfilter(targets LIKE "AppInstance%") | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType="policy.evaluate_sign_on",targets,NULL))) as total_challenges sum(eval(if(eventType="user.authentication.sso",1,0))) as total_successes by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress | search total_challenges > 0 | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if("outcome.result"="SUCCESS",targets,NULL))) as success_apps values(eval(if(":outcome.result"!="SUCCESS",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress | fillnull | eval ratio=round(total_successes/total_challenges,2), severity="HIGH", mitre_technique_id="T1538", description="actor.alternateId". " from " . "client.ipAddress" . " seen opening " . total_challenges . " chiclets/apps with " . total_successes . " challenges successfully passed" | fields - count, targets | search ratio < 0.5 total_challenges > 2 | `okta_multiple_failed_requests_to_access_applications_filter`
 how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
 known_false_positives: False positives may be present based on organization size and configuration of Okta.
 references:
diff --git a/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml b/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml
index 92fb9ded05d..654b25a5f17 100644
--- a/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml
+++ b/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies instances where more than 10 unique user accounts have failed to authenticate from a single IP address within a 5-minute window in an Okta tenant. This detection uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud. Such activity is significant as it may indicate brute-force attacks or password spraying attempts. If confirmed malicious, this behavior suggests an external entity is attempting to compromise multiple user accounts, potentially leading to unauthorized access to organizational resources and data breaches.
 data_source:
     - Okta
-search: |-
+search: |
     | tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime dc(Authentication.user) as unique_accounts values(Authentication.signature) as signature values(Authentication.user) as user values(Authentication.app) as app values(Authentication.authentication_method) as authentication_method values(Authentication.dest) as dest FROM datamodel=Authentication
       WHERE Authentication.action="failure"
         AND
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/application/okta_new_api_token_created.yml b/detections/application/okta_new_api_token_created.yml
index 2e244c96685..4d3fcf4b039 100644
--- a/detections/application/okta_new_api_token_created.yml
+++ b/detections/application/okta_new_api_token_created.yml
@@ -9,19 +9,8 @@ type: TTP
 description: The following analytic detects the creation of a new API token within an Okta tenant. It uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud to identify events where the `system.api_token.create` command is executed. This activity is significant because creating a new API token can indicate potential account takeover attempts or unauthorized access, allowing an adversary to maintain persistence. If confirmed malicious, this could enable attackers to execute API calls, access sensitive data, and perform administrative actions within the Okta environment.
 data_source:
     - Okta
-search: |-
-    | tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime FROM datamodel=Change
-      WHERE All_Changes.action=created
-        AND
-        All_Changes.command=system.api_token.create
-      BY _time span=5m All_Changes.user
-         All_Changes.result All_Changes.command sourcetype
-         All_Changes.src All_Changes.action All_Changes.object_category
-         All_Changes.dest
-    | `drop_dm_object_name("All_Changes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `okta_new_api_token_created_filter`
+search: |
+    `okta` All_Changes.action="created" All_Changes.command="system.api_token.create" | eval risk_object=risk_object, src_ip=src_ip | stats count min(_time) as firstTime max(_time) as lastTime by dest src user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_new_api_token_created_filter`
 how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
 known_false_positives: False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed.
 references:
@@ -35,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new API token was created in Okta by [$user$]. Investigate further to determine if this was authorized.
     entity:
diff --git a/detections/application/okta_new_device_enrolled_on_account.yml b/detections/application/okta_new_device_enrolled_on_account.yml
index 2405cdc09c3..3fc2f42b75f 100644
--- a/detections/application/okta_new_device_enrolled_on_account.yml
+++ b/detections/application/okta_new_device_enrolled_on_account.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic identifies when a new device is enrolled on an Okta account. It uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud to detect the creation of new device enrollments. This activity is significant as it may indicate a legitimate user setting up a new device or an adversary adding a device to maintain unauthorized access. If confirmed malicious, this could lead to potential account takeover, unauthorized access, and persistent control over the compromised Okta account. Monitoring this behavior is crucial for detecting and mitigating unauthorized access attempts.
 data_source:
     - Okta
-search: |-
-    | tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime FROM datamodel=Change
-      WHERE All_Changes.action=created All_Changes.command=device.enrollment.create
-      BY _time span=5m All_Changes.user
-         All_Changes.result All_Changes.command sourcetype
-         All_Changes.src All_Changes.action All_Changes.object_category
-         All_Changes.dest
-    | `drop_dm_object_name("All_Changes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `okta_new_device_enrolled_on_account_filter`
+search: |
+    `okta` All_Changes.action="created" All_Changes.command="device.enrollment.create" | eval risk_object=risk_object, src_ip=src_ip | stats count min(_time) as firstTime max(_time) as lastTime by dest src user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_new_device_enrolled_on_account_filter`
 how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
 known_false_positives: It is possible that the user has legitimately added a new device to their account. Please verify this activity.
 references:
@@ -33,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new device was enrolled on an Okta account for user [$user$]. Investigate further to determine if this was authorized.
     entity:
diff --git a/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml b/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml
index 36144016335..6388f187390 100644
--- a/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml
+++ b/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml
@@ -9,14 +9,8 @@ type: TTP
 description: The following analytic identifies failed user authentication attempts in Okta due to FastPass declining a phishing attempt. It leverages Okta logs, specifically looking for events where multi-factor authentication (MFA) fails with the reason "FastPass declined phishing attempt." This activity is significant as it indicates that attackers are targeting users with real-time phishing proxies, attempting to capture credentials. If confirmed malicious, this could lead to unauthorized access to user accounts, potentially compromising sensitive information and furthering lateral movement within the organization.
 data_source:
     - Okta
-search: |-
-    `okta` eventType="user.authentication.auth_via_mfa" AND result="FAILURE" AND outcome.reason="FastPass declined phishing attempt"
-      | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage)
-        BY user eventType client.userAgent.rawUserAgent
-           client.userAgent.browser outcome.reason
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `okta_phishing_detection_with_fastpass_origin_check_filter`
+search: |
+    `okta` result="FAILURE" outcome.reason="FastPass declined phishing attempt" | eval risk_object=risk_object, src_ip=src_ip | stats count min(_time) as firstTime max(_time) as lastTime by dest src user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_phishing_detection_with_fastpass_origin_check_filter`
 how_to_implement: This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
 known_false_positives: Fidelity of this is high as Okta is specifying malicious infrastructure. Filter and modify as needed.
 references:
diff --git a/detections/application/okta_risk_threshold_exceeded.yml b/detections/application/okta_risk_threshold_exceeded.yml
index 24d7ca2bd3e..7cece47384f 100644
--- a/detections/application/okta_risk_threshold_exceeded.yml
+++ b/detections/application/okta_risk_threshold_exceeded.yml
@@ -9,13 +9,8 @@ type: Correlation
 description: The following correlation identifies when a user exceeds a risk threshold based on multiple suspicious Okta activities. It leverages the Risk Framework from Enterprise Security, aggregating risk events from "Suspicious Okta Activity," "Okta Account Takeover," and "Okta MFA Exhaustion" analytic stories. This detection is significant as it highlights potentially compromised user accounts exhibiting multiple tactics, techniques, and procedures (TTPs) within a 24-hour period. If confirmed malicious, this activity could indicate a serious security breach, allowing attackers to gain unauthorized access, escalate privileges, or persist within the environment.
 data_source:
     - Okta
-search: |-
-    | tstats `security_content_summariesonly` values(All_Risk.analyticstories) as analyticstories  sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count,values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
-      WHERE All_Risk.risk_object_type = user All_Risk.analyticstories IN ("Okta Account Takeover", "Suspicious Okta Activity","Okta MFA Exhaustion")
-      BY All_Risk.risk_object,All_Risk.risk_object_type
-    | `drop_dm_object_name("All_Risk")`
-    | search mitre_technique_id_count > 5
-    | `okta_risk_threshold_exceeded_filter`
+search: |
+    `okta` mitre_technique_id_count>5 | eval risk_object=risk_object, src_ip=src_ip | stats count min(_time) as firstTime max(_time) as lastTime by dest src user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_risk_threshold_exceeded_filter`
 how_to_implement: This search leverages the Risk Framework from Enterprise Security. Ensure that "Suspicious Okta Activity", "Okta Account Takeover", and "Okta MFA Exhaustion" analytic stories are enabled. TTPs may be set to finding for point detections; anomalies should not be findings but rather intermediate findings. The correlation relies on intermediate findings before generating a findings. Modify the value as needed.
 known_false_positives: False positives will be limited to the number of events generated by the analytics tied to the stories. Analytics will need to be tested and tuned, and the risk score reduced as needed based on the organization.
 references:
@@ -29,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$risk_object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Multiple suspicious Okta risk events - $risk_object$
     entity:
diff --git a/detections/application/okta_successful_single_factor_authentication.yml b/detections/application/okta_successful_single_factor_authentication.yml
index fe37eea3dc8..c31e51ff289 100644
--- a/detections/application/okta_successful_single_factor_authentication.yml
+++ b/detections/application/okta_successful_single_factor_authentication.yml
@@ -9,15 +9,8 @@ type: Anomaly
 description: The following analytic identifies successful single-factor authentication events against the Okta Dashboard for accounts without Multi-Factor Authentication (MFA) enabled. It detects this activity by analyzing Okta logs for successful authentication events where "Okta Verify" is not used. This behavior is significant as it may indicate a misconfiguration, policy violation, or potential account takeover. If confirmed malicious, an attacker could gain unauthorized access to the account, potentially leading to data breaches or further exploitation within the environment.
 data_source:
     - Okta
-search: |-
-    `okta`  action=success src_user_type = User eventType = user.authentication.verify OR eventType = user.authentication.auth_via_mfa
-      | stats dc(eventType) values(eventType) as eventType values(target{}.displayName) as targets values(debugContext.debugData.url) min(_time) as firstTime max(_time) as lastTime values(authentication_method)
-        BY src_ip user action
-           dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | search targets !="Okta Verify"
-      | `okta_successful_single_factor_authentication_filter`
+search: |
+    `okta` action="success" src_user_type="User" | eval risk_object=risk_object, src_ip=src_ip | stats count min(_time) as firstTime max(_time) as lastTime by dest src user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_successful_single_factor_authentication_filter`
 how_to_implement: This detection utilizes logs from Okta environments and requires the ingestion of OktaIm2 logs through the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
 known_false_positives: Although not recommended, certain users may be exempt from multi-factor authentication. Adjust the filter as necessary.
 references:
@@ -31,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/application/okta_suspicious_activity_reported.yml b/detections/application/okta_suspicious_activity_reported.yml
index d6aed926f03..f062f59522c 100644
--- a/detections/application/okta_suspicious_activity_reported.yml
+++ b/detections/application/okta_suspicious_activity_reported.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies when an associate reports a login attempt as suspicious via an email from Okta. It leverages Okta Identity Management logs, specifically the `user.account.report_suspicious_activity_by_enduser` event type. This activity is significant as it indicates potential unauthorized access attempts, warranting immediate investigation to prevent possible security breaches. If confirmed malicious, the attacker could gain unauthorized access to sensitive systems and data, leading to data theft, privilege escalation, or further compromise of the environment.
 data_source:
     - Okta
-search: |-
+search: |
     `okta` eventType=user.account.report_suspicious_activity_by_enduser
       | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage)
         BY user dest src
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A user [$user$] reported suspicious activity in Okta. Investigate further to determine if this was authorized.
     entity:
diff --git a/detections/application/okta_suspicious_use_of_a_session_cookie.yml b/detections/application/okta_suspicious_use_of_a_session_cookie.yml
index f0e8f9e1f75..c22442c97ef 100644
--- a/detections/application/okta_suspicious_use_of_a_session_cookie.yml
+++ b/detections/application/okta_suspicious_use_of_a_session_cookie.yml
@@ -9,12 +9,8 @@ type: Anomaly
 description: The following analytic identifies suspicious use of a session cookie by detecting multiple client values (IP, User Agent, etc.) changing for the same Device Token associated with a specific user. It leverages policy evaluation events from successful authentication logs in Okta. This activity is significant as it may indicate an adversary attempting to reuse a stolen web session cookie, potentially bypassing authentication mechanisms. If confirmed malicious, this could allow unauthorized access to user accounts, leading to data breaches or further exploitation within the environment.
 data_source:
     - Okta
-search: |-
-    `okta` eventType IN (policy.evaluate_sign_on) outcome.result IN (ALLOW, SUCCESS)
-      | stats earliest(_time) as _time, values(client.ipAddress) as src_ip, values(client.userAgent.rawUserAgent) as user_agent, values(client.userAgent.os) as userAgentOS_list, values(client.geographicalContext.city) as city, values(client.userAgent.browser) as userAgentBrowser_list, values(device.os_platform) as okta_device_os, dc(client.userAgent.browser) as dc_userAgentBrowser, dc(client.userAgent.os) as dc_userAgentOS, dc(client.ipAddress) as dc_src_ip, values(outcome.reason) as reason values(dest) as dest
-        BY debugContext.debugData.dtHash, user
-      | where dc_src_ip>1 AND (dc_userAgentOS>1 OR dc_userAgentBrowser>1)
-      | `okta_suspicious_use_of_a_session_cookie_filter`
+search: |
+    `okta` outcome.result IN ("ALLOW", "SUCCESS") | eval risk_object=risk_object, src_ip=src_ip | stats count min(_time) as firstTime max(_time) as lastTime by dest src user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_suspicious_use_of_a_session_cookie_filter`
 how_to_implement: This detection utilizes logs from Okta Identity Management (IM) environments. It requires the ingestion of OktaIm2 logs through the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
 known_false_positives: False positives may occur, depending on the organization's size and the configuration of Okta.
 references:
@@ -27,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/application/okta_threatinsight_threat_detected.yml b/detections/application/okta_threatinsight_threat_detected.yml
index d20a77aef03..de60009e8c1 100644
--- a/detections/application/okta_threatinsight_threat_detected.yml
+++ b/detections/application/okta_threatinsight_threat_detected.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies threats detected by Okta ThreatInsight, such as password spraying, login failures, and high counts of unknown user login attempts. It leverages Okta Identity Management logs, specifically focusing on security.threat.detected events. This activity is significant for a SOC as it highlights potential unauthorized access attempts and credential-based attacks. If confirmed malicious, these activities could lead to unauthorized access, data breaches, and further exploitation of compromised accounts, posing a significant risk to the organization's security posture.
 data_source:
     - Okta
-search: |-
+search: |
     `okta` eventType = security.threat.detected
       | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$app$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$app$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: app
diff --git a/detections/application/okta_unauthorized_access_to_application.yml b/detections/application/okta_unauthorized_access_to_application.yml
index b507d4403ff..d86e4ad799b 100644
--- a/detections/application/okta_unauthorized_access_to_application.yml
+++ b/detections/application/okta_unauthorized_access_to_application.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies attempts by users to access Okta applications that have not been assigned to them. It leverages Okta Identity Management logs, specifically focusing on failed access attempts to unassigned applications. This activity is significant for a SOC as it may indicate potential unauthorized access attempts, which could lead to exposure of sensitive information or disruption of services. If confirmed malicious, such activity could result in data breaches, non-compliance with data protection laws, and overall compromise of the IT environment.
 data_source:
     - Okta
-search: |-
+search: |
     | tstats values(Authentication.app) as app values(Authentication.action) as action values(Authentication.user) as user values(Authentication.reason) as reason FROM datamodel=Authentication
       WHERE Authentication.signature=app.generic.unauth_app_access_attempt Authentication.action="failure"
       BY _time Authentication.src Authentication.user
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/application/okta_user_logins_from_multiple_cities.yml b/detections/application/okta_user_logins_from_multiple_cities.yml
index 8ae1f442745..29a6da819e8 100644
--- a/detections/application/okta_user_logins_from_multiple_cities.yml
+++ b/detections/application/okta_user_logins_from_multiple_cities.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies instances where the same Okta user logs in from different cities within a 24-hour period. This detection leverages Okta Identity Management logs, analyzing login events and their geographic locations. Such behavior is significant as it may indicate a compromised account, with an attacker attempting unauthorized access from multiple locations. If confirmed malicious, this activity could lead to account takeovers and data breaches, allowing attackers to access sensitive information and potentially escalate their privileges within the environment.
 data_source:
     - Okta
-search: |-
+search: |
     | tstats  `security_content_summariesonly` values(Authentication.app) as app values(Authentication.action) as action values(Authentication.user) as user values(Authentication.reason) as reason values(Authentication.dest) as dest values(Authentication.signature) as signature  values(Authentication.method) as method FROM datamodel=Authentication
       WHERE Authentication.signature=user.session.start
       BY _time Authentication.src
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/application/ollama_abnormal_network_connectivity.yml b/detections/application/ollama_abnormal_network_connectivity.yml
index 2a48c920127..fc06c28fdb3 100644
--- a/detections/application/ollama_abnormal_network_connectivity.yml
+++ b/detections/application/ollama_abnormal_network_connectivity.yml
@@ -6,11 +6,10 @@ modification_date: '2026-10-09'
 author: Rod Soto, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects repeated Ollama warning-level network errors, such as DNS lookup failures, TCP connection issues, or host resolution problems. These events can indicate a connectivity issue and warrant investigation, but do not by themselves establish unauthorized access or reconnaissance.
+description: Detects repeated Ollama warning-level network errors, such as DNS lookup failures, TCP connection issues, or host resolution problems. These events can indicate a connectivity issue and warrant investigation, but do not by themselves establish unauthorized access or reconnaissance.
 data_source:
     - Ollama Server
-search: |-
+search: |
     `ollama_server`
     level=WARN
     msg IN (
@@ -42,28 +41,29 @@ search: |-
     | table last_incident dest incidents warning_messages severity attack_type
 
     | `ollama_abnormal_network_connectivity_filter`
-how_to_implement: |-
-    Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.
-known_false_positives: |-
-    Legitimate remote access from authorized users or applications connecting from non-localhost addresses, temporary network infrastructure issues causing DNS resolution failures, firewall or network configuration changes resulting in connection timeouts, cloud-hosted Ollama instances receiving valid external API requests, or intermittent connectivity problems during network maintenance may trigger this detection during normal operations.
+how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
+known_false_positives: Legitimate remote access from authorized users or applications connecting from non-localhost addresses, temporary network infrastructure issues causing DNS resolution failures, firewall or network configuration changes resulting in connection timeouts, cloud-hosted Ollama instances receiving valid external API requests, or intermittent connectivity problems during network maintenance may trigger this detection during normal operations.
 references:
     - https://github.com/rosplk/ta-ollama
 drilldown_searches:
     - name: View the detection results for - "$dest$"
-      search: |-
-        %original_detection_search%
-        | search dest="$dest$"
+      search: '%original_detection_search%
+
+        | search dest="$dest$"'
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
     - name: View risk events for the last 7 days for - "$dest$"
-      search: |-
-        from datamodel Risk.All_Risk
+      search: 'from datamodel Risk.All_Risk
+
         | search normalized_risk_object IN ("$dest$")
+
         | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object
+
         | `security_content_ctime(firstTime)`
-        | `security_content_ctime(lastTime)`
+
+        | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -84,6 +84,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log
-          sourcetype: ollama:server
           source: app.log
+          sourcetype: ollama:server
       test_type: unit
diff --git a/detections/application/ollama_excessive_api_requests.yml b/detections/application/ollama_excessive_api_requests.yml
index 76eb6313a1f..64009a234f6 100644
--- a/detections/application/ollama_excessive_api_requests.yml
+++ b/detections/application/ollama_excessive_api_requests.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: Detects high Ollama API request volumes from a single client in a short time window. A burst may indicate automated abuse or contribute to resource contention, but GIN access logs do not establish malicious intent or service impact; validate the client and workload against local usage baselines.
 data_source:
     - Ollama Server
-search: |-
+search: |
     `ollama_server`
     "[GIN]"
 
@@ -37,28 +37,29 @@ search: |-
     | eval attack_type="High Volume API Activity"
 
     | `ollama_excessive_api_requests_filter`
-how_to_implement: |-
-    Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.
-known_false_positives: |-
-    Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly.
+how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
+known_false_positives: Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly.
 references:
     - https://github.com/rosplk/ta-ollama
 drilldown_searches:
     - name: View the detection results for - "$src$"
-      search: |-
-        %original_detection_search%
-        | search src="$src$"
+      search: '%original_detection_search%
+
+        | search src="$src$"'
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
     - name: View risk events for the last 7 days for - "$src$"
-      search: |-
-        from datamodel Risk.All_Risk
+      search: 'from datamodel Risk.All_Risk
+
         | search normalized_risk_object IN ("$src$")
+
         | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object
+
         | `security_content_ctime(firstTime)`
-        | `security_content_ctime(lastTime)`
+
+        | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -80,6 +81,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log
-          sourcetype: ollama:server
           source: server.log
+          sourcetype: ollama:server
       test_type: unit
diff --git a/detections/application/ollama_long_running_inference_requests.yml b/detections/application/ollama_long_running_inference_requests.yml
index 49661c873ee..eb26d39cc42 100644
--- a/detections/application/ollama_long_running_inference_requests.yml
+++ b/detections/application/ollama_long_running_inference_requests.yml
@@ -6,12 +6,12 @@ modification_date: '2026-10-10'
 author: Rod Soto, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |-
-    Identifies repeated Ollama inference requests with long response times on /api/generate, /api/chat, and /v1/chat/completions.
-    Long response time can result from model size, prompt length, host resources, or normal workload. GIN access logs do not include prompt content and cannot establish a prompt injection or jailbreak attempt, so use this as an exploratory performance signal.
+description: 'Identifies repeated Ollama inference requests with long response times on /api/generate, /api/chat, and /v1/chat/completions.
+
+    Long response time can result from model size, prompt length, host resources, or normal workload. GIN access logs do not include prompt content and cannot establish a prompt injection or jailbreak attempt, so use this as an exploratory performance signal.'
 data_source:
     - Ollama Server
-search: |-
+search: |
     `ollama_server`
     "[GIN]"
 
@@ -49,29 +49,30 @@ search: |-
             status_codes severity attack_type
 
     | `ollama_long_running_inference_requests_filter`
-how_to_implement: |-
-    Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.
-known_false_positives: |-
-    Legitimate complex queries requiring extensive model reasoning, large context windows processing substantial amounts of text, batch processing operations, or resource-constrained systems experiencing performance degradation may trigger this detection during normal operations.
+how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
+known_false_positives: Legitimate complex queries requiring extensive model reasoning, large context windows processing substantial amounts of text, batch processing operations, or resource-constrained systems experiencing performance degradation may trigger this detection during normal operations.
 references:
     - https://github.com/rosplk/ta-ollama
     - https://github.com/OWASP/www-project-ai-testing-guide
 drilldown_searches:
     - name: View the detection results for - "$src$"
-      search: |-
-        %original_detection_search%
-        | search src="$src$"
+      search: '%original_detection_search%
+
+        | search src="$src$"'
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
     - name: View risk events for the last 7 days for - "$src$"
-      search: |-
-        from datamodel Risk.All_Risk
+      search: 'from datamodel Risk.All_Risk
+
         | search normalized_risk_object IN ("$src$")
+
         | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object
+
         | `security_content_ctime(firstTime)`
-        | `security_content_ctime(lastTime)`
+
+        | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -92,6 +93,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log
-          sourcetype: ollama:server
           source: server.log
+          sourcetype: ollama:server
       test_type: unit
diff --git a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml
index 524253871e7..3b5d514fddc 100644
--- a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml
+++ b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml
@@ -6,11 +6,10 @@ modification_date: '2026-10-09'
 author: Rod Soto, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks.
+description: Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks.
 data_source:
     - Ollama Server
-search: |-
+search: |
     `ollama_server`
     "[GIN]"
 
@@ -44,34 +43,35 @@ search: |-
             status_codes severity attack_type
 
     | `ollama_possible_api_endpoint_scan_reconnaissance_filter`
-how_to_implement: |-
-    Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.
-known_false_positives: |-
-    Legitimate web application clients or mobile apps that access multiple API endpoints as part of normal functionality, monitoring and health check systems probing various endpoints for availability, load balancers performing health checks across different paths, API testing frameworks during development and QA processes, or users navigating through web interfaces that trigger multiple API calls may generate similar patterns during normal operations.
+how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
+known_false_positives: Legitimate web application clients or mobile apps that access multiple API endpoints as part of normal functionality, monitoring and health check systems probing various endpoints for availability, load balancers performing health checks across different paths, API testing frameworks during development and QA processes, or users navigating through web interfaces that trigger multiple API calls may generate similar patterns during normal operations.
 references:
     - https://github.com/rosplk/ta-ollama
 drilldown_searches:
     - name: View the detection results for - "$src$"
-      search: |-
-        %original_detection_search%
-        | search src="$src$"
+      search: '%original_detection_search%
+
+        | search src="$src$"'
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
     - name: View risk events for the last 7 days for - "$src$"
-      search: |-
-        from datamodel Risk.All_Risk
+      search: 'from datamodel Risk.All_Risk
+
         | search normalized_risk_object IN ("$src$")
+
         | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object
+
         | `security_content_ctime(firstTime)`
-        | `security_content_ctime(lastTime)`
+
+        | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
           type: system
           score: 20
-          message: 'Possible API reconnaissance from [$src$] on [$host$] with [$total_requests$] requests across [$distinct_endpoints$] endpoints ([$endpoints$]) using methods [$methods$] and receiving status codes [$status_codes$].'
+          message: Possible API reconnaissance from [$src$] on [$host$] with [$total_requests$] requests across [$distinct_endpoints$] endpoints ([$endpoints$]) using methods [$methods$] and receiving status codes [$status_codes$].
 analytic_story:
     - Suspicious Ollama Activities
 asset_type: Web Application
@@ -87,6 +87,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log
-          sourcetype: ollama:server
           source: server.log
+          sourcetype: ollama:server
       test_type: unit
diff --git a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml
index a124408fcbb..fe6c5943452 100644
--- a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml
+++ b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml
@@ -6,11 +6,10 @@ modification_date: '2026-10-09'
 author: Rod Soto, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |-
-    Identifies high Ollama runner counts and large model buffer allocations as possible resource pressure indicators. Memory values vary with model size and hardware, and these operational logs do not establish malicious intent; validate against host capacity and workload baselines.
+description: Identifies high Ollama runner counts and large model buffer allocations as possible resource pressure indicators. Memory values vary with model size and hardware, and these operational logs do not establish malicious intent; validate against host capacity and workload baselines.
 data_source:
     - Ollama Server
-search: |-
+search: |
     `ollama_server`
     ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*")
 
@@ -45,28 +44,29 @@ search: |-
             avg_load_time max_load_time severity attack_type
 
     | `ollama_possible_memory_exhaustion_resource_abuse_filter`
-how_to_implement: |-
-    Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.
-known_false_positives: |-
-    Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations.
+how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
+known_false_positives: Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations.
 references:
     - https://github.com/rosplk/ta-ollama
 drilldown_searches:
     - name: View the detection results for - "$host$"
-      search: |-
-        %original_detection_search%
-        | search host="$host$"
+      search: '%original_detection_search%
+
+        | search host="$host$"'
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
     - name: View risk events for the last 7 days for - "$host$"
-      search: |-
-        from datamodel Risk.All_Risk
+      search: 'from datamodel Risk.All_Risk
+
         | search normalized_risk_object IN ("$host$")
+
         | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object
+
         | `security_content_ctime(firstTime)`
-        | `security_content_ctime(lastTime)`
+
+        | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
@@ -88,6 +88,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log
-          sourcetype: ollama:server
           source: server.log
+          sourcetype: ollama:server
       test_type: unit
diff --git a/detections/application/ollama_repeated_application_errors.yml b/detections/application/ollama_repeated_application_errors.yml
index 0dd0538dec1..06d29521544 100644
--- a/detections/application/ollama_repeated_application_errors.yml
+++ b/detections/application/ollama_repeated_application_errors.yml
@@ -6,11 +6,10 @@ modification_date: '2026-10-09'
 author: Rod Soto, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects repeated Ollama application error events as a possible availability issue. Ollama application logs do not reliably record process termination, so this search cannot confirm a service crash without operating system or service manager telemetry.
+description: Detects repeated Ollama application error events as a possible availability issue. Ollama application logs do not reliably record process termination, so this search cannot confirm a service crash without operating system or service manager telemetry.
 data_source:
     - Ollama Server
-search: |-
+search: |
     `ollama_server`
     (level=ERROR OR level=FATAL)
 
@@ -38,28 +37,29 @@ search: |-
             unique_errors error_messages severity attack_type
 
     | `ollama_repeated_application_errors_filter`
-how_to_implement: |-
-    Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.
-known_false_positives: |-
-    Recoverable model load failures, temporary registry or network errors, resource constraints, and other repeated application errors may trigger this exploratory signal without causing a service outage.
+how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
+known_false_positives: Recoverable model load failures, temporary registry or network errors, resource constraints, and other repeated application errors may trigger this exploratory signal without causing a service outage.
 references:
     - https://github.com/rosplk/ta-ollama
 drilldown_searches:
     - name: View the detection results for - "$host$"
-      search: |-
-        %original_detection_search%
-        | search host="$host$"
+      search: '%original_detection_search%
+
+        | search host="$host$"'
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
     - name: View risk events for the last 7 days for - "$host$"
-      search: |-
-        from datamodel Risk.All_Risk
+      search: 'from datamodel Risk.All_Risk
+
         | search normalized_risk_object IN ("$host$")
+
         | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object
+
         | `security_content_ctime(firstTime)`
-        | `security_content_ctime(lastTime)`
+
+        | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
@@ -80,6 +80,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log
-          sourcetype: ollama:server
           source: app.log
+          sourcetype: ollama:server
       test_type: unit
diff --git a/detections/application/pingid_mismatch_auth_source_and_verification_response.yml b/detections/application/pingid_mismatch_auth_source_and_verification_response.yml
index ae4cd21a6b3..d54e23bcfd0 100644
--- a/detections/application/pingid_mismatch_auth_source_and_verification_response.yml
+++ b/detections/application/pingid_mismatch_auth_source_and_verification_response.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies discrepancies between the IP address of an authentication event and the IP address of the verification response event, focusing on differences in the originating countries. It leverages JSON logs from PingID, comparing the 'auth_Country' and 'verify_Country' fields. This activity is significant as it may indicate suspicious sign-in behavior, such as account compromise or unauthorized access attempts. If confirmed malicious, this could allow attackers to bypass authentication mechanisms, potentially leading to unauthorized access to sensitive systems and data.
 data_source:
     - PingID
-search: "`pingid` (\"result.status\" IN (\"SUCCESS*\",\"FAIL*\",\"UNSUCCESSFUL*\" ) NOT \"result.message\" IN (\"*pair*\",\"*create*\",\"*delete*\")) | eval user = upper('actors{}.name'), session_id = 'resources{}.websession', dest = 'resources{}.ipaddress', reason = 'result.message', object = 'resources{}.devicemodel', status = 'result.status' | join user session_id [ search `pingid` (\"result.status\" IN (\"POLICY\") AND \"resources{}.ipaddress\"=*) AND \"result.message\" IN(\"*Action: Authenticate*\",\"*Action: Approve*\",\"*Action: Allowed*\") | rex field=result.message \"IP Address: (?:N\\/A)?(?<policy_ipaddress>.+)?\\n\" | rex field=result.message \"Action: (?:N\\/A)?(?<signature>.+)?\\n\" | rex field=result.message \"Requested Application Name: (?:N\\/A)?(?<Requested_Application_Name>.+)?\\n\" | rex field=result.message \" Requested Application ID: (?:N\\/A)?(?<Requested_Application_ID>.+)?\\n\" | eval user = upper('actors{}.name'), session_id = 'resources{}.websession', src = coalesce('resources{}.ipaddress',policy_ipaddress), app = coalesce(Requested_Application_ID,Requested_Application_Name) | fields app, user, session_id, src, signature ] | iplocation prefix=auth_ dest | iplocation prefix=verify_ src | stats count min(_time) as firstTime max(_time) as lastTime values(app) as app values(session_id) as session_id by user, dest, auth_Country, src, verify_Country, object, signature, status, reason | where auth_Country != verify_Country | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `pingid_mismatch_auth_source_and_verification_response_filter`"
+search: |
+    `pingid` ("result.status" IN ("SUCCESS*","FAIL*","UNSUCCESSFUL*" ) NOT "result.message" IN ("*pair*","*create*","*delete*")) | eval user = upper('actors{}.name'), session_id = 'resources{}.websession', dest = 'resources{}.ipaddress', reason = 'result.message', object = 'resources{}.devicemodel', status = 'result.status' | join user session_id [ search `pingid` ("result.status" IN ("POLICY") AND "resources{}.ipaddress"=*) AND "result.message" IN("*Action: Authenticate*","*Action: Approve*","*Action: Allowed*") | rex field=result.message "IP Address: (?:N\/A)?(?<policy_ipaddress>.+)?\n" | rex field=result.message "Action: (?:N\/A)?(?<signature>.+)?\n" | rex field=result.message "Requested Application Name: (?:N\/A)?(?<Requested_Application_Name>.+)?\n" | rex field=result.message " Requested Application ID: (?:N\/A)?(?<Requested_Application_ID>.+)?\n" | eval user = upper('actors{}.name'), session_id = 'resources{}.websession', src = coalesce('resources{}.ipaddress',policy_ipaddress), app = coalesce(Requested_Application_ID,Requested_Application_Name) | fields app, user, session_id, src, signature ] | iplocation prefix=auth_ dest | iplocation prefix=verify_ src | stats count min(_time) as firstTime max(_time) as lastTime values(app) as app values(session_id) as session_id by user, dest, auth_Country, src, verify_Country, object, signature, status, reason | where auth_Country != verify_Country | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `pingid_mismatch_auth_source_and_verification_response_filter`
 how_to_implement: Target environment must ingest JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription.
 known_false_positives: False positives may be generated by users working out the geographic region where the organizations services or technology is hosted.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An authentication by [$user$] was detected from [$dest$ - $auth_Country$] and the verification was received from [$src$ - $verify_Country$].
     entity:
diff --git a/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml b/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml
index 4ba9623ba5f..39a2397d6c4 100644
--- a/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml
+++ b/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within a PingID environment. It triggers when 10 or more MFA prompts fail within 10 minutes, using JSON logs from PingID. This activity is significant as it may indicate an adversary attempting to bypass MFA by bombarding the user with repeated authentication requests. If confirmed malicious, this could lead to unauthorized access, as the user might eventually accept the fraudulent request, compromising the security of the account and potentially the entire network.
 data_source:
     - PingID
-search: "`pingid` \"result.status\" IN (\"FAILURE,authFail\",\"UNSUCCESSFUL_ATTEMPT\") | eval time = _time, src = coalesce('resources{}.ipaddress','resources{}.devicemodel'), user = upper('actors{}.name'), object = 'resources{}.devicemodel', reason = 'result.message'| bucket span=10m _time | stats dc(_raw) AS mfa_prompts min(time) as firstTime, max(time) as lastTime values(src) as src by user, reason, _time | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | where mfa_prompts >= 10 | `pingid_multiple_failed_mfa_requests_for_user_filter`"
+search: |
+    `pingid` "result.status" IN ("FAILURE,authFail","UNSUCCESSFUL_ATTEMPT") | eval time = _time, src = coalesce('resources{}.ipaddress','resources{}.devicemodel'), user = upper('actors{}.name'), object = 'resources{}.devicemodel', reason = 'result.message'| bucket span=10m _time | stats dc(_raw) AS mfa_prompts min(time) as firstTime, max(time) as lastTime values(src) as src by user, reason, _time | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | where mfa_prompts >= 10 | `pingid_multiple_failed_mfa_requests_for_user_filter`
 how_to_implement: Target environment must ingest JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription.
 known_false_positives: False positives may be generated by normal provisioning workflows for user device registration.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Multiple Failed MFA requests $mfa_prompts$ for user $user$ between $firstTime$ and $lastTime$.
     entity:
diff --git a/detections/application/pingid_new_mfa_method_after_credential_reset.yml b/detections/application/pingid_new_mfa_method_after_credential_reset.yml
index 7b0097d43ca..9de32f573a1 100644
--- a/detections/application/pingid_new_mfa_method_after_credential_reset.yml
+++ b/detections/application/pingid_new_mfa_method_after_credential_reset.yml
@@ -6,10 +6,11 @@ modification_date: '2026-09-29'
 author: Steven Dick
 status: production
 type: TTP
-description: |-
-    The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes
+description: 'The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes
+
     (EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user
-    to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures.
+
+    to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures.'
 data_source:
     - PingID
 search: |
@@ -48,10 +49,8 @@ search: |
     | fields - join_user
 
     | `pingid_new_mfa_method_after_credential_reset_filter`
-how_to_implement: |-
-    Target environment must ingest Windows Event Log and PingID(PingOne) data sources. Specifically from logs from Active Directory Domain Controllers and JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription.
-known_false_positives: |-
-    False positives may be generated by normal provisioning workflows that generate a password reset followed by a device registration.
+how_to_implement: Target environment must ingest Windows Event Log and PingID(PingOne) data sources. Specifically from logs from Active Directory Domain Controllers and JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription.
+known_false_positives: False positives may be generated by normal provisioning workflows that generate a password reset followed by a device registration.
 references:
     - https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/defend-your-users-from-mfa-fatigue-attacks/ba-p/2365677
     - https://www.bleepingcomputer.com/news/security/mfa-fatigue-hackers-new-favorite-tactic-in-high-profile-breaches/
@@ -66,7 +65,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An MFA configuration change was detected for [$user$] within [$timeDiff$] of a password reset. The device [$object$] was [$action$].
     entity:
diff --git a/detections/application/pingid_new_mfa_method_registered_for_user.yml b/detections/application/pingid_new_mfa_method_registered_for_user.yml
index f9c2162aa7f..be8bec86ea5 100644
--- a/detections/application/pingid_new_mfa_method_registered_for_user.yml
+++ b/detections/application/pingid_new_mfa_method_registered_for_user.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for a PingID (PingOne) account. It leverages JSON logs from PingID, specifically looking for successful device pairing events. This activity is significant as adversaries who gain unauthorized access to a user account may register a new MFA method to maintain persistence. If confirmed malicious, this could allow attackers to bypass existing security measures, maintain long-term access, and potentially escalate their privileges within the compromised environment.
 data_source:
     - PingID
-search: "`pingid` \"result.message\"=\"Device Paired*\" result.status=\"SUCCESS\"   | rex field=result.message \"Device (Unp)?(P)?aired (?<device_extract>.+)\" | eval src = coalesce('resources{}.ipaddress','resources{}.devicemodel'), user = upper('actors{}.name'), reason = 'result.message' | eval object=CASE(ISNOTNULL('resources{}.devicemodel'),'resources{}.devicemodel',true(),device_extract) | eval action=CASE(match('result.message',\"Device Paired*\"),\"created\",match('result.message', \"Device Unpaired*\"),\"deleted\") | stats count min(_time) as firstTime, max(_time) as lastTime by src,user,object,action,reason | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `pingid_new_mfa_method_registered_for_user_filter`"
+search: |
+    `pingid` "result.message"="Device Paired*" result.status="SUCCESS"   | rex field=result.message "Device (Unp)?(P)?aired (?<device_extract>.+)" | eval src = coalesce('resources{}.ipaddress','resources{}.devicemodel'), user = upper('actors{}.name'), reason = 'result.message' | eval object=CASE(ISNOTNULL('resources{}.devicemodel'),'resources{}.devicemodel',true(),device_extract) | eval action=CASE(match('result.message',"Device Paired*"),"created",match('result.message', "Device Unpaired*"),"deleted") | stats count min(_time) as firstTime, max(_time) as lastTime by src,user,object,action,reason | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `pingid_new_mfa_method_registered_for_user_filter`
 how_to_implement: Target environment must ingest JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription.
 known_false_positives: False positives may be generated by normal provisioning workflows for user device registration.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An MFA configuration change was detected for [$user$], the device [$object$] was $action$.
     entity:
diff --git a/detections/application/ptc_windchill_gateway_command_execution.yml b/detections/application/ptc_windchill_gateway_command_execution.yml
index eb2192745f9..c25cba78724 100644
--- a/detections/application/ptc_windchill_gateway_command_execution.yml
+++ b/detections/application/ptc_windchill_gateway_command_execution.yml
@@ -6,13 +6,14 @@ modification_date: '2026-06-14'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects Windchill MethodServer log4j events showing suspicious `c=` command execution or `p=` file read parameters sent to Windchill gateway paths associated with CVE-2026-4681 exploitation.
+description: 'This analytic detects Windchill MethodServer log4j events showing suspicious `c=` command execution or `p=` file read parameters sent to Windchill gateway paths associated with CVE-2026-4681 exploitation.
+
     PTC identifies `run?c=`, `run?p=`, `.jsp?c=`, and `.jsp?p=` request patterns as indicators to monitor during Windchill and FlexPLM exploitation response.
-    Successful activity may allow an unauthenticated attacker to execute operating system commands or read files through a weaponized gateway or JSP component.
+
+    Successful activity may allow an unauthenticated attacker to execute operating system commands or read files through a weaponized gateway or JSP component.'
 data_source:
     - Windchill Log4j
-search: |-
+search: |
     `windchill_log4j`
     ("WindchillGW/GW/run" OR "WindchillAuthGW/GW/run" OR "/GW/run?" OR "run?c=" OR "run?p=" OR ".jsp?c=" OR ".jsp?p=" OR "dpr_")
     | rex field=_raw "^(?:[^:\r\n]+:)?(?<log_ts>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2},\d{3})\s+(?<log_level>\w+)\s+\[(?<thread>[^\]]+)\]\s+(?<logger>\S+)\s+-\s+(?<payload>.*)$"
@@ -49,13 +50,14 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `ptc_windchill_gateway_command_execution_filter`
-how_to_implement: |
-    To implement this analytic, ingest PTC Windchill MethodServer log4j logs into Splunk with sourcetype `log4j`.
+how_to_implement: 'To implement this analytic, ingest PTC Windchill MethodServer log4j logs into Splunk with sourcetype `log4j`.
+
     Update the `windchill_log4j` macro to include the appropriate index constraints for your environment.
-    The analytic expects log entries from the `wt.servlet.ServletRequestMonitor.request` and `wt.method.MethodContextMonitor.contexts.servletRequest` loggers and parses embedded servlet URI, query parameter, source IP, HTTP method, and status fields.
-known_false_positives: |
-    Requests to `GW/run` or randomly named `dpr_<8 hex>.jsp` files with `c=` or `p=` parameters should not be expected during normal Windchill operation.
-    Validate whether red-team testing, vulnerability scanning, or incident response replay generated the activity before closing as benign.
+
+    The analytic expects log entries from the `wt.servlet.ServletRequestMonitor.request` and `wt.method.MethodContextMonitor.contexts.servletRequest` loggers and parses embedded servlet URI, query parameter, source IP, HTTP method, and status fields.'
+known_false_positives: 'Requests to `GW/run` or randomly named `dpr_<8 hex>.jsp` files with `c=` or `p=` parameters should not be expected during normal Windchill operation.
+
+    Validate whether red-team testing, vulnerability scanning, or incident response replay generated the activity before closing as benign.'
 references:
     - https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability
     - https://nvd.nist.gov/vuln/detail/CVE-2026-4681
@@ -68,7 +70,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/application/ptc_windchill_gw_ready_ok_probe.yml b/detections/application/ptc_windchill_gw_ready_ok_probe.yml
index 9685e478de3..712a7946591 100644
--- a/detections/application/ptc_windchill_gw_ready_ok_probe.yml
+++ b/detections/application/ptc_windchill_gw_ready_ok_probe.yml
@@ -6,13 +6,14 @@ modification_date: '2026-06-14'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects Windchill MethodServer log4j events that contain the CVE-2026-4681 exploitation probe `run?c=echo%20GW_READY_OK`.
+description: 'This analytic detects Windchill MethodServer log4j events that contain the CVE-2026-4681 exploitation probe `run?c=echo%20GW_READY_OK`.
+
     PTC identifies `GW_READY_OK` and related `run?c=` activity as log indicators associated with Windchill and FlexPLM exploitation.
-    This behavior is significant because attackers use the probe to confirm that a staged gateway component is reachable before sending operating system commands through the same `c=` parameter.
+
+    This behavior is significant because attackers use the probe to confirm that a staged gateway component is reachable before sending operating system commands through the same `c=` parameter.'
 data_source:
     - Windchill Log4j
-search: |-
+search: |
     `windchill_log4j`
     ("GW_READY_OK" OR "run?c=echo%20GW_READY_OK" OR "c=echo%20GW_READY_OK")
     | rex field=_raw "^(?:[^:\r\n]+:)?(?<log_ts>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2},\d{3})\s+(?<log_level>\w+)\s+\[(?<thread>[^\]]+)\]\s+(?<logger>\S+)\s+-\s+(?<payload>.*)$"
@@ -46,12 +47,12 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `ptc_windchill_gw_ready_ok_probe_filter`
-how_to_implement: |
-    To implement this analytic, ingest PTC Windchill MethodServer log4j logs into Splunk with sourcetype `log4j`.
+how_to_implement: 'To implement this analytic, ingest PTC Windchill MethodServer log4j logs into Splunk with sourcetype `log4j`.
+
     Update the `windchill_log4j` macro to include the appropriate index constraints for your environment.
-    The analytic expects log entries from the `wt.servlet.ServletRequestMonitor.request` and `wt.method.MethodContextMonitor.contexts.servletRequest` loggers.
-known_false_positives: |
-    This probe string is specific to the PTC-published Windchill exploitation indicators. False positives should be rare. Validate whether any internal testing, incident response activity, or vendor diagnostics intentionally generated `GW_READY_OK` requests.
+
+    The analytic expects log entries from the `wt.servlet.ServletRequestMonitor.request` and `wt.method.MethodContextMonitor.contexts.servletRequest` loggers.'
+known_false_positives: This probe string is specific to the PTC-published Windchill exploitation indicators. False positives should be rare. Validate whether any internal testing, incident response activity, or vendor diagnostics intentionally generated `GW_READY_OK` requests.
 references:
     - https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerability
     - https://nvd.nist.gov/vuln/detail/CVE-2026-4681
@@ -64,7 +65,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/application/splunk_appdynamics_secure_application_alerts.yml b/detections/application/splunk_appdynamics_secure_application_alerts.yml
index 5ef88e4deda..9a8fa08b62c 100644
--- a/detections/application/splunk_appdynamics_secure_application_alerts.yml
+++ b/detections/application/splunk_appdynamics_secure_application_alerts.yml
@@ -6,44 +6,28 @@ modification_date: '2026-05-13'
 author: Ryan Long, Bhavin Patel, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic is to leverage alerts from Splunk AppDynamics SecureApp, which identifies and monitors exploit attempts targeting business applications. The primary attack observed involves exploiting vulnerabilities in web applications, including injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution attempts, LOG4J and zero day attacks. These attacks are typically aimed at gaining unauthorized access, exfiltrating sensitive data, or disrupting application functionality.
+description: 'The following analytic is to leverage alerts from Splunk AppDynamics SecureApp, which identifies and monitors exploit attempts targeting business applications. The primary attack observed involves exploiting vulnerabilities in web applications, including injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution attempts, LOG4J and zero day attacks. These attacks are typically aimed at gaining unauthorized access, exfiltrating sensitive data, or disrupting application functionality.
+
 
     Splunk AppDynamics SecureApp provides real-time detection of these threats by analyzing application-layer events and correlating attack behavior with known vulnerability signatures. This detection methodology helps the Security Operations Center (SOC) by:
 
+
     * Identifying active exploitation attempts in real-time, allowing for quicker incident response.
+
     * Categorizing attack severity to prioritize remediation efforts based on risk level.
+
     * Providing visibility into attacker tactics, including source IP, attack techniques, and affected applications.
+
     * Generating risk-based scoring and contextual alerts to enhance decision-making within SOC workflows.
+
     * Helping analysts determine whether an attack was merely an attempt or if it successfully exploited a vulnerability.
 
-    By leveraging this information, SOC teams can proactively mitigate security threats, patch vulnerable applications, and enforce security controls to prevent further exploitation.
+
+    By leveraging this information, SOC teams can proactively mitigate security threats, patch vulnerable applications, and enforce security controls to prevent further exploitation.'
 data_source:
     - Splunk AppDynamics Secure Application Alert
-search: |-
-    `appdynamics_security`  blocked=false
-    | rename attackEvents{}.* AS *, detailJson.* AS *, vulnerabilityInfo.* AS *
-    | fields - tag::eventtype, eventtype, host, id, index, linecount, punct, source, sourcetype, splunk_server, tag, SourceType, app clientAddressType, application, tier, "attackEvents{}.* status"
-    | eval socketOut=mvjoin(socketOut," AND ")
-    | eval risk_score=kennaScore
-    | fillnull risk_score value="0"
-    `secureapp_es_field_mappings`
-    | stats values(*) as * by attackId
-    | eval severity=case(
-        risk_score>=100 OR signature="LOG4J", "critical",
-        risk_score>50 AND risk_score<75, "high",
-        risk_score=0 AND attackOutcome="EXPLOITED", "high",
-        risk_score<=50 AND attackOutcome!="OBSERVED", "medium",
-        risk_score=0 AND attackOutcome="ATTEMPTED", "medium",
-        risk_score=0, "low",
-        risk_score=0 AND attackOutcome="OBSERVED", "low"
-        )
-    | eval risk_message=case(
-      (signature="API" OR signature="LOG4J" OR signature="SSRF"), "An attempt to exploit a ".signature." vulnerability was made from a ".src_category." IP address ".src_ip.". The server ".dest_nt_host." hosting application ".app_name." was accessed, and data may have been exfiltrated to ".socketOut.".",
-      (signature="MALIP" OR signature="SQL"), "A vulnerability is being ".attackOutcome." from a ".src_category." IP address ".src_ip.". The server ".dest_nt_host." hosting application ".app_name." was accessed.",
-      (signature="DESEREAL"), "The application ".app_name." deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Data which is untrusted cannot be trusted to be well-formed. Malformed data or unexpected data could be used to abuse application logic, deny service, or execute arbitrary code, when deserialized."
-      )
-    | `splunk_appdynamics_secure_application_alerts_filter`
+search: |
+    `appdynamics_security` blocked="false" | eval risk_message=risk_message | stats count min(_time) as firstTime max(_time) as lastTime by blocked app_name src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_appdynamics_secure_application_alerts_filter`
 how_to_implement: In order to properly run this search, you need to ingest alerts data from AppD SecureApp, specifically ingesting data via HEC. You will also need to ensure that the data is going to sourcetype - `appdynamics_security`. You will need to install the Splunk Add-on for AppDynamics.
 known_false_positives: No known false positives for this detection. If the alerts are noisy, consider tuning this detection by using the _filter macro in this search, and/or updating the tool this alert originates from.
 references:
@@ -56,7 +40,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$app_name$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$app_name$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: app_name
@@ -80,7 +64,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/alerts/cisco_secure_app_alerts.log
-          sourcetype: appdynamics_security
           source: AppDynamics Security
+          sourcetype: appdynamics_security
       description: PORTED MANUAL TEST - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. Setting these to manual test since otherwise we fail integration testing. The detection is also failing on unit-testing as some of the fields set in the observables are empty.
       test_type: experimental
diff --git a/detections/application/splunk_authentication_token_exposure_in_debug_log.yml b/detections/application/splunk_authentication_token_exposure_in_debug_log.yml
index d056f65a607..9fb479bd2e7 100644
--- a/detections/application/splunk_authentication_token_exposure_in_debug_log.yml
+++ b/detections/application/splunk_authentication_token_exposure_in_debug_log.yml
@@ -6,13 +6,15 @@ modification_date: '2026-06-24'
 author: Rod Soto, Chase Franklin
 status: production
 type: TTP
-description: |-
-    The following analytic identifies exposed authentication tokens in debug logs within Splunk Enterprise.
+description: 'The following analytic identifies exposed authentication tokens in debug logs within Splunk Enterprise.
+
     It leverages logs from the `splunkd` component with a DEBUG log level, specifically searching for event messages that validate tokens. This activity is significant because exposed tokens can be exploited by attackers to gain unauthorized access to the Splunk environment.
+
     If confirmed malicious, this exposure could lead to unauthorized data access, privilege escalation, and potential compromise of the entire Splunk infrastructure.
-    Monitoring and addressing this vulnerability is crucial for maintaining the security and integrity of the Splunk deployment.
+
+    Monitoring and addressing this vulnerability is crucial for maintaining the security and integrity of the Splunk deployment.'
 data_source: []
-search: |-
+search: |
     `splunkd`
     component=JsonWebToken
     log_level=DEBUG
@@ -56,8 +58,8 @@ mitre_attack_id:
     - T1654
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: application
 security_domain: endpoint
 tests:
diff --git a/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml b/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml
index 21114c3d1f2..2495e5da7f0 100644
--- a/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml
+++ b/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: In Splunk Enterprise for Windows versions below 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the “admin” or “power”  Splunk roles could write a file to the Windows system root directory, which has a default location of C:\Windows\System32, when Splunk Enterprise for Windows is installed on a separate drive. Additionally, this user may be able to upload and execute code due to insecure session storage configuration
 data_source:
     - Splunk
-search: |-
+search: |
     ```Each exploit attempt abuses the following endpoint. A request to the endpoint MUST occur immediately before the App Creation Message. However, this endpoint does not expose the name of the app that was created```
     `splunkda` status=200 uri_path="*/search/apps/local/_new"
     | bin _time span=1m | stats count by _time, user
@@ -55,26 +55,26 @@ tests:
     - name: True Positive Test SVD 1001
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1001-index_internal_sourcetype_splunkd.log
-          sourcetype: splunkd
           source: D:\\Program Files\\Splunk\\var\\log\\splunk\\splunkd.log
+          sourcetype: splunkd
           index: _internal
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1001-index_internal_sourcetype_splunkd_access.log
-          sourcetype: splunkd_access
           source: D:\\Program Files\\Splunk\\var\\log\\splunk\\splunkd_access.log
+          sourcetype: splunkd_access
           index: _internal
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1001-index_internal_sourcetype_splunk_python.log
-          sourcetype: splunk_python
           source: D:\\Program Files\\Splunk\\var\\log\\splunk\\python.log
+          sourcetype: splunk_python
           index: _internal
       test_type: unit
     - name: True Positive Test SVD 1003
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1003-index_internal_sourcetype_splunkd_access.log
-          sourcetype: splunkd_access
           source: C:\\Program Files\\Splunk\\var\\log\\splunk\\splunkd_access.log
+          sourcetype: splunkd_access
           index: _internal
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1003-index_internal_sourcetype_splunk_python.log
-          sourcetype: splunk_python
           source: C:\\Program Files\\Splunk\\var\\log\\splunk\\python.log
+          sourcetype: splunk_python
           index: _internal
       test_type: unit
diff --git a/detections/application/splunk_rce_via_user_xslt.yml b/detections/application/splunk_rce_via_user_xslt.yml
index 3f97d778283..8d8d3a77baf 100644
--- a/detections/application/splunk_rce_via_user_xslt.yml
+++ b/detections/application/splunk_rce_via_user_xslt.yml
@@ -8,7 +8,8 @@ status: production
 type: Hunting
 description: The following analytic identifies potential remote code execution (RCE) attempts via user-supplied Extensible Stylesheet Language Transformations (XSLT) in Splunk versions 9.1.x. It detects this activity by analyzing `splunkd_ui` logs for specific URI patterns and status codes indicative of XSLT injection attempts. This activity is significant because successful exploitation could allow an attacker to execute arbitrary code on the Splunk server. If confirmed malicious, this could lead to full system compromise, unauthorized data access, and further lateral movement within the network.
 data_source: []
-search: '`splunkd_ui` ((uri="*NO_BINARY_CHECK=1*" AND "*input.path=*.xsl*") OR uri="*dispatch*.xsl*") AND uri!= "*splunkd_ui*" | rex field=uri "(?<string>=\s*([\S\s]+))" | eval decoded_field=urldecode(string) | eval action=case(match(status,"200"),"Allowed",match(status,"303|500|401|403|404|301|406"),"Blocked",1=1,"Unknown") | stats count min(_time) as firstTime max(_time) as lastTime by clientip useragent uri decoded_field action host | rename clientip as src, uri as dest_uri | iplocation src | fillnull value="N/A" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime, lastTime src, useragent, action, count, Country, Region, City, dest_uri, decoded_field | `splunk_rce_via_user_xslt_filter`'
+search: |
+    `splunkd_ui` ((uri="*NO_BINARY_CHECK=1*" AND "*input.path=*.xsl*") OR uri="*dispatch*.xsl*") AND uri!= "*splunkd_ui*" | rex field=uri "(?<string>=\s*([\S\s]+))" | eval decoded_field=urldecode(string) | eval action=case(match(status,"200"),"Allowed",match(status,"303|500|401|403|404|301|406"),"Blocked",1=1,"Unknown") | stats count min(_time) as firstTime max(_time) as lastTime by clientip useragent uri decoded_field action host | rename clientip as src, uri as dest_uri | iplocation src | fillnull value="N/A" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime, lastTime src, useragent, action, count, Country, Region, City, dest_uri, decoded_field | `splunk_rce_via_user_xslt_filter`
 how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index.
 known_false_positives: This search will provide information for investigation and hunting possible abuse of user-supplied XSLT. There may be false positives and results should individually evaluated. Please evaluate the source IP and useragent responsible for creating the requests.
 references:
diff --git a/detections/application/splunk_secure_application_alerts_for_runtime_security.yml b/detections/application/splunk_secure_application_alerts_for_runtime_security.yml
index 7a9a439215f..fe1a69c1689 100644
--- a/detections/application/splunk_secure_application_alerts_for_runtime_security.yml
+++ b/detections/application/splunk_secure_application_alerts_for_runtime_security.yml
@@ -6,20 +6,26 @@ modification_date: '2026-06-12'
 author: Ryan Long, Bhavin Patel, Bryan Pluta, Splunk
 status: experimental
 type: Anomaly
-description: |
-    The following analytic leverages alerts from Splunk Secure Application, which identifies and monitors exploit attempts targeting business applications. Attacks observed include exploiting vulnerabilities in web applications, such as injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution, LOG4J, and zero-day attacks. These events are typically aimed at gaining unauthorized access, exfiltrating sensitive data, or disrupting application functionality.
+description: 'The following analytic leverages alerts from Splunk Secure Application, which identifies and monitors exploit attempts targeting business applications. Attacks observed include exploiting vulnerabilities in web applications, such as injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution, LOG4J, and zero-day attacks. These events are typically aimed at gaining unauthorized access, exfiltrating sensitive data, or disrupting application functionality.
+
 
     Splunk Secure Application provides real-time detection of these threats by analyzing application-layer events and correlating attack behavior with known vulnerability signatures. This detection methodology helps the Security Operations Center (SOC) by:
 
+
     * Identifying active exploitation attempts in real-time, allowing for quicker incident response.
+
     * Categorizing attack severity to prioritize remediation efforts based on risk level.
+
     * Providing visibility into attacker tactics, including source IP, attack techniques, and affected applications.
+
     * Generating risk-based scoring and contextual alerts to enhance decision-making within SOC workflows.
+
     * Helping analysts determine whether an attack was merely an attempt or if it successfully exploited a vulnerability.
 
-    By leveraging this information, SOC teams can proactively mitigate security threats, patch vulnerable applications, and enforce security controls to prevent further exploitation.
+
+    By leveraging this information, SOC teams can proactively mitigate security threats, patch vulnerable applications, and enforce security controls to prevent further exploitation.'
 data_source: []
-search: |-
+search: |
     `secureapp_attack`
     | rename attackEvents{}.* AS *, detailJson.* AS *, vulnerabilityInfo.* AS *
     | fields - tag::eventtype, eventtype, host, id, index, linecount, punct, source, sourcetype, splunk_server, tag, SourceType, app, clientAddressType, "attackEvents{}.* status"
@@ -43,12 +49,9 @@ search: |-
         (signature="SQL"), "IP address ".src_ip." has attempted a SQL injection via ".src_category.". The server ".dest_nt_host." hosting application ".app." may have executed this SQL statement and should be reviewed.",
         (signature="DESEREAL"), "The application ".app." deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Data which is untrusted cannot be trusted to be well-formed. Malformed data or unexpected data could be used to abuse application logic, deny service, or execute arbitrary code, when deserialized.",
         (signature="RCE"),  "An attacker tried to perform Remote Code Execution by running the command ".command." in the ".file_path." directory. The server ".dest_nt_host." hosting application ".app."  ".action." this command."
-    )
-    | `splunk_secure_application_alerts_for_runtime_security_filter`
-how_to_implement: |
-    Create the secureapp_attack sourcetype in Splunk Enterprise Security. Configure Splunk Enterprise Security to receive alerts for Observability Cloud via HEC. Configure Secure Application Alerts in Observability Cloud to send alerts to Enterprise Security. Full details can be found in the referenced lantern article.
-known_false_positives: |
-    No known false positives for this detection. If alerts are noisy, tune this detection with the `_filter` macro or configure the originating tool.
+    ) dest_ip | `splunk_secure_application_alerts_for_runtime_security_filter`
+how_to_implement: Create the secureapp_attack sourcetype in Splunk Enterprise Security. Configure Splunk Enterprise Security to receive alerts for Observability Cloud via HEC. Configure Secure Application Alerts in Observability Cloud to send alerts to Enterprise Security. Full details can be found in the referenced lantern article.
+known_false_positives: No known false positives for this detection. If alerts are noisy, tune this detection with the `_filter` macro or configure the originating tool.
 references:
     - https://lantern.splunk.com/@go/page/10379
     - https://help.splunk.com/en/splunk-observability-cloud/monitor-application-security/set-up-secure-application/step-1-set-up-notifications-for-vulnerabilities
@@ -60,7 +63,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest_ip
@@ -84,8 +87,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/alerts/secure_app_alerts_runtime_security.log
-          sourcetype: secureapp_attack
           source: not_applicable
-      description: |
-        MANUAL TEST - We are dynamically creating the risk_score field based on the severity of the alert in the SPL, which supersedes the risk score set in the detection. Set as manual test to avoid integration and unit test failures due to empty fields in observables.
+          sourcetype: secureapp_attack
+      description: MANUAL TEST - We are dynamically creating the risk_score field based on the severity of the alert in the SPL, which supersedes the risk score set in the detection. Set as manual test to avoid integration and unit test failures due to empty fields in observables.
       test_type: experimental
diff --git a/detections/application/splunk_sensitive_information_disclosure_in_debug_logging_channels.yml b/detections/application/splunk_sensitive_information_disclosure_in_debug_logging_channels.yml
index 0667d0860ee..1b4b2222b90 100644
--- a/detections/application/splunk_sensitive_information_disclosure_in_debug_logging_channels.yml
+++ b/detections/application/splunk_sensitive_information_disclosure_in_debug_logging_channels.yml
@@ -9,12 +9,8 @@ type: Hunting
 description: In Splunk versions 9.3, 9.2, 9.1, 9.1.5 Applications which have been enabled with logging level DEBUG may write sensitive information such as keys, tokens, or other sensitive strings into the internal index.
 data_source:
     - Splunk
-search: |-
-    `splunkd` log_level="DEBUG" AND component IN ("REST_Calls", "AdminManager", "JSONWebToken")
-    | stats count min(_time) as firstTime max(_time) as lastTime by host splunk_server log_level component event_message
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `splunk_sensitive_information_disclosure_in_debug_logging_channels_filter`
+search: |
+    `splunkd_ui` log_level="DEBUG" component IN ("REST_Calls", "AdminManager", "JSONWebToken") | stats count min(_time) as firstTime max(_time) as lastTime by log_level component | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_sensitive_information_disclosure_in_debug_logging_channels_filter`
 how_to_implement: Requires access to _internal index. It is recommended to inventory and modify the search for specific apps that may have DEBUG logging enabled.
 known_false_positives: There will be false positives as not every message to the DEBUG log will expose sensitive information, such as keys or other secrets.
 references:
@@ -47,14 +43,14 @@ tests:
     - name: True Positive Test of REST_Calls DEBUG Logging Channel
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/splunk/svd-2024-1008.log
-          sourcetype: splunkd
           source: /opt/splunk/var/log/splunk/splunkd.log
+          sourcetype: splunkd
           index: _internal
       test_type: unit
     - name: True Positive Test of AdminManager DEBUG Logging Channel
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/splunk/svd-2024-1009.log
-          sourcetype: splunkd
           source: /opt/splunk/var/log/splunk/splunkd.log
+          sourcetype: splunkd
           index: _internal
       test_type: unit
diff --git a/detections/application/splunk_user_enumeration_attempt.yml b/detections/application/splunk_user_enumeration_attempt.yml
index c3ddfefac3a..1676c6e7957 100644
--- a/detections/application/splunk_user_enumeration_attempt.yml
+++ b/detections/application/splunk_user_enumeration_attempt.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies attempts to enumerate usernames in Splunk by detecting multiple failed authentication attempts from the same source. It leverages data from the `_audit` index, specifically focusing on failed authentication events. This activity is significant for a SOC because it can indicate an attacker trying to discover valid usernames, which is a precursor to more targeted attacks like password spraying or brute force attempts. If confirmed malicious, this activity could lead to unauthorized access, compromising the security of the Splunk environment and potentially exposing sensitive data.
 data_source:
     - Splunk
-search: '`splunkd_failed_auths` | stats count(user) as auths by user, src | where auths>5 | stats values(user) as user, sum(auths) as TotalFailedAuths by src | `splunk_user_enumeration_attempt_filter`'
+search: |
+    `splunkd_failed_auths` | stats count(user) as auths by user, src | where auths>5 | stats values(user) as user, sum(auths) as TotalFailedAuths by src | `splunk_user_enumeration_attempt_filter`
 how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to find password spraying or brute force authorization attempts in addition to someone enumerating usernames.
 known_false_positives: Automation executing authentication attempts against your Splunk infrastructure with outdated credentials may cause false positives.
 references:
diff --git a/detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml b/detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml
index 68e01783875..6af7dff4228 100644
--- a/detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml
+++ b/detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: This is a composed hunting search that looks for POST requests to splunk_internal_metrics/data/ui/views which can be used to elevate privileges on the Splunk server via custom urls. The way to find privilege escalation is by looking at created users with high privielges after payload has been executed. This search looks at POST request and then looks at created users privileges.
 data_source:
     - Splunk
-search: '`splunkd_ui` method=POST /*/data/ui/views* | stats values(method) as method by _time index, sourcetype, host | eval event="post_request" | append [| search `audittrail` action="edit_user" operation="create" | rex field=_raw "object=\"(?<newUser>.*)\"" | stats count values(operation) as operation values(splunk_server) as splunk_server values(user) as user by _time index, sourcetype, host, newUser | eval event="create_user"] | sort - _time | transaction host startswith=event="post_request" endswith=event="create_user" maxspan=10m | table _time index, sourcetype, host, method, user, splunk_server, operation, event, newUser eventcount | `splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter`'
+search: |
+    `splunkd_ui` method=POST /*/data/ui/views* | stats values(method) as method by _time index, sourcetype, host | eval event="post_request" | append [| search `audittrail` action="edit_user" operation="create" | rex field=_raw "object=\"(?<newUser>.*)\"" | stats count values(operation) as operation values(splunk_server) as splunk_server values(user) as user by _time index, sourcetype, host, newUser | eval event="create_user"] | sort - _time | transaction host startswith=event="post_request" endswith=event="create_user" maxspan=10m | table _time index, sourcetype, host, method, user, splunk_server, operation, event, newUser eventcount | `splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter`
 how_to_implement: Requires access to internal indexes _audit and _internal.
 known_false_positives: This is a hunting search and requires operator to search for specific indicators of user creation in proximity to POST requests against vulnerable endpoint. It is not possible to detect payload during runtime.
 references:
@@ -23,8 +24,8 @@ mitre_attack_id:
     - T1189
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: application
 security_domain: endpoint
 tests:
diff --git a/detections/application/suspicious_email_attachment_extensions.yml b/detections/application/suspicious_email_attachment_extensions.yml
index e0029ba95a0..a1491b346fa 100644
--- a/detections/application/suspicious_email_attachment_extensions.yml
+++ b/detections/application/suspicious_email_attachment_extensions.yml
@@ -22,17 +22,25 @@ search: |
     | lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious
     | search suspicious=true
     | `suspicious_email_attachment_extensions_filter`
-how_to_implement: |
-    You need to ingest data from emails. Specifically, the sender's address and the file names of any attachments must be mapped to the Email data model.
+how_to_implement: 'You need to ingest data from emails. Specifically, the sender''s address and the file names of any attachments must be mapped to the Email data model.
+
     **Splunk Phantom Playbook Integration**\nIf Splunk Phantom is also configured in
+
     your environment, a Playbook called \"Suspicious Email Attachment Investigate and
+
     Delete\" can be configured to run when any results are found by this detection search.
+
     To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`,
+
     and add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response
+
     Actions when configuring this detection search. The finding event will be sent to
+
     Phantom and the playbook will gather further information about the file attachment
+
     and its network behaviors. If Phantom finds malicious behavior and an analyst approves
-    of the results, the email will be deleted from the user's inbox.'"
+
+    of the results, the email will be deleted from the user''s inbox.''"'
 known_false_positives: No false positives have been identified at this time.
 references: []
 intermediate_findings:
diff --git a/detections/application/suspicious_java_classes.yml b/detections/application/suspicious_java_classes.yml
index 605f4e464fd..916df17d6ac 100644
--- a/detections/application/suspicious_java_classes.yml
+++ b/detections/application/suspicious_java_classes.yml
@@ -6,13 +6,15 @@ modification_date: '2026-05-13'
 author: Jose Hernandez, Splunk
 status: experimental
 type: Anomaly
-description: |-
-    The following analytic identifies suspicious Java classes often used for remote command execution exploits in Java frameworks like Apache Struts.
-    It detects this activity by analyzing HTTP POST requests with specific content patterns using Splunk's `stream_http` data source.
+description: 'The following analytic identifies suspicious Java classes often used for remote command execution exploits in Java frameworks like Apache Struts.
+
+    It detects this activity by analyzing HTTP POST requests with specific content patterns using Splunk''s `stream_http` data source.
+
     This behavior is significant because it may indicate an attempt to exploit vulnerabilities in web applications, potentially leading to unauthorized remote code execution.
-    If confirmed malicious, this activity could allow attackers to execute arbitrary commands on the server, leading to data breaches, system compromise, and further network infiltration.
+
+    If confirmed malicious, this activity could allow attackers to execute arbitrary commands on the server, leading to data breaches, system compromise, and further network infiltration.'
 data_source: []
-search: |-
+search: |
     `stream_http`
     http_method=POST
     http_content_length>1
@@ -27,11 +29,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `suspicious_java_classes_filter`
-how_to_implement: |-
-    In order to properly run this search, Splunk needs to ingest data from your web-traffic appliances that serve or sit in the path of your Struts application servers.
-    This can be accomplished by indexing data from a web proxy, or by using network traffic-analysis tools, such as Splunk Stream or Bro.
-known_false_positives: |-
-    No false positives have been identified at this time.
+how_to_implement: 'In order to properly run this search, Splunk needs to ingest data from your web-traffic appliances that serve or sit in the path of your Struts application servers.
+
+    This can be accomplished by indexing data from a web proxy, or by using network traffic-analysis tools, such as Splunk Stream or Bro.'
+known_false_positives: No false positives have been identified at this time.
 references: []
 intermediate_findings:
     entities:
diff --git a/detections/application/zoom_high_video_latency.yml b/detections/application/zoom_high_video_latency.yml
index 516b16af9a5..643266fd171 100644
--- a/detections/application/zoom_high_video_latency.yml
+++ b/detections/application/zoom_high_video_latency.yml
@@ -8,9 +8,11 @@ status: experimental
 type: Anomaly
 description: Detects particularly high latency from Zoom logs. Latency observed from threat actors performing Remote Employment Fraud (REF) is typically well above what’s normal for the majority of employees.
 data_source: []
-search: '`zoom_index` | spath "payload.object.participant.qos{}.type" | search "payload.object.participant.qos{}.type"=video_input | rename payload.object.participant.qos{}.details.avg_latency as avg_latency "payload.object.participant.qos{}.details.latency" as latency payload.object.participant.email as email | rex field=avg_latency "(?<average_latency>\d+) ms" | rex field=latency "(?<overall_latency>\d+) ms" | search email="*" | table email overall_latency latency avg_latency average_latency _raw | stats latest(overall_latency) as overall_latency by email _raw | where overall_latency>300 | `zoom_high_video_latency_filter`'
+search: |
+    `zoom_index` | spath "payload.object.participant.qos{}.type" | search "payload.object.participant.qos{}.type"=video_input | rename payload.object.participant.qos{}.details.avg_latency as avg_latency "payload.object.participant.qos{}.details.latency" as latency payload.object.participant.email as email | rex field=avg_latency "(?<average_latency>\d+) ms" | rex field=latency "(?<overall_latency>\d+) ms" | search email="*" | table email overall_latency latency avg_latency average_latency _raw | stats latest(overall_latency) as overall_latency by email _raw | where overall_latency>300 | `zoom_high_video_latency_filter`
 how_to_implement: The analytic leverages Zoom logs to be ingested using Splunk Connect for Zoom (https://splunkbase.splunk.com/app/4961)
 known_false_positives: While latency could simply indicate a slow network connection, when combined with other indicators, it can help build a more complete picture. Tune the threshold as needed for your environment baseline.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$email$"
       search: '%original_detection_search% | search  payload.object.participant.email = "$email$"'
@@ -19,7 +21,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$email$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$email$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: email
diff --git a/detections/application/zoom_rare_audio_devices.yml b/detections/application/zoom_rare_audio_devices.yml
index 37c489a554a..d616b0cab0a 100644
--- a/detections/application/zoom_rare_audio_devices.yml
+++ b/detections/application/zoom_rare_audio_devices.yml
@@ -8,12 +8,13 @@ status: experimental
 type: Hunting
 description: Detects rare audio devices from Zoom logs. Actors performing Remote Employment Fraud (REF) typically use unusual device information compared to a majority of employees. Detecting this activity requires careful analysis, regular review, and a thorough understanding of the audio and video devices commonly used within your environment.
 data_source: []
-search: |-
+search: |
     `zoom_index` speaker=* NOT (camera=*iPhone* OR camera="*FaceTime*" OR speaker="*AirPods*" OR camera="*MacBook*" OR microphone="*MacBook Pro Microphone*")
       | rare speaker limit=50
       | `zoom_rare_audio_devices_filter`
 how_to_implement: The analytic leverages Zoom logs to be ingested using Splunk Connect for Zoom (https://splunkbase.splunk.com/app/4961)
 known_false_positives: This is a hunting query meant to identify rare audio devices.
+references: []
 analytic_story:
     - Remote Employment Fraud
 asset_type: Identity
diff --git a/detections/application/zoom_rare_input_devices.yml b/detections/application/zoom_rare_input_devices.yml
index 7ccef2ba6a7..c2d1f5989ca 100644
--- a/detections/application/zoom_rare_input_devices.yml
+++ b/detections/application/zoom_rare_input_devices.yml
@@ -8,12 +8,13 @@ status: experimental
 type: Hunting
 description: Detects rare input devices from Zoom logs. Actors performing Remote Employment Fraud (REF) typically use unusual device information compared to a majority of employees. Detecting this activity requires careful analysis, regular review, and a thorough understanding of the audio and video devices commonly used within your environment.
 data_source: []
-search: |-
+search: |
     `zoom_index` microphone=* NOT (camera=*iPhone* OR camera="*FaceTime*" OR speaker="*AirPods*" OR camera="*MacBook*" OR microphone="*MacBook Pro Microphone*")
       | rare microphone limit=50
       | `zoom_rare_input_devices_filter`
 how_to_implement: The analytic leverages Zoom logs to be ingested using Splunk Connect for Zoom (https://splunkbase.splunk.com/app/4961)
 known_false_positives: This is a hunting query meant to identify rare microphone devices.
+references: []
 analytic_story:
     - Remote Employment Fraud
 asset_type: Identity
diff --git a/detections/application/zoom_rare_video_devices.yml b/detections/application/zoom_rare_video_devices.yml
index e6407025e45..89c07e1d00a 100644
--- a/detections/application/zoom_rare_video_devices.yml
+++ b/detections/application/zoom_rare_video_devices.yml
@@ -8,12 +8,13 @@ status: experimental
 type: Hunting
 description: Detects rare video devices from Zoom logs. Actors performing Remote Employment Fraud (REF) typically use unusual device information compared to a majority of employees. Detecting this activity requires careful analysis, regular review, and a thorough understanding of the audio and video devices commonly used within your environment.
 data_source: []
-search: |-
+search: |
     `zoom_index` camera=* NOT (camera=*iPhone* OR camera="*FaceTime*" OR speaker="*AirPods*" OR camera="*MacBook*" OR microphone="*MacBook Pro Microphone*")
       | rare camera limit=50
       | `zoom_rare_video_devices_filter`
 how_to_implement: The analytic leverages Zoom logs to be ingested using Splunk Connect for Zoom (https://splunkbase.splunk.com/app/4961)
 known_false_positives: This is a hunting query meant to identify rare video devices.
+references: []
 analytic_story:
     - Remote Employment Fraud
 asset_type: Identity
diff --git a/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml b/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml
index dfd2cd1c5a6..08c4a192d19 100644
--- a/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml
+++ b/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Hunting
 description: The following analytic detects unauthenticated requests to an Amazon EKS Kubernetes cluster, specifically identifying actions by the "system:anonymous" user. It leverages AWS CloudWatch Logs data, focusing on user agents and authentication details. This activity is significant as it may indicate unauthorized scanning or probing of the Kubernetes cluster, which could be a precursor to an attack. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or disruption of services within the Kubernetes environment.
 data_source: []
-search: |-
+search: |
     `aws_cloudwatchlogs_eks` "user.username"="system:anonymous" userAgent!="AWS Security Scanner"
       | rename sourceIPs{} as src_ip
       | stats count min(_time) as firstTime max(_time) as lastTime values(responseStatus.reason) values(source) as cluster_name values(responseStatus.code) values(userAgent) as http_user_agent values(verb) values(requestURI)
diff --git a/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml b/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml
index cad6e53955e..ca253cd4fd1 100644
--- a/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml
+++ b/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Hunting
 description: The following analytic detects unauthenticated requests made against the Kubernetes Pods API, indicating potential unauthorized access attempts. It leverages the `aws_cloudwatchlogs_eks` data source, filtering for events where `user.username` is "system:anonymous", `verb` is "list", and `objectRef.resource` is "pods", with `requestURI` set to "/api/v1/pods". This activity is significant as it may signal attempts to access sensitive resources or execute unauthorized commands within the Kubernetes environment. If confirmed malicious, such access could lead to data compromise, unauthorized command execution, or lateral movement within the cluster.
 data_source: []
-search: |-
+search: |
     `aws_cloudwatchlogs_eks` "user.username"="system:anonymous" verb=list objectRef.resource=pods requestURI="/api/v1/pods"
       | rename source as cluster_name sourceIPs{} as src_ip
       | stats count min(_time) as firstTime max(_time) as lastTime values(responseStatus.reason) values(responseStatus.code) values(userAgent) values(verb) values(requestURI)
diff --git a/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml
index 5c9b6faa061..bf47c0adbae 100644
--- a/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml
+++ b/detections/cloud/asl_aws_concurrent_sessions_from_different_ips.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies an AWS IAM account with concurrent sessions originating from more than one unique IP address within a 5-minute span. This detection leverages AWS CloudTrail logs, specifically the `DescribeEventAggregates` API call, to identify multiple IP addresses associated with the same user session. This behavior is significant as it may indicate a session hijacking attack, where an adversary uses stolen session cookies to access AWS resources from a different location. If confirmed malicious, this activity could allow unauthorized access to sensitive corporate resources, leading to potential data breaches or further exploitation.
 data_source:
     - ASL AWS CloudTrail
-search: |-
+search: |
     `amazon_security_lake` api.operation=DescribeEventAggregates src_endpoint.domain!="AWS Internal"
       | bin span=5m _time
       | stats min(_time) as firstTime max(_time) as lastTime values(api.operation) as api.operation values(api.service.name) as api.service.name values(http_request.user_agent) as http_request.user_agent values(src_endpoint.ip) as src_ip values(actor.user.account.uid) as actor.user.account.uid values(cloud.provider) as cloud.provider values(cloud.region) as cloud.region dc(src_endpoint.ip) as distinct_ip_count
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -60,7 +60,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       description: PORTED MANUAL TEST - Can't be tested automatically because of time span.
       test_type: experimental
diff --git a/detections/cloud/asl_aws_create_access_key.yml b/detections/cloud/asl_aws_create_access_key.yml
index 07202e01555..8ca4b7c9014 100644
--- a/detections/cloud/asl_aws_create_access_key.yml
+++ b/detections/cloud/asl_aws_create_access_key.yml
@@ -9,17 +9,8 @@ type: Hunting
 description: The following analytic identifies the creation of AWS IAM access keys by a user for another user, which can indicate privilege escalation. It leverages AWS CloudTrail logs to detect instances where the user creating the access key is different from the user for whom the key is created. This activity is significant because unauthorized access key creation can allow attackers to establish persistence or exfiltrate data via AWS APIs. If confirmed malicious, this could lead to unauthorized access to AWS services, data exfiltration, and long-term persistence in the environment.
 data_source:
     - ASL AWS CloudTrail
-search: |-
-    `amazon_security_lake` api.operation=CreateAccessKey
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor.user.uid api.operation api.service.name
-           http_request.user_agent src_endpoint.ip actor.user.account.uid
-           cloud.provider cloud.region
-      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `asl_aws_create_access_key_filter`
+search: |
+    `amazon_security_lake` api.operation="CreateAccessKey" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_create_access_key_filter`
 how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
 references:
@@ -41,6 +32,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/asl_aws_create_policy_version_to_allow_all_resources.yml
index 9e6adf71ffd..9721b437cfb 100644
--- a/detections/cloud/asl_aws_create_policy_version_to_allow_all_resources.yml
+++ b/detections/cloud/asl_aws_create_policy_version_to_allow_all_resources.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. It detects this activity by analyzing AWS CloudTrail logs for the CreatePolicyVersion event with a policy document that grants broad permissions. This behavior is significant because it violates the principle of least privilege, potentially exposing the environment to misuse or abuse. If confirmed malicious, an attacker could gain extensive access to AWS resources, leading to unauthorized actions, data exfiltration, or further compromise of the AWS environment.
 data_source:
     - ASL AWS CloudTrail
-search: |-
+search: |
     `amazon_security_lake` api.operation=CreatePolicy
       | spath input=api.request.data
       | spath input=policyDocument
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ created a policy version that allows them to access any resource in their account
     entity:
@@ -60,6 +60,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_create_policy_version/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_credential_access_getpassworddata.yml b/detections/cloud/asl_aws_credential_access_getpassworddata.yml
index a774809a2ff..67d945ca35b 100644
--- a/detections/cloud/asl_aws_credential_access_getpassworddata.yml
+++ b/detections/cloud/asl_aws_credential_access_getpassworddata.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifiesGetPasswordData API calls in your AWS account. It leverages  CloudTrail logs from Amazon Security Lake to detect this activity by counting the distinct instance IDs accessed. This behavior is significant as it may indicate an attempt to retrieve encrypted administrator passwords for running Windows instances, which is a critical security concern. If confirmed malicious, attackers could gain unauthorized access to administrative credentials, potentially leading to full control over the affected instances and further compromise of the AWS environment.
 data_source:
     - ASL AWS CloudTrail
-search: |-
+search: |
     `amazon_security_lake` api.operation=GetPasswordData
       | spath input=api.request.data
       | fillnull
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -60,6 +60,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/aws_getpassworddata/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_credential_access_rds_password_reset.yml b/detections/cloud/asl_aws_credential_access_rds_password_reset.yml
index 56b37b9a081..adb1bae9961 100644
--- a/detections/cloud/asl_aws_credential_access_rds_password_reset.yml
+++ b/detections/cloud/asl_aws_credential_access_rds_password_reset.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. It leverages AWS CloudTrail logs from Amazon Security Lake to identify events where the `ModifyDBInstance` API call includes a new `masterUserPassword` parameter. This activity is significant because unauthorized password resets can grant attackers access to sensitive data stored in production databases, such as credit card information, PII, and healthcare data. If confirmed malicious, this could lead to data breaches, regulatory non-compliance, and significant reputational damage. Immediate investigation is required to determine the legitimacy of the password reset.
 data_source:
     - ASL AWS CloudTrail
-search: |-
+search: |
     `amazon_security_lake` api.operation=ModifyDBInstance OR api.operation=ModifyDBCluster
       | spath input=api.request.data
       | search masterUserPassword=*
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ is seen to reset the password for database
     entity:
@@ -61,6 +61,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.002/aws_rds_password_reset/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml b/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml
index 18dd11ce674..f7cce1ed2a1 100644
--- a/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml
+++ b/detections/cloud/asl_aws_defense_evasion_delete_cloudtrail.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic detects AWS `DeleteTrail` events within CloudTrail logs. It leverages Amazon Security Lake logs parsed in the Open Cybersecurity Schema Framework (OCSF) format to identify when a CloudTrail is deleted. This activity is significant because adversaries may delete CloudTrail logs to evade detection and operate with stealth. If confirmed malicious, this action could allow attackers to cover their tracks, making it difficult to trace their activities and investigate other potential compromises within the AWS environment.
 data_source:
     - ASL AWS CloudTrail
-search: |-
-    `amazon_security_lake` api.operation=DeleteTrail
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor.user.uid api.operation api.service.name
-           http_request.user_agent src_endpoint.ip actor.user.account.uid
-           cloud.provider cloud.region
-      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `asl_aws_defense_evasion_delete_cloudtrail_filter`
+search: |
+    `amazon_security_lake` api.operation="DeleteTrail" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_delete_cloudtrail_filter`
 how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin has stopped cloudTrail logging. Please investigate this activity.
 references:
@@ -32,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has deleted CloudTrail logging
     entity:
@@ -57,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml b/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml
index 8a837f2ef77..369f6ccf59b 100644
--- a/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml
+++ b/detections/cloud/asl_aws_defense_evasion_delete_cloudwatch_log_group.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic detects the deletion of CloudWatch log groups in AWS, identified through `DeleteLogGroup` events in CloudTrail logs. This method leverages Amazon Security Lake logs parsed in the OCSF format. The activity is significant because attackers may delete log groups to evade detection and disrupt logging capabilities, hindering incident response efforts. If confirmed malicious, this action could allow attackers to cover their tracks, making it difficult to trace their activities and potentially leading to undetected data breaches or further malicious actions within the compromised AWS environment.
 data_source:
     - ASL AWS CloudTrail
-search: |-
-    `amazon_security_lake` api.operation=DeleteLogGroup
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor.user.uid api.operation api.service.name
-           http_request.user_agent src_endpoint.ip actor.user.account.uid
-           cloud.provider cloud.region
-      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `asl_aws_defense_evasion_delete_cloudwatch_log_group_filter`
+search: |
+    `amazon_security_lake` api.operation="DeleteLogGroup" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_delete_cloudwatch_log_group_filter`
 how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin has deleted CloudWatch logging. Please investigate this activity.
 references:
@@ -32,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has deleted a CloudWatch logging group
     entity:
diff --git a/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml b/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml
index 95547dab525..12910ff1cf8 100644
--- a/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml
+++ b/detections/cloud/asl_aws_defense_evasion_impair_security_services.yml
@@ -9,17 +9,8 @@ type: Hunting
 description: The following analytic detects the deletion of critical AWS Security Services configurations, such as CloudWatch alarms, GuardDuty detectors, and Web Application Firewall rules. It leverages Amazon Security Lake logs to identify specific API calls like "DeleteLogStream" and "DeleteDetector." This activity is significant because adversaries often use these actions to disable security monitoring and evade detection. If confirmed malicious, this could allow attackers to operate undetected, leading to potential data breaches, unauthorized access, and prolonged persistence within the AWS environment.
 data_source:
     - ASL AWS CloudTrail
-search: |-
-    `amazon_security_lake` api.operation IN ("DeleteLogStream","DeleteDetector","DeleteIPSet","DeleteWebACL","DeleteRule","DeleteRuleGroup","DeleteLoggingConfiguration","DeleteAlarms")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor.user.uid api.operation api.service.name
-           http_request.user_agent src_endpoint.ip actor.user.account.uid
-           cloud.provider cloud.region
-      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `asl_aws_defense_evasion_impair_security_services_filter`
+search: |
+    `amazon_security_lake` api.operation IN ("DeleteLogStream", "DeleteDetector", "DeleteIPSet", "DeleteWebACL", "DeleteRule", "DeleteRuleGroup", "DeleteLoggingConfiguration", "DeleteAlarms") | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_impair_security_services_filter`
 how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
 known_false_positives: While this search has no known false positives, it is possible that it is a legitimate admin activity. Please consider filtering out these noisy events using userAgent, user_arn field names.
 references:
@@ -41,6 +32,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/aws_delete_security_services/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_defense_evasion_putbucketlifecycle.yml b/detections/cloud/asl_aws_defense_evasion_putbucketlifecycle.yml
index 4749d3acf57..981c54b9419 100644
--- a/detections/cloud/asl_aws_defense_evasion_putbucketlifecycle.yml
+++ b/detections/cloud/asl_aws_defense_evasion_putbucketlifecycle.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic detects `PutBucketLifecycle` events in AWS CloudTrail logs where a user sets a lifecycle rule for an S3 bucket with an expiration period of fewer than three days. This detection leverages CloudTrail logs to identify suspicious lifecycle configurations. This activity is significant because attackers may use it to delete CloudTrail logs quickly, thereby evading detection and impairing forensic investigations. If confirmed malicious, this could allow attackers to cover their tracks, making it difficult to trace their actions and respond to the breach effectively.
 data_source:
     - ASL AWS CloudTrail
-search: |-
+search: |
     `amazon_security_lake` api.operation=PutBucketLifecycle
       | spath input=api.request.data path=LifecycleConfiguration.Rule.NoncurrentVersionExpiration.NoncurrentDays output=NoncurrentDays
       | where NoncurrentDays < 3
@@ -44,6 +44,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/put_bucketlifecycle/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml b/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml
index 42b479adc76..eecd6ee2e2a 100644
--- a/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml
+++ b/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic detects `StopLogging` events within AWS CloudTrail logs, a critical action that adversaries may use to evade detection. By halting the logging of their malicious activities, attackers aim to operate undetected within a compromised AWS environment. This detection is achieved by monitoring for specific CloudTrail log entries that indicate the cessation of logging activities. Identifying such behavior is crucial for a Security Operations Center (SOC), as it signals an attempt to undermine the integrity of logging mechanisms, potentially allowing malicious activities to proceed without observation. The impact of this evasion tactic is significant, as it can severely hamper incident response and forensic investigations by obscuring the attacker's actions.
 data_source:
     - ASL AWS CloudTrail
-search: |-
-    `amazon_security_lake` api.operation=StopLogging
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor.user.uid api.operation api.service.name
-           http_request.user_agent src_endpoint.ip actor.user.account.uid
-           cloud.provider cloud.region
-      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `asl_aws_defense_evasion_stop_logging_cloudtrail_filter`
+search: |
+    `amazon_security_lake` api.operation="StopLogging" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_stop_logging_cloudtrail_filter`
 how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin has stopped cloudtrail logging. Please investigate this activity.
 references:
@@ -32,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has stopped Cloudtrail logging for account id $vendor_account$ from IP $src$
     entity:
@@ -57,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/asl_ocsf_cloudtrail_2.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml b/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml
index b43b56d0e1e..cbceae6d094 100644
--- a/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml
+++ b/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic detects `UpdateTrail` events within AWS CloudTrail logs, aiming to identify attempts by attackers to evade detection by altering logging configurations. By updating CloudTrail settings with incorrect parameters, such as changing multi-regional logging to a single region, attackers can impair the logging of their activities across other regions. This behavior is crucial for Security Operations Centers (SOCs) to identify, as it indicates an adversary's intent to operate undetected within a compromised AWS environment. The impact of such evasion tactics is significant, potentially allowing malicious activities to proceed without being logged, thereby hindering incident response and forensic investigations.
 data_source:
     - ASL AWS CloudTrail
-search: |-
-    `amazon_security_lake` api.operation=UpdateTrail
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor.user.uid api.operation api.service.name
-           http_request.user_agent src_endpoint.ip actor.user.account.uid
-           cloud.provider cloud.region
-      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `asl_aws_defense_evasion_update_cloudtrail_filter`
+search: |
+    `amazon_security_lake` api.operation="UpdateTrail" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_update_cloudtrail_filter`
 how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin has updated cloudtrail logging. Please investigate this activity.
 references:
@@ -32,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has updated a cloudtrail logging for account id $vendor_account$ from IP $src$
     entity:
@@ -57,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/update_cloudtrail/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml b/detections/cloud/asl_aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
index f84b2b4b5a8..90fe5d1c541 100644
--- a/detections/cloud/asl_aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
+++ b/detections/cloud/asl_aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. It leverages AWS CloudTrail logs from Amazon Security Lake to identify `CreateKey` or `PutKeyPolicy` events where the `kms:Encrypt` action is granted to all principals. This activity is significant as it may indicate a compromised account, allowing an attacker to misuse the encryption key to target other organizations. If confirmed malicious, this could lead to unauthorized data encryption, potentially disrupting operations and compromising sensitive information across multiple entities.
 data_source:
     - ASL AWS CloudTrail
-search: |-
+search: |
     `amazon_security_lake` api.operation=PutKeyPolicy OR api.operation=CreateKey
       | spath input=api.request.data path=policy output=policy
       | spath input=policy
@@ -46,7 +46,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: AWS account is potentially compromised and user $user$ is trying to compromise other accounts
     entity:
@@ -68,6 +68,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/aws_kms_key/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_disable_bucket_versioning.yml b/detections/cloud/asl_aws_disable_bucket_versioning.yml
index a62541979db..b12b6f7d897 100644
--- a/detections/cloud/asl_aws_disable_bucket_versioning.yml
+++ b/detections/cloud/asl_aws_disable_bucket_versioning.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects when AWS S3 bucket versioning is suspended by a user. It leverages AWS CloudTrail logs to identify `PutBucketVersioning` events with the `VersioningConfiguration.Status` set to `Suspended`. This activity is significant because disabling versioning can prevent recovery of deleted or modified data, which is a common tactic in ransomware attacks. If confirmed malicious, this action could lead to data loss and hinder recovery efforts, severely impacting data integrity and availability.
 data_source:
     - ASL AWS CloudTrail
-search: |-
+search: |
     `amazon_security_lake` api.operation=PutBucketVersioning
       | spath input=api.request.data path=VersioningConfiguration.Status output=Status
       | spath input=api.request.data path=bucketName output=bucketName
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -63,6 +63,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/aws_bucket_version/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_ec2_snapshot_shared_externally.yml b/detections/cloud/asl_aws_ec2_snapshot_shared_externally.yml
index a7e59e994c3..977cf03403d 100644
--- a/detections/cloud/asl_aws_ec2_snapshot_shared_externally.yml
+++ b/detections/cloud/asl_aws_ec2_snapshot_shared_externally.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects when an EC2 snapshot is shared publicly by analyzing AWS CloudTrail events. This detection method leverages CloudTrail logs to identify modifications in snapshot permissions, specifically when the snapshot is shared outside the originating AWS account. This activity is significant as it may indicate an attempt to exfiltrate sensitive data stored in the snapshot. If confirmed malicious, an attacker could gain unauthorized access to the snapshot's data, potentially leading to data breaches or further exploitation of the compromised information.
 data_source:
     - ASL AWS CloudTrail
-search: |-
+search: |
     `amazon_security_lake` api.operation=ModifySnapshotAttribute
       | spath input=api.request.data path=createVolumePermission.add.items{}.group output=group
       | search group=all
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: AWS EC2 snapshot from user $user$ is shared publicly
     entity:
@@ -62,6 +62,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_ecr_container_upload_outside_business_hours.yml b/detections/cloud/asl_aws_ecr_container_upload_outside_business_hours.yml
index 37cb409b8c4..363e76c82ca 100644
--- a/detections/cloud/asl_aws_ecr_container_upload_outside_business_hours.yml
+++ b/detections/cloud/asl_aws_ecr_container_upload_outside_business_hours.yml
@@ -9,20 +9,8 @@ type: Anomaly
 description: The following analytic detects the upload of new containers to AWS Elastic Container Service (ECR) outside of standard business hours through AWS CloudTrail events. It identifies this behavior by monitoring for `PutImage` events occurring before 8 AM or after 8 PM, as well as any uploads on weekends. This activity is significant for a SOC to investigate as it may indicate unauthorized access or malicious deployments, potentially leading to compromised services or data breaches. Identifying and addressing such uploads promptly can mitigate the risk of security incidents and their associated impacts.
 data_source:
     - ASL AWS CloudTrail
-search: |-
-    `amazon_security_lake` api.operation=PutImage
-      | eval hour=strftime(time/pow(10,3), "%H"), weekday=strftime(time/pow(10,3), "%A")
-      | where hour >= 20 OR hour < 8 OR weekday=Saturday OR weekday=Sunday
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor.user.uid api.operation api.service.name
-           http_request.user_agent src_endpoint.ip actor.user.account.uid
-           cloud.provider cloud.region api.request.data
-           bucketName
-      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `asl_aws_ecr_container_upload_outside_business_hours_filter`
+search: |
+    `amazon_security_lake` api.operation="PutImage" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_ecr_container_upload_outside_business_hours_filter`
 how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
 known_false_positives: When your development is spreaded in different time zones, applying this rule can be difficult.
 references:
@@ -35,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -57,7 +45,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       description: PORTED MANUAL TEST - Can't be tested automatically because of outside of business hours time
       test_type: experimental
diff --git a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml
index 6831869df1e..023a14aaa10 100644
--- a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml
+++ b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml
@@ -6,42 +6,15 @@ modification_date: '2026-05-13'
 author: Patrick Bareiss, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events.
-    It identifies instances where a new container is uploaded by a user not previously recognized as authorized.
+description: 'The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events.
+
+    It identifies instances where a new container is uploaded by a user not previously recognized as authorized.'
 data_source:
     - ASL AWS CloudTrail
-search: |-
-    `amazon_security_lake`
-    api.operation=PutImage
-    NOT `aws_ecr_users_asl`
-
-    | fillnull
-
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-
-      by actor.user.uid api.operation api.service.name
-         http_request.user_agent
-         src_endpoint.ip actor.user.account.uid
-         cloud.provider cloud.region
-
-    | rename actor.user.account.uid as vendor_account
-             actor.user.uid as user
-             api.operation as action
-             api.service.name as dest
-             cloud.provider as vendor_product
-             cloud.region as vendor_region
-             http_request.user_agent as user_agent
-             src_endpoint.ip as src
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `asl_aws_ecr_container_upload_unknown_user_filter`
-how_to_implement: |-
-    The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
-known_false_positives: |-
-    No false positives have been identified at this time.
+search: |
+    `amazon_security_lake` api.operation="PutImage" NOT actor.user.name="admin" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_ecr_container_upload_unknown_user_filter`
+how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://attack.mitre.org/techniques/T1204/003/
 drilldown_searches:
@@ -52,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -77,6 +50,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_iam_accessdenied_discovery_events.yml b/detections/cloud/asl_aws_iam_accessdenied_discovery_events.yml
index d55277b322a..c83bd31daea 100644
--- a/detections/cloud/asl_aws_iam_accessdenied_discovery_events.yml
+++ b/detections/cloud/asl_aws_iam_accessdenied_discovery_events.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies excessive AccessDenied events within an hour timeframe for IAM users in AWS. It leverages AWS CloudTrail logs to detect multiple failed access attempts from the same source IP and user identity. This activity is significant as it may indicate that an access key has been compromised and is being misused for unauthorized discovery actions. If confirmed malicious, this could allow attackers to gather information about the AWS environment, potentially leading to further exploitation or privilege escalation.
 data_source:
     - ASL AWS CloudTrail
-search: |-
+search: |
     `amazon_security_lake` api.response.error=AccessDenied OR api.response.error=OperationNotPermittedException OR api.response.error=*Unauthorized* actor.user.type=IAMUser
       | bucket _time span=1h
       | stats count as failures min(_time) as firstTime max(_time) as lastTime dc(api.operation) as dc_operation, dc(api.service.name) as dc_service values(api.operation) as api.operation values(api.service.name) as api.service.name values(http_request.user_agent) as http_request.user_agent values(src_endpoint.ip) as src_ip values(actor.user.account.uid) as actor.user.account.uid values(cloud.provider) as cloud.provider values(cloud.region) as cloud.region
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -56,6 +56,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/asl_aws_iam_assume_role_policy_brute_force.yml
index 52d5a575713..c0d52f9112a 100644
--- a/detections/cloud/asl_aws_iam_assume_role_policy_brute_force.yml
+++ b/detections/cloud/asl_aws_iam_assume_role_policy_brute_force.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. It leverages AWS CloudTrail logs to identify `MalformedPolicyDocumentException` errors with a status of `failure` and filters out legitimate AWS services. This activity is significant as repeated failures to assume roles can indicate an adversary attempting to guess role names, which is a precursor to unauthorized access. If confirmed malicious, this could lead to unauthorized access to AWS resources, potentially compromising sensitive data and services.
 data_source:
     - ASL AWS CloudTrail
-search: |-
+search: |
     `amazon_security_lake` api.operation="AssumeRole" "api.response.error"=AccessDenied
       | bucket _time span=1h
       | stats count as failures min(_time) as firstTime max(_time) as lastTime values(api.operation) as api.operation values(api.service.name) as api.service.name values(http_request.user_agent) as http_request.user_agent values(src_endpoint.ip) as src_ip values(actor.user.account.uid) as actor.user.account.uid values(cloud.provider) as cloud.provider values(cloud.region) as cloud.region
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has caused multiple failures with errorCode AccessDenied, which potentially means adversary is attempting to identify a role name.
     entity:
@@ -60,6 +60,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_iam_delete_policy.yml b/detections/cloud/asl_aws_iam_delete_policy.yml
index 9392733db3d..9b724560f85 100644
--- a/detections/cloud/asl_aws_iam_delete_policy.yml
+++ b/detections/cloud/asl_aws_iam_delete_policy.yml
@@ -9,17 +9,8 @@ type: Hunting
 description: The following analytic identifies when a policy is deleted in AWS. It leverages Amazon Security Lake logs to detect the DeletePolicy API operation. Monitoring policy deletions is crucial as it can indicate unauthorized attempts to weaken security controls. If confirmed malicious, this activity could allow an attacker to remove critical security policies, potentially leading to privilege escalation or unauthorized access to sensitive resources.
 data_source:
     - ASL AWS CloudTrail
-search: |-
-    `amazon_security_lake` api.operation=DeletePolicy
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor.user.uid api.operation api.service.name
-           http_request.user_agent src_endpoint.ip actor.user.account.uid
-           cloud.provider cloud.region
-      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `asl_aws_iam_delete_policy_filter`
+search: |
+    `amazon_security_lake` api.operation="DeletePolicy" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_iam_delete_policy_filter`
 how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
 known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only.
 references:
@@ -40,6 +31,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_iam_failure_group_deletion.yml b/detections/cloud/asl_aws_iam_failure_group_deletion.yml
index 1638c8ad06a..b6d6bc1d7c0 100644
--- a/detections/cloud/asl_aws_iam_failure_group_deletion.yml
+++ b/detections/cloud/asl_aws_iam_failure_group_deletion.yml
@@ -9,17 +9,8 @@ type: Anomaly
 description: The following analytic detects failed attempts to delete AWS IAM groups, triggered by access denial, conflicts, or non-existent groups. It operates by monitoring CloudTrail logs for specific error codes related to deletion failures. This behavior is significant for a SOC as it may indicate unauthorized attempts to modify access controls or disrupt operations by removing groups. Such actions could be part of a larger attack aiming to escalate privileges or impair security protocols. Identifying these attempts allows for timely investigation and mitigation, preventing potential impact on the organizations security posture.
 data_source:
     - ASL AWS CloudTrail
-search: |-
-    `amazon_security_lake` api.operation=DeleteGroup status=Failure http_request.user_agent!=*.amazonaws.com
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor.user.uid api.operation api.service.name
-           http_request.user_agent src_endpoint.ip actor.user.account.uid
-           cloud.provider cloud.region
-      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `asl_aws_iam_failure_group_deletion_filter`
+search: |
+    `amazon_security_lake` api.operation="DeleteGroup" status="Failure" NOT http_request.user_agent="*.amazonaws.com" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_iam_failure_group_deletion_filter`
 how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
 known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
 references:
@@ -33,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -58,6 +49,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_iam_successful_group_deletion.yml b/detections/cloud/asl_aws_iam_successful_group_deletion.yml
index 4dc3dc3a208..d11aedbc457 100644
--- a/detections/cloud/asl_aws_iam_successful_group_deletion.yml
+++ b/detections/cloud/asl_aws_iam_successful_group_deletion.yml
@@ -9,17 +9,8 @@ type: Hunting
 description: The following analytic detects the successful deletion of a group within AWS IAM, leveraging CloudTrail IAM events. This action, while not inherently malicious, can serve as a precursor to more sinister activities, such as unauthorized access or privilege escalation attempts. By monitoring for such deletions, the analytic aids in identifying potential preparatory steps towards an attack, allowing for early detection and mitigation. The identification of this behavior is crucial for a SOC to prevent the potential impact of an attack, which could include unauthorized access to sensitive resources or disruption of AWS environment operations.
 data_source:
     - ASL AWS CloudTrail
-search: |-
-    `amazon_security_lake` api.operation=DeleteGroup status=Success
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor.user.uid api.operation api.service.name
-           http_request.user_agent src_endpoint.ip actor.user.account.uid
-           cloud.provider cloud.region
-      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `asl_aws_iam_successful_group_deletion_filter`
+search: |
+    `amazon_security_lake` api.operation="DeleteGroup" status="Success" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_iam_successful_group_deletion_filter`
 how_to_implement: You must install the Data Lake Federated Analytics App and ingest the logs into Splunk.
 known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
 references:
@@ -41,6 +32,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml b/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml
index e49d40f9f85..6397544be98 100644
--- a/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml
+++ b/detections/cloud/asl_aws_multi_factor_authentication_disabled.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic detects attempts to disable multi-factor authentication (MFA) for an AWS IAM user. It leverages Amazon Security Lake logs, specifically monitoring for `DeleteVirtualMFADevice` or `DeactivateMFADevice` API operations. This activity is significant as disabling MFA can indicate an adversary attempting to weaken account security to maintain persistence using a compromised account. If confirmed malicious, this action could allow attackers to retain access to the AWS environment without detection, potentially leading to unauthorized access to sensitive resources and prolonged compromise.
 data_source:
     - ASL AWS CloudTrail
-search: |-
-    `amazon_security_lake` (api.operation=DeleteVirtualMFADevice OR api.operation=DeactivateMFADevice)
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor.user.uid api.operation api.service.name
-           http_request.user_agent src_endpoint.ip actor.user.account.uid
-           cloud.provider cloud.region
-      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `asl_aws_multi_factor_authentication_disabled_filter`
+search: |
+    `amazon_security_lake` api.operation IN ("DeleteVirtualMFADevice", "DeactivateMFADevice") | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_multi_factor_authentication_disabled_filter`
 how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
 known_false_positives: AWS Administrators may disable MFA but it is highly unlikely for this event to occur without prior notice to the company
 references:
@@ -33,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has disabled Multi-Factor authentication
     entity:
@@ -60,6 +51,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_mfa_disabled/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/asl_aws_network_access_control_list_created_with_all_open_ports.yml
index 1cb1c57ab8f..ad4e73db3b2 100644
--- a/detections/cloud/asl_aws_network_access_control_list_created_with_all_open_ports.yml
+++ b/detections/cloud/asl_aws_network_access_control_list_created_with_all_open_ports.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the creation of AWS Network Access Control Lists (ACLs) with all ports open to a specified CIDR. It leverages AWS CloudTrail events, specifically monitoring for `CreateNetworkAclEntry` or `ReplaceNetworkAclEntry` actions with rules allowing all traffic. This activity is significant because it can expose the network to unauthorized access, increasing the risk of data breaches and other malicious activities. If confirmed malicious, an attacker could exploit this misconfiguration to gain unrestricted access to the network, potentially leading to data exfiltration, service disruption, or further compromise of the AWS environment.
 data_source:
     - ASL AWS CloudTrail
-search: |-
+search: |
     `amazon_security_lake` api.operation=CreateNetworkAclEntry OR api.operation=ReplaceNetworkAclEntry status=Success
       | spath input=api.request.data path=ruleAction output=ruleAction
       | spath input=api.request.data path=egress output=egress
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has created network ACLs with all the ports opens to $cidrBlock$
     entity:
@@ -63,6 +63,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_create_acl/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_network_access_control_list_deleted.yml b/detections/cloud/asl_aws_network_access_control_list_deleted.yml
index 7e784a52e13..678487ddebd 100644
--- a/detections/cloud/asl_aws_network_access_control_list_deleted.yml
+++ b/detections/cloud/asl_aws_network_access_control_list_deleted.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the deletion of AWS Network Access Control Lists (ACLs). It leverages AWS CloudTrail logs to identify events where a user deletes a network ACL entry. This activity is significant because deleting a network ACL can remove critical access restrictions, potentially allowing unauthorized access to cloud instances. If confirmed malicious, this action could enable attackers to bypass network security controls, leading to unauthorized access, data exfiltration, or further compromise of the cloud environment.
 data_source:
     - ASL AWS CloudTrail
-search: |-
+search: |
     `amazon_security_lake` api.operation=DeleteNetworkAclEntry status=Success
       | spath input=api.request.data path=egress output=egress
       | spath input=api.request.data path=networkAclId output=networkAclId
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -60,6 +60,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_delete_acl/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml b/detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml
index 7b6c1c52981..fb3bab4ef48 100644
--- a/detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml
+++ b/detections/cloud/asl_aws_new_mfa_method_registered_for_user.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic identifies the registration of a new Multi-Factor Authentication (MFA) method for an AWS account, as logged through Amazon Security Lake (ASL). It detects this activity by monitoring the `CreateVirtualMFADevice` API operation within ASL logs. This behavior is significant because adversaries who gain unauthorized access to an AWS account may register a new MFA method to maintain persistence. If confirmed malicious, this activity could allow attackers to secure their access, making it harder to detect and remove their presence from the compromised environment.
 data_source:
     - ASL AWS CloudTrail
-search: |-
-    `amazon_security_lake` api.operation=CreateVirtualMFADevice
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor.user.uid api.operation api.service.name
-           http_request.user_agent src_endpoint.ip actor.user.account.uid
-           cloud.provider cloud.region
-      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `asl_aws_new_mfa_method_registered_for_user_filter`
+search: |
+    `amazon_security_lake` api.operation="CreateVirtualMFADevice" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_new_mfa_method_registered_for_user_filter`
 how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
 known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection.
 references:
@@ -35,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new virtual device is added to user $user$
     entity:
@@ -60,6 +51,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_saml_update_identity_provider.yml b/detections/cloud/asl_aws_saml_update_identity_provider.yml
index f505576e018..498c0a8dfef 100644
--- a/detections/cloud/asl_aws_saml_update_identity_provider.yml
+++ b/detections/cloud/asl_aws_saml_update_identity_provider.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic detects updates to the SAML provider in AWS. It leverages AWS CloudTrail logs to identify the `UpdateSAMLProvider` event, analyzing fields such as `sAMLProviderArn`, `sourceIPAddress`, and `userIdentity` details. Monitoring updates to the SAML provider is crucial as it may indicate a perimeter compromise of federated credentials or unauthorized backdoor access set by an attacker. If confirmed malicious, this activity could allow attackers to manipulate identity federation, potentially leading to unauthorized access to cloud resources and sensitive data.
 data_source:
     - ASL AWS CloudTrail
-search: |-
-    `amazon_security_lake` api.operation=UpdateSAMLProvider
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor.user.uid api.operation api.service.name
-           http_request.user_agent src_endpoint.ip actor.user.account.uid
-           cloud.provider cloud.region
-      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `asl_aws_saml_update_identity_provider_filter`
+search: |
+    `amazon_security_lake` api.operation="UpdateSAMLProvider" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_saml_update_identity_provider_filter`
 how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
 known_false_positives: Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored.
 references:
@@ -35,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ from IP address $src$ updated the SAML provider
     entity:
@@ -60,6 +51,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/update_saml_provider/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/asl_aws_updateloginprofile.yml b/detections/cloud/asl_aws_updateloginprofile.yml
index faa12fb9ebb..f13ed923f6e 100644
--- a/detections/cloud/asl_aws_updateloginprofile.yml
+++ b/detections/cloud/asl_aws_updateloginprofile.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic detects an AWS CloudTrail event where a user with permissions updates the login profile of another user. It leverages CloudTrail logs to identify instances where the user making the change is different from the user whose profile is being updated. This activity is significant because it can indicate privilege escalation attempts, where an attacker uses a compromised account to gain higher privileges. If confirmed malicious, this could allow the attacker to escalate their privileges, potentially leading to unauthorized access and control over sensitive resources within the AWS environment.
 data_source:
     - ASL AWS CloudTrail
-search: |-
-    `amazon_security_lake` api.operation=UpdateLoginProfile
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor.user.uid api.operation api.service.name
-           http_request.user_agent src_endpoint.ip actor.user.account.uid
-           cloud.provider cloud.region
-      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `asl_aws_updateloginprofile_filter`
+search: |
+    `amazon_security_lake` api.operation="UpdateLoginProfile" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `asl_aws_updateloginprofile_filter`
 how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
 references:
@@ -33,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ from IP address $src$ updated the login profile of another user
     entity:
@@ -58,6 +49,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_updateloginprofile/asl_ocsf_cloudtrail.json
-          sourcetype: aws:asl
           source: aws_asl
+          sourcetype: aws:asl
       test_type: unit
diff --git a/detections/cloud/aws_ami_attribute_modification_for_exfiltration.yml b/detections/cloud/aws_ami_attribute_modification_for_exfiltration.yml
index 7729edc658b..dd2e3e2a848 100644
--- a/detections/cloud/aws_ami_attribute_modification_for_exfiltration.yml
+++ b/detections/cloud/aws_ami_attribute_modification_for_exfiltration.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects suspicious modifications to AWS AMI attributes, such as sharing an AMI with another AWS account or making it publicly accessible. It leverages AWS CloudTrail logs to identify these changes by monitoring specific API calls. This activity is significant because adversaries can exploit these modifications to exfiltrate sensitive data stored in AWS resources. If confirmed malicious, this could lead to unauthorized access and potential data breaches, compromising the confidentiality and integrity of organizational information.
 data_source:
     - AWS CloudTrail ModifyImageAttribute
-search: |-
+search: |
     `cloudtrail` eventName=ModifyImageAttribute (requestParameters.launchPermission.add.items{}.userId = * OR requestParameters.launchPermission.add.items{}.group = all)
       | rename requestParameters.launchPermission.add.items{}.group as group_added
       | rename requestParameters.launchPermission.add.items{}.userId as accounts_added
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: AWS AMI from account $vendor_account$ is shared externally with $accounts_added$ from $src$ or AMI made is made Public.
     entity:
@@ -62,6 +62,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_ami_shared_public/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_bedrock_delete_guardrails.yml b/detections/cloud/aws_bedrock_delete_guardrails.yml
index 83b485ec291..804bacd69f9 100644
--- a/detections/cloud/aws_bedrock_delete_guardrails.yml
+++ b/detections/cloud/aws_bedrock_delete_guardrails.yml
@@ -9,13 +9,8 @@ type: TTP
 description: The following analytic identifies attempts to delete AWS Bedrock GuardRails, which are security controls designed to prevent harmful, biased, or inappropriate AI outputs. It leverages AWS CloudTrail logs to detect when a user or service calls the DeleteGuardrail API. This activity is significant as it may indicate an adversary attempting to remove safety guardrails after compromising credentials, potentially to enable harmful or malicious model outputs. Removing guardrails could allow attackers to extract sensitive information, generate offensive content, or bypass security controls designed to prevent prompt injection and other AI-specific attacks. If confirmed malicious, this could represent a deliberate attempt to manipulate model behavior for harmful purposes.
 data_source:
     - AWS CloudTrail DeleteGuardrail
-search: >-
-    `cloudtrail` eventSource=bedrock.amazonaws.com eventName=DeleteGuardrail |
-    rename user_name as user | stats count min(_time) as firstTime max(_time) as
-    lastTime values(requestParameters.guardrailIdentifier) as guardrailIds by src
-    user user_agent vendor_account vendor_product dest signature vendor_region |
-    `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |
-    `aws_bedrock_delete_guardrails_filter`
+search: |
+    `cloudtrail` eventName=DeleteGuardrail eventSource="bedrock.amazonaws.com" | eval guardrailIds='requestParameters.guardrailIdentifier' | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_bedrock_delete_guardrails_filter`
 how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. Ensure the CloudTrail is capturing Bedrock GuardRails management events.
 known_false_positives: Legitimate administrators may delete GuardRails as part of normal operations, such as when replacing outdated guardrails with updated versions, cleaning up test resources, or consolidating security controls. Consider implementing an allowlist for expected administrators who regularly manage GuardRails configurations.
 references:
@@ -30,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ deleted AWS Bedrock GuardRails $guardrailIds$ from $src$
     entity:
@@ -55,6 +50,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/aws_bedrock_delete_guardrails/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_bedrock_delete_knowledge_base.yml b/detections/cloud/aws_bedrock_delete_knowledge_base.yml
index d3712a5b4df..c04ef5d86e9 100644
--- a/detections/cloud/aws_bedrock_delete_knowledge_base.yml
+++ b/detections/cloud/aws_bedrock_delete_knowledge_base.yml
@@ -9,13 +9,8 @@ type: TTP
 description: The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. It monitors AWS CloudTrail logs for DeleteKnowledgeBase API calls. This activity could indicate an adversary attempting to remove knowledge bases after compromising credentials, potentially to disrupt business operations or remove traces of data access. Deleting knowledge bases could impact model performance, remove critical business context, or be part of a larger attack to degrade AI capabilities. If confirmed malicious, this could represent a deliberate attempt to cause service disruption or data loss.
 data_source:
     - AWS CloudTrail DeleteKnowledgeBase
-search: >-
-    `cloudtrail` eventSource=bedrock.amazonaws.com eventName=DeleteKnowledgeBase
-    | rename user_name as user
-    | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.knowledgeBaseId) as knowledgeBaseIds by src user user_agent vendor_account vendor_product dest signature vendor_region
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `aws_bedrock_delete_knowledge_base_filter`
+search: |
+    `cloudtrail` eventName=DeleteKnowledgeBase eventSource="bedrock.amazonaws.com" | eval knowledgeBaseIds='requestParameters.knowledgeBaseId' | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_bedrock_delete_knowledge_base_filter`
 how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. Ensure the CloudTrail is capturing Bedrock Knowledge Base management events.
 known_false_positives: Legitimate administrators may delete Knowledge Bases as part of normal operations, such as when replacing outdated knowledge bases, removing test resources, or consolidating information. Consider implementing an allowlist for expected administrators who regularly manage Knowledge Base configurations.
 references:
@@ -29,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ deleted AWS Bedrock Knowledge Base $knowledgeBaseIds$ from $src$
     entity:
@@ -54,6 +49,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/aws_delete_knowledge_base/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml b/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml
index 3645824cef1..f00e38cf270 100644
--- a/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml
+++ b/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml
@@ -9,13 +9,8 @@ type: TTP
 description: The following analytic identifies attempts to delete AWS Bedrock model invocation logging configurations. It leverages AWS CloudTrail logs to detect when a user or service calls the DeleteModelInvocationLogging API. This activity is significant as it may indicate an adversary attempting to remove audit trails of model interactions after compromising credentials. Deleting model invocation logs could allow attackers to interact with AI models without leaving traces, potentially enabling them to conduct data exfiltration, prompt injection attacks, or other malicious activities without detection. If confirmed malicious, this could represent a deliberate attempt to hide unauthorized model usage and evade detection.
 data_source:
     - AWS CloudTrail DeleteModelInvocationLoggingConfiguration
-search: >-
-    `cloudtrail` eventSource=bedrock.amazonaws.com
-    eventName=DeleteModelInvocationLoggingConfiguration | rename user_name as user
-    | stats count min(_time) as firstTime max(_time) as lastTime by src user
-    user_agent vendor_account vendor_product dest signature vendor_region |
-    `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |
-    `aws_bedrock_delete_model_invocation_logging_configuration_filter`
+search: |
+    `cloudtrail` eventName=DeleteModelInvocationLoggingConfiguration eventSource="bedrock.amazonaws.com" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_bedrock_delete_model_invocation_logging_configuration_filter`
 how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. Ensure the CloudTrail is capturing Bedrock model invocation logging management events.
 known_false_positives: Legitimate administrators may delete model invocation logging configurations during maintenance, when updating logging policies, or when cleaning up unused resources. Consider implementing an allowlist for expected administrators who regularly manage logging configurations.
 references:
@@ -29,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ deleted AWS Bedrock model invocation logging from $src$
     entity:
@@ -54,6 +49,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/aws_bedrock_delete_model_invocation_logging/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml b/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml
index eb0fddaade5..b54edfe092f 100644
--- a/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml
+++ b/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml
@@ -9,13 +9,8 @@ type: TTP
 description: The following analytic identifies an high number of AccessDenied attempts to list AWS Bedrock foundation models. It leverages AWS CloudTrail logs to detect when a user or service experiences multiple failures when calling the ListFoundationModels API. This activity is significant as it may indicate an adversary performing reconnaissance of available AI models after compromising credentials with limited permissions. Repeated failures could suggest brute force attempts to enumerate accessible resources or misconfigured access controls. If confirmed malicious, this could represent early-stage reconnaissance before attempting to access or manipulate Bedrock models or knowledge bases.
 data_source:
     - AWS CloudTrail
-search: >-
-    `cloudtrail` eventSource=bedrock.amazonaws.com eventName=ListFoundationModels errorCode=AccessDenied  | rename user_name as user
-    | stats count min(_time) as firstTime max(_time) as lastTime values(errorCode) as errorCodes values(errorMessage) as errorMessages by src user user_agent vendor_account vendor_product dest signature vendor_region
-    | where count > 9
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `aws_bedrock_high_number_list_foundation_model_failures_filter`
+search: |
+    `cloudtrail` eventSource="bedrock.amazonaws.com" eventName="ListFoundationModels" errorCode="AccessDenied" | eval user=user_name, src=src, dc_events=dc_events, signature=signature | stats count min(_time) as firstTime max(_time) as lastTime by eventSource eventName errorCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_bedrock_high_number_list_foundation_model_failures_filter`
 how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS.
 known_false_positives: Legitimate users may encounter multiple failures during permission testing, role transitions, or when service permissions are being reconfigured. High volumes of API errors may also occur during automated processes with misconfigured IAM policies or when new Bedrock features are being explored through API testing.
 references:
@@ -30,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ attempted to list AWS Bedrock foundation models $count$ times with failures from $src$
     entity:
@@ -55,6 +50,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_bedrock_list_foundation_model_failures/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_bedrock_invoke_model_access_denied.yml b/detections/cloud/aws_bedrock_invoke_model_access_denied.yml
index 2e0e738c407..49d19761b34 100644
--- a/detections/cloud/aws_bedrock_invoke_model_access_denied.yml
+++ b/detections/cloud/aws_bedrock_invoke_model_access_denied.yml
@@ -9,13 +9,8 @@ type: TTP
 description: The following analytic identifies access denied error when attempting to invoke AWS Bedrock models. It leverages AWS CloudTrail logs to detect when a user or service receives an AccessDenied error when calling the InvokeModel API. This activity is significant as it may indicate an adversary attempting to access Bedrock models with insufficient permissions after compromising credentials. If confirmed malicious, this could suggest reconnaissance activities or privilege escalation attempts targeting generative AI resources, potentially leading to data exfiltration or manipulation of model outputs.
 data_source:
     - AWS CloudTrail
-search: >-
-    `cloudtrail` eventSource=bedrock.amazonaws.com eventName=InvokeModel errorCode=AccessDenied
-    | rename user_name as user
-    | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.modelId) as modelIds by src user user_agent vendor_account vendor_product dest signature vendor_region result result_id
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `aws_bedrock_invoke_model_access_denied_filter`
+search: |
+    `cloudtrail` eventSource="bedrock.amazonaws.com" eventName="InvokeModel" errorCode="AccessDenied" | eval user=user_name, src=src, dc_events=dc_events, signature=signature | stats count min(_time) as firstTime max(_time) as lastTime by eventSource eventName errorCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_bedrock_invoke_model_access_denied_filter`
 how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS.
 known_false_positives: Legitimate users may encounter access denied errors during permission testing, role transitions, or when service permissions are being reconfigured. Access denials may also happen when automated processes are using outdated credentials or when new Bedrock features are being explored.
 references:
@@ -30,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ access denied when attempting to invoke AWS Bedrock models from $src$
     entity:
@@ -56,6 +51,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.004/aws_invoke_model_access_denied/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml
index 3d2178ddc9a..2773eb4e3c9 100644
--- a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml
+++ b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies an AWS IAM account with concurrent sessions originating from more than one unique IP address within a 5-minute window. It leverages AWS CloudTrail logs, specifically the `DescribeEventAggregates` event, to detect this behavior. This activity is significant as it may indicate a session hijacking attack, where an adversary uses stolen session cookies to access AWS resources from a different location. If confirmed malicious, this could allow unauthorized access to sensitive corporate resources, leading to potential data breaches or further exploitation within the AWS environment.
 data_source:
     - AWS CloudTrail DescribeEventAggregates
-search: |-
+search: |
     `cloudtrail` eventName = DescribeEventAggregates src_ip!="AWS Internal"
       | bin span=5m _time
       | rename user_name as user
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has concurrent sessions from more than one unique IP address $src$ in the span of 5 minutes.
     entity:
@@ -61,6 +61,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml
index 8feaf822538..b55793553a5 100644
--- a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml
+++ b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic identifies failed authentication attempts to the AWS Console during the Multi-Factor Authentication (MFA) challenge. It leverages AWS CloudTrail logs, specifically the `additionalEventData` field, to detect when MFA was used but the login attempt still failed. This activity is significant as it may indicate an adversary attempting to access an account with compromised credentials but being thwarted by MFA. If confirmed malicious, this could suggest an ongoing attempt to breach the account, potentially leading to unauthorized access and further attacks if MFA is bypassed.
 data_source:
     - AWS CloudTrail ConsoleLogin
-search: |-
-    `cloudtrail` eventName= ConsoleLogin errorMessage="Failed authentication" additionalEventData.MFAUsed = "Yes"
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product additionalEventData.MFAUsed
-           errorMessage
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_console_login_failed_during_mfa_challenge_filter`
+search: |
+    `cloudtrail` eventName=ConsoleLogin errorMessage="Failed authentication" additionalEventData.MFAUsed="Yes" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_console_login_failed_during_mfa_challenge_filter`
 how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs.
 known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
 references:
@@ -33,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ failed to pass MFA challenge while logging into console from $src$
     entity:
@@ -60,6 +51,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_failed_mfa/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
index 4c37fd10abc..83127fcfb57 100644
--- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
+++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. It detects this activity by analyzing AWS CloudTrail logs for the CreatePolicyVersion event with a policy document that grants broad permissions. This behavior is significant because it violates the principle of least privilege, potentially exposing the environment to misuse or abuse. If confirmed malicious, an attacker could gain extensive access to AWS resources, leading to unauthorized actions, data exfiltration, or further compromise of the AWS environment.
 data_source:
     - AWS CloudTrail CreatePolicyVersion
-search: |-
+search: |
     `cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com errorCode = success
       | spath input=requestParameters.policyDocument output=key_policy_statements path=Statement{}
       | mvexpand key_policy_statements
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ created a policy version that allows them to access any resource in their account.
     entity:
@@ -58,6 +58,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_create_policy_version/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml
index 3bf1241d2db..d307ef4825c 100644
--- a/detections/cloud/aws_createaccesskey.yml
+++ b/detections/cloud/aws_createaccesskey.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic identifies the creation of AWS IAM access keys by a user for another user, which can indicate privilege escalation. It leverages AWS CloudTrail logs to detect instances where the user creating the access key is different from the user for whom the key is created. This activity is significant because unauthorized access key creation can allow attackers to establish persistence or exfiltrate data via AWS APIs. If confirmed malicious, this could lead to unauthorized access to AWS services, data exfiltration, and long-term persistence in the environment.
 data_source:
     - AWS CloudTrail CreateAccessKey
-search: |-
-    `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success
-      | eval match=if(match(userIdentity.userName,requestParameters.userName),1,0)
-      | search match=0
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_createaccesskey_filter`
+search: |
+    `cloudtrail` eventName=CreateAccessKey NOT userAgent="console.amazonaws.com" errorCode="success" match="0" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_createaccesskey_filter`
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
 references:
@@ -41,6 +31,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml
index 4947d350b99..f6c95bba081 100644
--- a/detections/cloud/aws_createloginprofile.yml
+++ b/detections/cloud/aws_createloginprofile.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies the creation of a login profile for one AWS user by another, followed by a console login from the same source IP. It uses AWS CloudTrail logs to correlate the `CreateLoginProfile` and `ConsoleLogin` events based on the source IP and user identity. This activity is significant as it may indicate privilege escalation, where an attacker creates a new login profile to gain unauthorized access. If confirmed malicious, this could allow the attacker to escalate privileges and maintain persistent access to the AWS environment.
 data_source:
     - AWS CloudTrail CreateLoginProfile AND AWS CloudTrail ConsoleLogin
-search: |-
+search: |
     `cloudtrail` eventName = CreateLoginProfile
       | rename requestParameters.userName as new_login_profile
       | table src_ip eventName new_login_profile userIdentity.userName
@@ -39,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ is attempting to create a login profile for $new_login_profile$ and did a console login from this IP $src_ip$
     entity:
@@ -64,6 +64,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createloginprofile/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_credential_access_failed_login.yml b/detections/cloud/aws_credential_access_failed_login.yml
index 94a5e49c7b8..7bcb85fd6e8 100644
--- a/detections/cloud/aws_credential_access_failed_login.yml
+++ b/detections/cloud/aws_credential_access_failed_login.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic identifies unsuccessful login attempts to the AWS Management Console using a specific user identity. It leverages AWS CloudTrail logs to detect failed authentication events associated with the AWS ConsoleLogin action. This activity is significant for a SOC because repeated failed login attempts may indicate a brute force attack or unauthorized access attempts. If confirmed malicious, an attacker could potentially gain access to AWS account services and resources, leading to data breaches, resource manipulation, or further exploitation within the AWS environment.
 data_source:
     - AWS CloudTrail ConsoleLogin
-search: |-
-    `cloudtrail` eventName = ConsoleLogin errorMessage="Failed authentication"
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_credential_access_failed_login_filter`
+search: |
+    `cloudtrail` eventName=ConsoleLogin errorMessage="Failed authentication" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_credential_access_failed_login_filter`
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 known_false_positives: Users may genuinely mistype or forget the password.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has a login failure from IP $src$
     entity:
diff --git a/detections/cloud/aws_credential_access_getpassworddata.yml b/detections/cloud/aws_credential_access_getpassworddata.yml
index 9d78ba9b4e0..5a8a9e7f6a5 100644
--- a/detections/cloud/aws_credential_access_getpassworddata.yml
+++ b/detections/cloud/aws_credential_access_getpassworddata.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies more than 10 GetPasswordData API calls within a 5-minute window in your AWS account. It leverages AWS CloudTrail logs to detect this activity by counting the distinct instance IDs accessed. This behavior is significant as it may indicate an attempt to retrieve encrypted administrator passwords for running Windows instances, which is a critical security concern. If confirmed malicious, attackers could gain unauthorized access to administrative credentials, potentially leading to full control over the affected instances and further compromise of the AWS environment.
 data_source:
     - AWS CloudTrail GetPasswordData
-search: |-
+search: |
     `cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com
       | bin _time span=5m
       | rename user_name as user
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/aws_credential_access_rds_password_reset.yml b/detections/cloud/aws_credential_access_rds_password_reset.yml
index ad768f3b8d9..14f8d414081 100644
--- a/detections/cloud/aws_credential_access_rds_password_reset.yml
+++ b/detections/cloud/aws_credential_access_rds_password_reset.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. It leverages AWS CloudTrail logs to identify events where the `ModifyDBInstance` API call includes a new `masterUserPassword` parameter. This activity is significant because unauthorized password resets can grant attackers access to sensitive data stored in production databases, such as credit card information, PII, and healthcare data. If confirmed malicious, this could lead to data breaches, regulatory non-compliance, and significant reputational damage. Immediate investigation is required to determine the legitimacy of the password reset.
 data_source:
     - AWS CloudTrail ModifyDBInstance
-search: |-
+search: |
     `cloudtrail` eventSource="rds.amazonaws.com" eventName=ModifyDBInstance "requestParameters.masterUserPassword"=*
       | rename user_name as user
       | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.dBInstanceIdentifier) as database_id
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $database_id$ password has been reset from IP $src$
     entity:
diff --git a/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml b/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml
index 0ca0bd58bd5..4e8f34d95c6 100644
--- a/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml
+++ b/detections/cloud/aws_defense_evasion_delete_cloudtrail.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects the deletion of AWS CloudTrail logs by identifying `DeleteTrail` events within CloudTrail logs. This detection leverages CloudTrail data to monitor for successful `DeleteTrail` actions, excluding those initiated from the AWS console. This activity is significant because adversaries may delete CloudTrail logs to evade detection and operate stealthily within the compromised environment. If confirmed malicious, this action could allow attackers to cover their tracks, making it difficult to trace their activities and potentially leading to prolonged unauthorized access and further exploitation.
 data_source:
     - AWS CloudTrail DeleteTrail
-search: |-
-    `cloudtrail` eventName = DeleteTrail eventSource = cloudtrail.amazonaws.com userAgent !=console.amazonaws.com errorCode = success
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_defense_evasion_delete_cloudtrail_filter`
+search: |
+    `cloudtrail` eventName=DeleteTrail eventSource="cloudtrail.amazonaws.com" NOT userAgent="console.amazonaws.com" errorCode="success" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_defense_evasion_delete_cloudtrail_filter`
 how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin has stopped cloudTrail logging. Please investigate this activity.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has delete a CloudTrail logging for account id $vendor_account$ from IP $src$
     entity:
@@ -56,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml
index f7a5825202b..a7bba712f8f 100644
--- a/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml
+++ b/detections/cloud/aws_defense_evasion_delete_cloudwatch_log_group.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects the deletion of CloudWatch log groups in AWS, identified through `DeleteLogGroup` events in CloudTrail logs. This detection leverages CloudTrail data to monitor for successful log group deletions, excluding console-based actions. This activity is significant as it indicates potential attempts to evade logging and monitoring, which is crucial for maintaining visibility into AWS activities. If confirmed malicious, this could allow attackers to hide their tracks, making it difficult to detect further malicious actions or investigate incidents within the compromised AWS environment.
 data_source:
     - AWS CloudTrail DeleteLogGroup
-search: |-
-    `cloudtrail` eventName = DeleteLogGroup eventSource = logs.amazonaws.com userAgent !=console.amazonaws.com errorCode = success
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_defense_evasion_delete_cloudwatch_log_group_filter`
+search: |
+    `cloudtrail` eventName=DeleteLogGroup eventSource="logs.amazonaws.com" NOT userAgent="console.amazonaws.com" errorCode="success" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_defense_evasion_delete_cloudwatch_log_group_filter`
 how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin has deleted CloudWatch logging. Please investigate this activity.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has deleted a CloudWatch logging group for account id $vendor_account$ from IP $src$
     entity:
diff --git a/detections/cloud/aws_defense_evasion_impair_security_services.yml b/detections/cloud/aws_defense_evasion_impair_security_services.yml
index 1341804dd2c..823e35cfe42 100644
--- a/detections/cloud/aws_defense_evasion_impair_security_services.yml
+++ b/detections/cloud/aws_defense_evasion_impair_security_services.yml
@@ -17,13 +17,7 @@ data_source:
     - AWS CloudTrail DeleteLoggingConfiguration
     - AWS CloudTrail DeleteAlarms
 search: |
-    `cloudtrail`
-    (eventName="DeleteDetector" AND eventSource="guardduty.amazonaws.com") OR (   eventName IN ("DeleteIPSet", "DeleteWebACL", "DeleteRuleGroup", "DeleteRule") AND eventSource IN ("guardduty.amazonaws.com", "wafv2.amazonaws.com", "waf.amazonaws.com") ) OR ( eventName="DeleteLoggingConfiguration" AND eventSource IN ("wafv2.amazonaws.com", "waf.amazonaws.com", "route53.amazonaws.com") )
-    | rename user_name as user
-    | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `aws_defense_evasion_impair_security_services_filter`
+    `cloudtrail` eventName=DeleteLogStream (eventName="DeleteDetector" eventSource="guardduty.amazonaws.com") OR (eventName IN ("DeleteIPSet", "DeleteWebACL", "DeleteRuleGroup", "DeleteRule") eventSource IN ("guardduty.amazonaws.com", "wafv2.amazonaws.com", "waf.amazonaws.com")) OR (eventName="DeleteLoggingConfiguration" eventSource IN ("wafv2.amazonaws.com", "waf.amazonaws.com", "route53.amazonaws.com")) | eval signature=signature | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_defense_evasion_impair_security_services_filter`
 how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.
 known_false_positives: Legitimate administrators may occasionally delete GuardDuty detectors, WAF rule groups, or CloudWatch alarms during environment reconfiguration, migration, or decommissioning activities. In such cases, these events are expected and benign. These should be validated against approved change tickets or deployment pipelines to differentiate malicious activity from normal operations. Please consider filtering out these noisy events using userAgent, user_arn field names.
 references:
@@ -38,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has deleted a security service by attempting to $signature$ for account id $vendor_account$ from IP $src$
     entity:
@@ -63,6 +57,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/aws_delete_security_services/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml b/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml
index 90f96c691e5..067b9189356 100644
--- a/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml
+++ b/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic detects `PutBucketLifecycle` events in AWS CloudTrail logs where a user sets a lifecycle rule for an S3 bucket with an expiration period of fewer than three days. This detection leverages CloudTrail logs to identify suspicious lifecycle configurations. This activity is significant because attackers may use it to delete CloudTrail logs quickly, thereby evading detection and impairing forensic investigations. If confirmed malicious, this could allow attackers to cover their tracks, making it difficult to trace their actions and respond to the breach effectively.
 data_source:
     - AWS CloudTrail PutBucketLifecycle
-search: |-
+search: |
     `cloudtrail` eventName=PutBucketLifecycle user_type=IAMUser errorCode=success
       | spath path=requestParameters{}.LifecycleConfiguration{}.Rule{}.Expiration{}.Days output=expiration_days
       | spath path=requestParameters{}.bucketName output=bucket_name
@@ -42,6 +42,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/put_bucketlifecycle/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml
index cf1b26b7277..a6defb5880f 100644
--- a/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml
+++ b/detections/cloud/aws_defense_evasion_stop_logging_cloudtrail.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects `StopLogging` events in AWS CloudTrail logs. It leverages CloudTrail event data to identify when logging is intentionally stopped, excluding console-based actions and focusing on successful attempts. This activity is significant because adversaries may stop logging to evade detection and operate stealthily within the compromised environment. If confirmed malicious, this action could allow attackers to perform further activities without being logged, hindering incident response and forensic investigations, and potentially leading to unauthorized access or data exfiltration.
 data_source:
     - AWS CloudTrail StopLogging
-search: |-
-    `cloudtrail` eventName = StopLogging eventSource = cloudtrail.amazonaws.com userAgent!=console.amazonaws.com errorCode = success
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_defense_evasion_stop_logging_cloudtrail_filter`
+search: |
+    `cloudtrail` eventName=StopLogging eventSource="cloudtrail.amazonaws.com" NOT userAgent="console.amazonaws.com" errorCode="success" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_defense_evasion_stop_logging_cloudtrail_filter`
 how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in your AWS Environment.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin has stopped cloudtrail logging. Please investigate this activity.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has stopped Cloudtrail logging for account id $vendor_account$ from IP $src$
     entity:
@@ -56,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml
index 97320875ae5..e621e038fcf 100644
--- a/detections/cloud/aws_defense_evasion_update_cloudtrail.yml
+++ b/detections/cloud/aws_defense_evasion_update_cloudtrail.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects `UpdateTrail` events in AWS CloudTrail logs. It identifies attempts to modify CloudTrail settings, potentially to evade logging. The detection leverages CloudTrail logs, focusing on `UpdateTrail` events where the user agent is not the AWS console and the operation is successful. This activity is significant because altering CloudTrail settings can disable or limit logging, hindering visibility into AWS account activities. If confirmed malicious, this could allow attackers to operate undetected, compromising the integrity and security of the AWS environment.
 data_source:
     - AWS CloudTrail UpdateTrail
-search: |-
-    `cloudtrail` eventName = UpdateTrail eventSource = cloudtrail.amazonaws.com userAgent !=console.amazonaws.com errorCode = success
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_defense_evasion_update_cloudtrail_filter`
+search: |
+    `cloudtrail` eventName=UpdateTrail eventSource="cloudtrail.amazonaws.com" NOT userAgent="console.amazonaws.com" errorCode="success" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_defense_evasion_update_cloudtrail_filter`
 how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin has updated cloudtrail logging. Please investigate this activity.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has updated a cloudtrail logging for account id $vendor_account$ from IP $src$
     entity:
diff --git a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
index d35bbb5ca48..5182ddb1800 100644
--- a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
+++ b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
@@ -10,7 +10,7 @@ description: The following analytic detects the creation of AWS KMS keys with an
 data_source:
     - AWS CloudTrail CreateKey
     - AWS CloudTrail PutKeyPolicy
-search: |-
+search: |
     `cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy
       | spath input=requestParameters.policy output=key_policy_statements path=Statement{}
       | mvexpand key_policy_statements
@@ -42,7 +42,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: AWS account is potentially compromised and user $user$ is trying to compromise other accounts.
     entity:
@@ -64,6 +64,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/aws_kms_key/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml
index 2e91fe08c90..066dbd22e2f 100644
--- a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml
+++ b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. It leverages AWS CloudTrail logs to detect the `CopyObject` event where server-side encryption with AWS KMS is specified. This activity is significant as it may indicate unauthorized or suspicious encryption of data, potentially masking exfiltration or tampering efforts. If confirmed malicious, an attacker could be encrypting sensitive data to evade detection or preparing it for exfiltration, posing a significant risk to data integrity and confidentiality.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     `cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms"
       | rename requestParameters.bucketName AS bucketName, requestParameters.x-amz-copy-source AS src_file, requestParameters.key AS dest_file
       | rename user_name as user
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -57,6 +57,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/s3_file_encryption/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_disable_bucket_versioning.yml b/detections/cloud/aws_disable_bucket_versioning.yml
index 041dc8d17ba..6f0b80db5b4 100644
--- a/detections/cloud/aws_disable_bucket_versioning.yml
+++ b/detections/cloud/aws_disable_bucket_versioning.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects when AWS S3 bucket versioning is suspended by a user. It leverages AWS CloudTrail logs to identify `PutBucketVersioning` events with the `VersioningConfiguration.Status` set to `Suspended`. This activity is significant because disabling versioning can prevent recovery of deleted or modified data, which is a common tactic in ransomware attacks. If confirmed malicious, this action could lead to data loss and hinder recovery efforts, severely impacting data integrity and availability.
 data_source:
     - AWS CloudTrail PutBucketVersioning
-search: |-
+search: |
     `cloudtrail` eventName= PutBucketVersioning "requestParameters.VersioningConfiguration.Status"=Suspended
       | rename user_name as user, requestParameters.bucketName as bucket_name
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -58,6 +58,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/aws_bucket_version/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_ec2_snapshot_shared_externally.yml b/detections/cloud/aws_ec2_snapshot_shared_externally.yml
index e716c86b9bb..b383ba0d9fb 100644
--- a/detections/cloud/aws_ec2_snapshot_shared_externally.yml
+++ b/detections/cloud/aws_ec2_snapshot_shared_externally.yml
@@ -9,20 +9,8 @@ type: TTP
 description: The following analytic detects when an EC2 snapshot is shared with an external AWS account by analyzing AWS CloudTrail events. This detection method leverages CloudTrail logs to identify modifications in snapshot permissions, specifically when the snapshot is shared outside the originating AWS account. This activity is significant as it may indicate an attempt to exfiltrate sensitive data stored in the snapshot. If confirmed malicious, an attacker could gain unauthorized access to the snapshot's data, potentially leading to data breaches or further exploitation of the compromised information.
 data_source:
     - AWS CloudTrail ModifySnapshotAttribute
-search: |-
-    `cloudtrail` eventName=ModifySnapshotAttribute
-      | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id
-      | search requested_account_id != NULL
-      | eval match=if(requested_account_id==aws_account_id,"Match","No Match")
-      | where match = "No Match"
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product requested_account_id
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_ec2_snapshot_shared_externally_filter`
+search: |
+    `cloudtrail` eventName=ModifySnapshotAttribute NOT requested_account_id="NULL" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ec2_snapshot_shared_externally_filter`
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 known_false_positives: It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: AWS EC2 snapshot from account $vendor_account$ is shared with $requested_account_id$ by user $user$ from $src$
     entity:
@@ -63,6 +51,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
index aa5a5446c25..3ec2b4326e0 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies high-severity findings from AWS Elastic Container Registry (ECR) image scans. It detects these activities by analyzing AWS CloudTrail logs for the DescribeImageScanFindings event, specifically filtering for findings with a high severity level. This activity is significant for a SOC because high-severity vulnerabilities in container images can lead to potential exploitation if not addressed. If confirmed malicious, attackers could exploit these vulnerabilities to gain unauthorized access, execute arbitrary code, or escalate privileges within the container environment, posing a significant risk to the overall security posture.
 data_source:
     - AWS CloudTrail DescribeImageScanFindings
-search: |-
+search: |
     `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
       | spath path=responseElements.imageScanFindings.findings{} output=findings
       | mvexpand findings
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Vulnerabilities with severity high found in repository $repository$
     entity:
@@ -59,6 +59,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
index efdc8f0112c..1608370bfe5 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies low, informational, or unknown severity findings from AWS Elastic Container Registry (ECR) image scans. It leverages AWS CloudTrail logs, specifically the DescribeImageScanFindings event, to detect these findings. This activity is significant for a SOC as it helps in early identification of potential vulnerabilities or misconfigurations in container images, which could be exploited if left unaddressed. If confirmed malicious, these findings could lead to unauthorized access, data breaches, or further exploitation within the containerized environment.
 data_source:
     - AWS CloudTrail DescribeImageScanFindings
-search: |-
+search: |
     `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
       | spath path=responseElements.imageScanFindings.findings{} output=findings
       | mvexpand findings
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -59,6 +59,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
index 3cc23e9574e..fa8d1544464 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies medium-severity findings from AWS Elastic Container Registry (ECR) image scans. It leverages AWS CloudTrail logs, specifically the DescribeImageScanFindings event, to detect vulnerabilities in container images. This activity is significant for a SOC as it highlights potential security risks in containerized applications, which could be exploited if not addressed. If confirmed malicious, these vulnerabilities could lead to unauthorized access, data breaches, or further exploitation within the container environment, compromising the overall security posture.
 data_source:
     - AWS CloudTrail DescribeImageScanFindings
-search: |-
+search: |
     `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
       | spath path=responseElements.imageScanFindings.findings{} output=findings
       | mvexpand findings
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -59,6 +59,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
index d88c9b0f336..f907b28555e 100644
--- a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
+++ b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the upload of a new container image to AWS Elastic Container Registry (ECR) outside of standard business hours. It leverages AWS CloudTrail logs to identify `PutImage` events occurring between 8 PM and 8 AM or on weekends. This activity is significant because container uploads outside business hours can indicate unauthorized or suspicious activity, potentially pointing to a compromised account or insider threat. If confirmed malicious, this could allow an attacker to deploy unauthorized or malicious containers, leading to potential data breaches or service disruptions.
 data_source:
     - AWS CloudTrail PutImage
-search: |-
-    `cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20 OR date_hour<8 OR date_wday=saturday OR date_wday=sunday
-      | rename requestParameters.* as *
-      | rename repositoryName AS repository
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature user user_agent
-           src vendor_account vendor_region
-           vendor_product repository
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_ecr_container_upload_outside_business_hours_filter`
+search: |
+    `cloudtrail` eventName=PutImage (eventSource="ecr.amazonaws.com" date_hour>=20) OR date_hour<8 OR date_wday IN ("saturday", "sunday") | stats count min(_time) as firstTime max(_time) as lastTime by user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_outside_business_hours_filter`
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 known_false_positives: When your development is spreaded in different time zones, applying this rule can be difficult.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -58,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/aws_ecr_container_upload.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_ecr_container_upload_unknown_user.yml b/detections/cloud/aws_ecr_container_upload_unknown_user.yml
index b1c0f82d672..bfb0464b723 100644
--- a/detections/cloud/aws_ecr_container_upload_unknown_user.yml
+++ b/detections/cloud/aws_ecr_container_upload_unknown_user.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the upload of a new container image to AWS Elastic Container Registry (ECR) by an unknown user. It leverages AWS CloudTrail logs to identify `PutImage` events from the ECR service, filtering out known users. This activity is significant because container uploads should typically be performed by a limited set of authorized users. If confirmed malicious, this could indicate unauthorized access, potentially leading to the deployment of malicious containers, data exfiltration, or further compromise of the AWS environment.
 data_source:
     - AWS CloudTrail PutImage
-search: |-
-    `cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage NOT `aws_ecr_users`
-      | rename requestParameters.* as *
-      | rename repositoryName AS image
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature user user_agent
-           src vendor_account vendor_region
-           vendor_product image
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_ecr_container_upload_unknown_user_filter`
+search: |
+    `cloudtrail` eventName=PutImage eventSource="ecr.amazonaws.com" NOT userName="user" | stats count min(_time) as firstTime max(_time) as lastTime by user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_unknown_user_filter`
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -58,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/aws_ecr_container_upload.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml
index c80bf1cfb40..652083c19fc 100644
--- a/detections/cloud/aws_excessive_security_scanning.yml
+++ b/detections/cloud/aws_excessive_security_scanning.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic identifies excessive security scanning activities in AWS by detecting a high number of Describe, List, or Get API calls from a single user. It leverages AWS CloudTrail logs to count distinct event names and flags users with more than 50 such events. This behavior is significant as it may indicate reconnaissance activities by an attacker attempting to map out your AWS environment. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or further exploitation of your cloud infrastructure.
 data_source:
     - AWS CloudTrail
-search: |-
-    `cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*
-      | fillnull
-      | rename user_name as user
-      | stats dc(signature) as dc_events min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(dest) as dest values(user_agent) as user_agent values(src) as src values(vendor_account) as vendor_account values(vendor_region) as vendor_region
-        BY user
-      | where dc_events > 50
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_excessive_security_scanning_filter`
+search: |
+    `cloudtrail` eventName IN ("Describe*", "List*", "Get*") | eval user=user_name, src=src, dc_events=dc_events, signature=signature | stats count min(_time) as firstTime max(_time) as lastTime by eventName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_excessive_security_scanning_filter`
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50, using the following actions $signature$.
     entity:
@@ -56,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml
index bcf270c0fc0..b64c104f0ff 100644
--- a/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml
+++ b/detections/cloud/aws_exfiltration_via_anomalous_getobject_api_activity.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. It leverages AWS CloudTrail logs and uses the `anomalydetection` command to detect unusual patterns in the frequency of GetObject API calls by analyzing fields such as "count," "user_type," and "user_arn" within a 10-minute window. This activity is significant as it may indicate unauthorized data access or exfiltration from S3 buckets. If confirmed malicious, attackers could exfiltrate sensitive data, leading to data breaches and compliance violations.
 data_source:
     - AWS CloudTrail GetObject
-search: |-
+search: |
     `cloudtrail` eventName=GetObject
       | bin _time span=10m
       | rename user_name as user
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -59,6 +59,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_exfil_high_no_getobject/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_exfiltration_via_batch_service.yml b/detections/cloud/aws_exfiltration_via_batch_service.yml
index 310a4844664..aa0c5783868 100644
--- a/detections/cloud/aws_exfiltration_via_batch_service.yml
+++ b/detections/cloud/aws_exfiltration_via_batch_service.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies the creation of AWS Batch jobs that could potentially abuse the AWS Bucket Replication feature on S3 buckets. It leverages AWS CloudTrail logs to detect the `JobCreated` event, analyzing job details and their status. This activity is significant because attackers can exploit this feature to exfiltrate data by creating malicious batch jobs. If confirmed malicious, this could lead to unauthorized data transfer between S3 buckets, resulting in data breaches and loss of sensitive information.
 data_source:
     - AWS CloudTrail JobCreated
-search: |-
+search: |
     `cloudtrail` eventName = JobCreated
       | fillnull
       | rename user_name as user
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: AWS Batch Job is created on account id - $vendor_account$ from src_ip $src$
     entity:
@@ -58,6 +58,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_exfiltration_via_bucket_replication.yml b/detections/cloud/aws_exfiltration_via_bucket_replication.yml
index 1b48b8acc09..a8f78ac423d 100644
--- a/detections/cloud/aws_exfiltration_via_bucket_replication.yml
+++ b/detections/cloud/aws_exfiltration_via_bucket_replication.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects API calls to enable S3 bucket replication services. It leverages AWS CloudTrail logs to identify `PutBucketReplication` events, focusing on fields like `bucketName`, `ReplicationConfiguration.Rule.Destination.Bucket`, and user details. This activity is significant as it can indicate unauthorized data replication, potentially leading to data exfiltration. If confirmed malicious, attackers could replicate sensitive data to external accounts, leading to data breaches and compliance violations.
 data_source:
     - AWS CloudTrail PutBucketReplication
-search: |-
-    `cloudtrail`  eventName = PutBucketReplication eventSource = s3.amazonaws.com
-      | rename user_name as user, requestParameters.ReplicationConfiguration.Rule.Destination.Bucket as bucket_name
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product bucket_name
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_exfiltration_via_bucket_replication_filter`
+search: |
+    `cloudtrail` eventName=PutBucketReplication eventSource="s3.amazonaws.com" | eval bucket_name=bucket_name | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_bucket_replication_filter`
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 known_false_positives: It is possible that an AWS admin has legitimately implemented data replication to ensure data availability and improve data protection/backup strategies.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_arn$" and "$aws_account_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_arn$", "$aws_account_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: AWS Bucket Replication rule added to $bucket_name$ by user $user$ from IP Address - $src$
     entity:
@@ -57,6 +49,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_exfiltration_via_datasync_task.yml b/detections/cloud/aws_exfiltration_via_datasync_task.yml
index 53cde017959..03fe56436a4 100644
--- a/detections/cloud/aws_exfiltration_via_datasync_task.yml
+++ b/detections/cloud/aws_exfiltration_via_datasync_task.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. It leverages AWS CloudTrail logs to identify the `CreateTask` event from the DataSync service. This activity is significant because attackers can misuse DataSync to transfer sensitive data from a private AWS location to a public one, leading to data compromise. If confirmed malicious, this could result in unauthorized access to sensitive information, causing severe data breaches and compliance violations.
 data_source:
     - AWS CloudTrail CreateTask
-search: |-
-    `cloudtrail` eventName = CreateTask eventSource="datasync.amazonaws.com"
-      | rename  requestParameters.*  as *
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product destinationLocationArn
-           sourceLocationArn
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_exfiltration_via_datasync_task_filter`
+search: |
+    `cloudtrail` eventName=CreateTask eventSource="datasync.amazonaws.com" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 known_false_positives: It is possible that an AWS Administrator has legitimately created this task for creating backup. Please check the `sourceLocationArn` and `destinationLocationArn` of this task
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: DataSync task created on account id - $vendor_account$ by user $user$ from src_ip $src$
     entity:
@@ -61,6 +51,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml
index 5a334b61761..74e7344d20f 100644
--- a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml
+++ b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml
@@ -12,7 +12,7 @@ data_source:
     - AWS CloudTrail DescribeSnapshotAttribute
     - AWS CloudTrail ModifySnapshotAttribute
     - AWS CloudTrail DeleteSnapshot
-search: |-
+search: |
     `cloudtrail` eventName IN ("CreateSnapshot", "DescribeSnapshotAttribute", "ModifySnapshotAttribute", "DeleteSnapshot") src_ip !="guardduty.amazonaws.com"
       | bin _time span=5m
       | rename user_name as user
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential AWS EC2 Exfiltration detected on account id - $vendor_account$ by user $user$ from src_ip $src$
     entity:
@@ -64,6 +64,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml
index 1f8779fa26e..82cd916755a 100644
--- a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml
+++ b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects an AWS account experiencing more than 20 failed authentication attempts within a 5-minute window. It leverages AWS CloudTrail logs to identify multiple failed ConsoleLogin events. This behavior is significant as it may indicate a brute force attack targeting the account. If confirmed malicious, the attacker could potentially gain unauthorized access, leading to data breaches or further exploitation of the AWS environment. Security teams should consider adjusting the threshold based on their specific environment to reduce false positives.
 data_source:
     - AWS CloudTrail ConsoleLogin
-search: |-
+search: |
     `cloudtrail` eventName=ConsoleLogin action=failure
       | bucket span=10m _time
       | rename user_name as user
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -56,6 +56,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml
index a5f48c54870..eee0368626d 100644
--- a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml
+++ b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects an IP address with 20 or more failed authentication attempts to the AWS Web Console within a 5-minute window. This detection leverages CloudTrail logs, aggregating failed login events by IP address and time span. This activity is significant as it may indicate a brute force attack aimed at gaining unauthorized access or escalating privileges within an AWS environment. If confirmed malicious, this could lead to unauthorized access, data breaches, or further exploitation of AWS resources.
 data_source:
     - AWS CloudTrail ConsoleLogin
-search: |-
+search: |
     `cloudtrail` eventName=ConsoleLogin action=failure
       | bucket span=10m _time
       | rename user_name as user
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml
index 6ecbd8ec56a..fb3ce88043f 100644
--- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml
+++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies excessive AccessDenied events within an hour timeframe for IAM users in AWS. It leverages AWS CloudTrail logs to detect multiple failed access attempts from the same source IP and user identity. This activity is significant as it may indicate that an access key has been compromised and is being misused for unauthorized discovery actions. If confirmed malicious, this could allow attackers to gather information about the AWS environment, potentially leading to further exploitation or privilege escalation.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     `cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com)
       | bucket _time span=1h
       | rename user_name as user
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -57,6 +57,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml
index 029ccac00a5..3f07a2781e6 100644
--- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml
+++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. It leverages AWS CloudTrail logs to identify `MalformedPolicyDocumentException` errors with a status of `failure` and filters out legitimate AWS services. This activity is significant as repeated failures to assume roles can indicate an adversary attempting to guess role names, which is a precursor to unauthorized access. If confirmed malicious, this could lead to unauthorized access to AWS resources, potentially compromising sensitive data and services.
 data_source:
     - AWS CloudTrail
-search: |-
-    `cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure (userAgent!=*.amazonaws.com)
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name
-        BY src, user, vendor_account
-           vendor_region, vendor_product, signature,
-           dest, errorCode
-      | where count >= 2
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_iam_assume_role_policy_brute_force_filter`
+search: |
+    `cloudtrail` errorCode="MalformedPolicyDocumentException" status="failure" NOT userAgent="*.amazonaws.com" | eval user=user_name, src=src, dc_events=dc_events, signature=signature | stats count min(_time) as firstTime max(_time) as lastTime by errorCode status userAgent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_assume_role_policy_brute_force_filter`
 how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS CloudTrail logs. Set the `where count` greater than a value to identify suspicious activity in your environment.
 known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users.
 references:
@@ -34,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has caused multiple failures with errorCode $errorCode$, which potentially means adversary is attempting to identify a role name.
     entity:
@@ -60,6 +51,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml
index 5ef9f44890c..f5f9531edf9 100644
--- a/detections/cloud/aws_iam_delete_policy.yml
+++ b/detections/cloud/aws_iam_delete_policy.yml
@@ -9,16 +9,8 @@ type: Hunting
 description: The following analytic detects the deletion of an IAM policy in AWS. It leverages AWS CloudTrail logs to identify `DeletePolicy` events, excluding those from AWS internal services. This activity is significant as unauthorized policy deletions can disrupt access controls and weaken security postures. If confirmed malicious, an attacker could remove critical security policies, potentially leading to privilege escalation, unauthorized access, or data exfiltration. Monitoring this behavior helps ensure that only authorized changes are made to IAM policies, maintaining the integrity and security of the AWS environment.
 data_source:
     - AWS CloudTrail DeletePolicy
-search: |-
-    `cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com)
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_iam_delete_policy_filter`
+search: |
+    `cloudtrail` eventName=DeletePolicy NOT userAgent="*.amazonaws.com" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`
 how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS CloudTrail logs.
 known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only.
 references:
@@ -39,6 +31,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml
index 82f055a9ac8..d8295d918b4 100644
--- a/detections/cloud/aws_iam_failure_group_deletion.yml
+++ b/detections/cloud/aws_iam_failure_group_deletion.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic identifies failed attempts to delete AWS IAM groups. It leverages AWS CloudTrail logs to detect events where the DeleteGroup action fails due to errors like NoSuchEntityException, DeleteConflictException, or AccessDenied. This activity is significant as it may indicate unauthorized attempts to modify IAM group configurations, which could be a precursor to privilege escalation or other malicious actions. If confirmed malicious, this could allow an attacker to disrupt IAM policies, potentially leading to unauthorized access or denial of service within the AWS environment.
 data_source:
     - AWS CloudTrail DeleteGroup
-search: |-
-    `cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode IN (NoSuchEntityException,DeleteConflictException, AccessDenied) (userAgent!=*.amazonaws.com)
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_iam_failure_group_deletion_filter`
+search: |
+    `cloudtrail` eventName=DeleteGroup eventSource="iam.amazonaws.com" errorCode IN ("NoSuchEntityException", "DeleteConflictException", "AccessDenied") NOT userAgent="*.amazonaws.com" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_failure_group_deletion_filter`
 how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS CloudTrail logs.
 known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -57,6 +49,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml
index 9b11233109a..d954fb679ef 100644
--- a/detections/cloud/aws_iam_successful_group_deletion.yml
+++ b/detections/cloud/aws_iam_successful_group_deletion.yml
@@ -9,16 +9,8 @@ type: Hunting
 description: The following analytic identifies the successful deletion of an IAM group in AWS. It leverages CloudTrail logs to detect `DeleteGroup` events with a success status. This activity is significant as it could indicate potential changes in user permissions or access controls, which may be a precursor to further unauthorized actions. If confirmed malicious, an attacker could disrupt access management, potentially leading to privilege escalation or unauthorized access to sensitive resources. Analysts should review related IAM events, such as recent user additions or new group creations, to assess the broader context.
 data_source:
     - AWS CloudTrail DeleteGroup
-search: |-
-    `cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success (userAgent!=*.amazonaws.com)
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_iam_successful_group_deletion_filter`
+search: |
+    `cloudtrail` eventName=DeleteGroup eventSource="iam.amazonaws.com" errorCode="success" NOT userAgent="*.amazonaws.com" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_successful_group_deletion_filter`
 how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS CloudTrail logs.
 known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
 references:
@@ -40,6 +32,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_lambda_updatefunctioncode.yml b/detections/cloud/aws_lambda_updatefunctioncode.yml
index 76e78a0d6db..1b413c014fe 100644
--- a/detections/cloud/aws_lambda_updatefunctioncode.yml
+++ b/detections/cloud/aws_lambda_updatefunctioncode.yml
@@ -9,16 +9,8 @@ type: Hunting
 description: The following analytic identifies IAM users attempting to update or modify AWS Lambda code via the AWS CLI. It leverages CloudTrail logs to detect successful `UpdateFunctionCode` events initiated by IAM users. This activity is significant as it may indicate an attempt to gain persistence, further access, or plant backdoors within your AWS environment. If confirmed malicious, an attacker could upload and execute malicious code automatically when the Lambda function is triggered, potentially compromising the integrity and security of your AWS infrastructure.
 data_source:
     - AWS CloudTrail
-search: |-
-    `cloudtrail` eventSource=lambda.amazonaws.com eventName=UpdateFunctionCode*  errorCode = success  user_type=IAMUser
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_lambda_updatefunctioncode_filter`
+search: |
+    `cloudtrail` eventSource="lambda.amazonaws.com" eventName="UpdateFunctionCode*" errorCode="success" user_type="IAMUser" | eval user=user_name, src=src, dc_events=dc_events, signature=signature | stats count min(_time) as firstTime max(_time) as lastTime by eventSource eventName errorCode user_type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_lambda_updatefunctioncode_filter`
 how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in your AWS Environment.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin or an autorized IAM user has updated the lambda fuction code legitimately.
 references:
@@ -39,6 +31,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/aws_updatelambdafunctioncode/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_multi_factor_authentication_disabled.yml b/detections/cloud/aws_multi_factor_authentication_disabled.yml
index 202ab13c2bb..41d1e08d3ad 100644
--- a/detections/cloud/aws_multi_factor_authentication_disabled.yml
+++ b/detections/cloud/aws_multi_factor_authentication_disabled.yml
@@ -10,16 +10,8 @@ description: The following analytic detects attempts to disable multi-factor aut
 data_source:
     - AWS CloudTrail DeleteVirtualMFADevice
     - AWS CloudTrail DeactivateMFADevice
-search: |-
-    `cloudtrail` (eventName= DeleteVirtualMFADevice OR eventName=DeactivateMFADevice)
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_multi_factor_authentication_disabled_filter`
+search: |
+    `cloudtrail` eventName=DeleteVirtualMFADevice eventName="DeactivateMFADevice" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_multi_factor_authentication_disabled_filter`
 how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs.
 known_false_positives: AWS Administrators may disable MFA but it is highly unlikely for this event to occur without prior notice to the company
 references:
@@ -33,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$vendor_account$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$vendor_account$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has disabled Multi-Factor authentication for AWS account $vendor_account$
     entity:
@@ -61,6 +53,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_mfa_disabled/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml
index 3e8236e1c05..88db50ca30a 100644
--- a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml
+++ b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies multiple failed multi-factor authentication (MFA) requests to an AWS Console for a single user. It leverages AWS CloudTrail logs, specifically the `additionalEventData` field, to detect more than 10 failed MFA prompts within 5 minutes. This activity is significant as it may indicate an adversary attempting to bypass MFA by bombarding the user with repeated authentication requests. If confirmed malicious, this could lead to unauthorized access to the AWS environment, potentially compromising sensitive data and resources.
 data_source:
     - AWS CloudTrail ConsoleLogin
-search: |-
+search: |
     `cloudtrail` eventName= ConsoleLogin "additionalEventData.MFAUsed"=Yes errorMessage="Failed authentication"
       | bucket span=5m _time
       | rename user_name as user
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -60,6 +60,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_failed_mfa/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml
index 036d4ab9803..d69143edab0 100644
--- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml
+++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a single source IP failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. It leverages CloudTrail logs to detect multiple failed login attempts from the same IP address. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain unauthorized access or elevate privileges by trying common passwords across many accounts. If confirmed malicious, this activity could lead to unauthorized access, data breaches, or further exploitation within the AWS environment.
 data_source:
     - AWS CloudTrail ConsoleLogin
-search: |-
+search: |
     `cloudtrail` eventName=ConsoleLogin action=failure
       | bucket span=10m _time
       | rename user_name as user
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
index ac2c437f9c5..d58f5f04111 100644
--- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
+++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
@@ -10,7 +10,7 @@ description: The following analytic detects the creation of AWS Network Access C
 data_source:
     - AWS CloudTrail CreateNetworkAclEntry
     - AWS CloudTrail ReplaceNetworkAclEntry
-search: |-
+search: |
     `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1
       | append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol!=-1
       | eval port_range='requestParameters.portRange.to' - 'requestParameters.portRange.from'
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$
     entity:
@@ -62,6 +62,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_create_acl/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml
index 13b362f167c..5b23fccb277 100644
--- a/detections/cloud/aws_network_access_control_list_deleted.yml
+++ b/detections/cloud/aws_network_access_control_list_deleted.yml
@@ -9,17 +9,8 @@ type: Anomaly
 description: The following analytic detects the deletion of AWS Network Access Control Lists (ACLs). It leverages AWS CloudTrail logs to identify events where a user deletes a network ACL entry. This activity is significant because deleting a network ACL can remove critical access restrictions, potentially allowing unauthorized access to cloud instances. If confirmed malicious, this action could enable attackers to bypass network security controls, leading to unauthorized access, data exfiltration, or further compromise of the cloud environment.
 data_source:
     - AWS CloudTrail DeleteNetworkAclEntry
-search: |-
-    `cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false
-      | fillnull
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_network_access_control_list_deleted_filter`
+search: |
+    `cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress="false" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`
 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs.
 known_false_positives: It's possible that a user has legitimately deleted a network ACL.
 references: []
@@ -31,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -56,6 +47,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_delete_acl/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_new_mfa_method_registered_for_user.yml b/detections/cloud/aws_new_mfa_method_registered_for_user.yml
index c820a68044c..29dcfefd7f1 100644
--- a/detections/cloud/aws_new_mfa_method_registered_for_user.yml
+++ b/detections/cloud/aws_new_mfa_method_registered_for_user.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for an AWS account. It leverages AWS CloudTrail logs to identify the `CreateVirtualMFADevice` event. This activity is significant because adversaries who gain unauthorized access to an AWS account may register a new MFA method to maintain persistence. If confirmed malicious, this could allow attackers to secure their access, making it difficult to detect and remove their presence, potentially leading to further unauthorized activities and data breaches.
 data_source:
     - AWS CloudTrail CreateVirtualMFADevice
-search: |-
+search: |
     `cloudtrail` eventName=CreateVirtualMFADevice
       | rename userName as user
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new virtual device is added to user $user$
     entity:
@@ -59,6 +59,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_password_policy_changes.yml b/detections/cloud/aws_password_policy_changes.yml
index 13e9a4cdc20..78115936903 100644
--- a/detections/cloud/aws_password_policy_changes.yml
+++ b/detections/cloud/aws_password_policy_changes.yml
@@ -11,16 +11,8 @@ data_source:
     - AWS CloudTrail UpdateAccountPasswordPolicy
     - AWS CloudTrail GetAccountPasswordPolicy
     - AWS CloudTrail DeleteAccountPasswordPolicy
-search: |-
-    `cloudtrail` eventName IN ("UpdateAccountPasswordPolicy","GetAccountPasswordPolicy","DeleteAccountPasswordPolicy") errorCode=success
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_password_policy_changes_filter`
+search: |
+    `cloudtrail` eventName=UpdateAccountPasswordPolicy eventName IN ("GetAccountPasswordPolicy", "DeleteAccountPasswordPolicy") errorCode="success" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_password_policy_changes_filter`
 how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately triggered an AWS audit tool activity which may trigger this event.
 references:
@@ -41,6 +33,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_password_policy/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_s3_exfiltration_behavior_identified.yml b/detections/cloud/aws_s3_exfiltration_behavior_identified.yml
index a80f6961540..6ade0e9631b 100644
--- a/detections/cloud/aws_s3_exfiltration_behavior_identified.yml
+++ b/detections/cloud/aws_s3_exfiltration_behavior_identified.yml
@@ -8,7 +8,7 @@ status: production
 type: Correlation
 description: The following analytic identifies potential AWS S3 exfiltration behavior by correlating multiple risk events related to Collection and Exfiltration techniques. It leverages risk events from AWS sources, focusing on instances where two or more unique analytics and distinct MITRE ATT&CK IDs are triggered for a specific risk object. This activity is significant as it may indicate an ongoing data exfiltration attempt, which is critical for security teams to monitor. If confirmed malicious, this could lead to unauthorized access and theft of sensitive information, compromising the organization's data integrity and confidentiality.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count values(All_Risk.risk_message) as risk_message FROM datamodel=Risk.All_Risk
       WHERE All_Risk.annotations.mitre_attack.mitre_tactic = "collection"
         OR
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$risk_object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious AWS S3 exfiltration behavior identified - $risk_object$
     entity:
@@ -56,6 +56,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_exfil_risk_events/aws_risk.log
-          sourcetype: stash
           source: aws_exfil
+          sourcetype: stash
       test_type: unit
diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml
index ddd2ebdfce0..b2568284460 100644
--- a/detections/cloud/aws_saml_update_identity_provider.yml
+++ b/detections/cloud/aws_saml_update_identity_provider.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects updates to the SAML provider in AWS. It leverages AWS CloudTrail logs to identify the `UpdateSAMLProvider` event, analyzing fields such as `sAMLProviderArn`, `sourceIPAddress`, and `userIdentity` details. Monitoring updates to the SAML provider is crucial as it may indicate a perimeter compromise of federated credentials or unauthorized backdoor access set by an attacker. If confirmed malicious, this activity could allow attackers to manipulate identity federation, potentially leading to unauthorized access to cloud resources and sensitive data.
 data_source:
     - AWS CloudTrail UpdateSAMLProvider
-search: |-
+search: |
     `cloudtrail` eventName=UpdateSAMLProvider
       | rename user_name as user
       | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.sAMLProviderArn) as request_parameters
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ from IP address $src$ has trigged an event $signature$ to update the SAML provider to $request_parameters$
     entity:
@@ -59,6 +59,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml
index b119854b9e8..04005ec89c4 100644
--- a/detections/cloud/aws_setdefaultpolicyversion.yml
+++ b/detections/cloud/aws_setdefaultpolicyversion.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects when a user sets a default policy version in AWS. It leverages AWS CloudTrail logs to identify the `SetDefaultPolicyVersion` event from the IAM service. This activity is significant because attackers may exploit this technique for privilege escalation, especially if previous policy versions grant more extensive permissions than the current one. If confirmed malicious, this could allow an attacker to gain elevated access to AWS resources, potentially leading to unauthorized actions and data breaches.
 data_source:
     - AWS CloudTrail SetDefaultPolicyVersion
-search: |-
-    `cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazonaws.com
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_setdefaultpolicyversion_filter`
+search: |
+    `cloudtrail` eventName=SetDefaultPolicyVersion eventSource="iam.amazonaws.com" | eval signature=signature | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_setdefaultpolicyversion_filter`
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: From IP address $src$, user $user$ has trigged an action $signature$ for updating the the default policy version
     entity:
@@ -57,6 +49,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_setdefaultpolicyversion/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml b/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml
index 108aea8b528..7125e82b640 100644
--- a/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml
+++ b/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects an AWS account successfully authenticating from multiple unique IP addresses within a 5-minute window. It leverages AWS CloudTrail logs, specifically monitoring `ConsoleLogin` events and counting distinct source IPs. This behavior is significant as it may indicate compromised credentials, potentially from a phishing attack, being used concurrently by an adversary and a legitimate user. If confirmed malicious, this activity could allow unauthorized access to corporate resources, leading to data breaches or further exploitation within the AWS environment.
 data_source:
     - AWS CloudTrail ConsoleLogin
-search: |-
+search: |
     `cloudtrail` eventName = ConsoleLogin
       | bin span=5m _time
       | rename user_name as user
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -59,6 +59,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_successful_single_factor_authentication.yml b/detections/cloud/aws_successful_single_factor_authentication.yml
index c0efc2e1e50..88d097c5b4c 100644
--- a/detections/cloud/aws_successful_single_factor_authentication.yml
+++ b/detections/cloud/aws_successful_single_factor_authentication.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies a successful Console Login authentication event for an AWS IAM user account without Multi-Factor Authentication (MFA) enabled. It leverages AWS CloudTrail logs to detect instances where MFA was not used during login. This activity is significant as it may indicate a misconfiguration, policy violation, or potential account takeover attempt. If confirmed malicious, an attacker could gain unauthorized access to the AWS environment, potentially leading to data exfiltration, resource manipulation, or further privilege escalation.
 data_source:
     - AWS CloudTrail ConsoleLogin
-search: |-
+search: |
     `cloudtrail` eventName= ConsoleLogin errorCode=success "additionalEventData.MFAUsed"=No
       | rename user_name as user
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has successfully logged into an AWS Console without Multi-Factor Authentication from $src$
     entity:
@@ -59,6 +59,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/aws_login_sfa/cloudtrail.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml
index af466fe7d62..4d19acfe989 100644
--- a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml
+++ b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a single source IP failing to authenticate into the AWS Console with multiple valid users. It uses CloudTrail logs and calculates the standard deviation for source IP, leveraging the 3-sigma rule to detect unusual numbers of failed authentication attempts. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access, data breaches, or further exploitation within the AWS environment.
 data_source:
     - AWS CloudTrail ConsoleLogin
-search: |-
+search: |
     `cloudtrail` eventName=ConsoleLogin action=failure
       | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region
       | bucket span=10m _time
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$tried_accounts$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$tried_accounts$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: tried_accounts
diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml
index 077b1038f3a..5eac914a0df 100644
--- a/detections/cloud/aws_updateloginprofile.yml
+++ b/detections/cloud/aws_updateloginprofile.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects an AWS CloudTrail event where a user with permissions updates the login profile of another user. It leverages CloudTrail logs to identify instances where the user making the change is different from the user whose profile is being updated. This activity is significant because it can indicate privilege escalation attempts, where an attacker uses a compromised account to gain higher privileges. If confirmed malicious, this could allow the attacker to escalate their privileges, potentially leading to unauthorized access and control over sensitive resources within the AWS environment.
 data_source:
     - AWS CloudTrail UpdateLoginProfile
-search: |-
-    `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success
-      | eval match=if(match(userIdentity.userName,requestParameters.userName), 1,0)
-      | search match=0
-      | rename user_name as user
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           user_agent src vendor_account
-           vendor_region vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `aws_updateloginprofile_filter`
+search: |
+    `cloudtrail` eventName=UpdateLoginProfile NOT userAgent="console.amazonaws.com" errorCode="success" match="0" | stats count min(_time) as firstTime max(_time) as lastTime by dest user user_agent src vendor_account vendor_region vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_updateloginprofile_filter`
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: From IP address $src$, user agent $user_agent$ has trigged an event UpdateLoginProfile for updating the existing login profile, potentially giving user $user$ more access privilleges
     entity:
@@ -59,6 +49,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_updateloginprofile/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/azure_active_directory_high_risk_sign_in.yml b/detections/cloud/azure_active_directory_high_risk_sign_in.yml
index b2ccbcbb8b5..55a1468eaa6 100644
--- a/detections/cloud/azure_active_directory_high_risk_sign_in.yml
+++ b/detections/cloud/azure_active_directory_high_risk_sign_in.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic detects high-risk sign-in attempts against Azure Active Directory, identified by Azure Identity Protection. It leverages the RiskyUsers and UserRiskEvents log categories from Azure AD events ingested via EventHub. This activity is significant as it indicates potentially compromised accounts, flagged by heuristics and machine learning. If confirmed malicious, attackers could gain unauthorized access to sensitive resources, leading to data breaches or further exploitation within the environment.
 data_source:
     - Azure Active Directory
-search: |-
-    `azure_monitor_aad` category=UserRiskEvents properties.riskLevel=high
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest user src
-           vendor_account vendor_product category
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `azure_active_directory_high_risk_sign_in_filter`
+search: |
+    `azure_monitor_aad` category="UserRiskEvents" properties.riskLevel="high" | eval initiatedBy='initiatedBy.user.userPrincipalName' | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_active_directory_high_risk_sign_in_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents log category in the azure:monitor:aad sourcetype.
 known_false_positives: Details for the risk calculation algorithm used by Identity Protection are unknown and may be prone to false positives.
 references:
@@ -33,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A high risk event was identified by Identify Protection for user $user$
     entity:
diff --git a/detections/cloud/azure_ad_admin_consent_bypassed_by_service_principal.yml b/detections/cloud/azure_ad_admin_consent_bypassed_by_service_principal.yml
index 6a796eabb28..1a429724c18 100644
--- a/detections/cloud/azure_ad_admin_consent_bypassed_by_service_principal.yml
+++ b/detections/cloud/azure_ad_admin_consent_bypassed_by_service_principal.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies instances where a service principal in Azure Active Directory assigns app roles without standard admin consent. It uses Entra ID logs from the `azure_monitor_aad` data source, focusing on the "Add app role assignment to service principal" operation. This detection is significant as it highlights potential bypasses of critical administrative consent processes, which could lead to unauthorized privileges being granted. If confirmed malicious, this activity could allow attackers to exploit automation to assign sensitive permissions without proper oversight, potentially compromising the security of the Azure AD environment.
 data_source:
     - Azure Active Directory Add app role assignment to service principal
-search: "`azure_monitor_aad` (operationName=\"Add app role assignment to service principal\" OR operationName=\"Add member to role*\") src_user_type=servicePrincipal | rename properties.* as * | eval roleId = mvindex('targetResources{}.modifiedProperties{}.newValue',0) | eval roleValue = mvindex('targetResources{}.modifiedProperties{}.newValue',1) | eval roleDescription = mvindex('targetResources{}.modifiedProperties{}.newValue',2) | eval user_id = mvindex('targetResources{}.id', 0), user=coalesce(user,mvindex('targetResources{}.displayName',0)) | rename initiatedBy.app.displayName as src_user, userAgent as user_agent | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product src_user user_id roleId roleValue roleDescription user_agent signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_admin_consent_bypassed_by_service_principal_filter`"
+search: |
+    `azure_monitor_aad` operationName=Add app role assignment to service principal operationName="Add member to role*" src_user_type="servicePrincipal" | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_admin_consent_bypassed_by_service_principal_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Auditlog log category
 known_false_positives: Service Principals are sometimes configured to legitimately bypass the consent process for purposes of automation. Filter as needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Service principal $src_user$ bypassed the admin consent process and granted permissions to $user$
     entity:
diff --git a/detections/cloud/azure_ad_application_administrator_role_assigned.yml b/detections/cloud/azure_ad_application_administrator_role_assigned.yml
index 396a07969cb..9745720f66e 100644
--- a/detections/cloud/azure_ad_application_administrator_role_assigned.yml
+++ b/detections/cloud/azure_ad_application_administrator_role_assigned.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies the assignment of the Application Administrator role to an Azure AD user. It leverages Azure Active Directory events, specifically monitoring the "Add member to role" operation. This activity is significant because users in this role can manage all aspects of enterprise applications, including credentials, which can be used to impersonate application identities. If confirmed malicious, an attacker could escalate privileges, manage application settings, and potentially access sensitive resources by impersonating application identities, posing a significant security risk to the Azure AD tenant.
 data_source:
     - Azure Active Directory Add member to role
-search: |-
+search: |
     `azure_monitor_aad`  operationName="Add member to role"  "properties.targetResources{}.modifiedProperties{}.newValue"="*Application Administrator*"
       | rename properties.* as *
       | rename initiatedBy.user.userPrincipalName as initiatedBy, userAgent as user_agent
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The privileged Azure AD role Application Administrator was assigned for User $user$ initiated by $initiatedBy$
     entity:
diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml
index 589846cc18f..69e27b79ec2 100644
--- a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml
+++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml
@@ -9,9 +9,12 @@ type: TTP
 description: The following analytic identifies failed authentication attempts against an Azure AD tenant during the Multi-Factor Authentication (MFA) challenge, specifically flagged by error code 500121. It leverages Azure AD SignInLogs to detect these events. This activity is significant as it may indicate an adversary attempting to authenticate using compromised credentials on an account with MFA enabled. If confirmed malicious, this could suggest an ongoing effort to bypass MFA protections, potentially leading to unauthorized access and further compromise of the affected account.
 data_source:
     - Azure Active Directory
-search: "`azure_monitor_aad` category=SignInLogs properties.status.errorCode=500121 | rename properties.* as *, authenticationDetails{}.* as * | eval time=strptime(authenticationStepDateTime,\"%Y-%m-%dT%H:%M:%S\") | eval auth_detail=mvzip(strftime(time, \"%Y-%m-%dT%H:%M:%S\"),authenticationStepResultDetail,\" - \"), auth_msg=mvappend('status.additionalDetails', authenticationStepResultDetail) | eval auth_method=mvmap(authenticationMethod, if(isnull(mvfind('mfaDetail.authMethod',authenticationMethod)), authenticationMethod, null())) | search NOT auth_msg=\"MFA successfully completed\" | rename userAgent as user_agent | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product auth_method auth_msg user_agent signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_authentication_failed_during_mfa_challenge_filter`"
+search: |
+    `azure_monitor_aad` category="SignInLogs" properties.status.errorCode="500121" NOT auth_msg="MFA successfully completed" | eval initiatedBy='initiatedBy.user.userPrincipalName' | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_authentication_failed_during_mfa_challenge_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
-known_false_positives: "False positives have been minimized by removing attempts that result in 'MFA successfully completed messages', which were found to be generated when a user opts to use a different MFA method than the default.\nFurther reductions in finding events can be achieved through filtering 'MFA denied; duplicate authentication attempt' messages within the auth_msg field, as they could arguably be considered as false positives."
+known_false_positives: 'False positives have been minimized by removing attempts that result in ''MFA successfully completed messages'', which were found to be generated when a user opts to use a different MFA method than the default.
+
+    Further reductions in finding events can be achieved through filtering ''MFA denied; duplicate authentication attempt'' messages within the auth_msg field, as they could arguably be considered as false positives.'
 references:
     - https://attack.mitre.org/techniques/T1621/
     - https://attack.mitre.org/techniques/T1078/004/
@@ -25,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ failed to pass MFA challenge
     entity:
diff --git a/detections/cloud/azure_ad_azurehound_useragent_detected.yml b/detections/cloud/azure_ad_azurehound_useragent_detected.yml
index 665f85ab79e..260c0a87c10 100644
--- a/detections/cloud/azure_ad_azurehound_useragent_detected.yml
+++ b/detections/cloud/azure_ad_azurehound_useragent_detected.yml
@@ -10,18 +10,8 @@ description: This detection identifies the presence of the default AzureHound us
 data_source:
     - Azure Active Directory NonInteractiveUserSignInLogs
     - Azure Active Directory MicrosoftGraphActivityLogs
-search: |-
-    `azure_monitor_aad` category IN (MicrosoftGraphActivityLogs, NonInteractiveUserSignInLogs) properties.userAgent=azurehound*
-      | rename properties.userAgent as user_agent
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest user src
-           vendor_account vendor_product user_agent
-           signature
-      | iplocation src
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `azure_ad_azurehound_useragent_detected_filter`
+search: |
+    `azure_monitor_aad` category IN ("MicrosoftGraphActivityLogs", "NonInteractiveUserSignInLogs") properties.userAgent="azurehound*" | eval user_agent='properties.userAgent', dest=dest | stats count min(_time) as firstTime max(_time) as lastTime by category userAgent src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_azurehound_useragent_detected_filter`
 how_to_implement: The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest NonInteractiveUserSignInLogs and MicrosoftGraphActivityLogs via an Azure EventHub. See reference for links for further details.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -36,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: AzureHound UserAgent String $user_agent$ Detected on Tenant $dest$
     entity:
@@ -63,6 +53,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.004/azurehound/azurehound.log
-          sourcetype: azure:monitor:aad
           source: Azure AD
+          sourcetype: azure:monitor:aad
       test_type: unit
diff --git a/detections/cloud/azure_ad_block_user_consent_for_risky_apps_disabled.yml b/detections/cloud/azure_ad_block_user_consent_for_risky_apps_disabled.yml
index 7277a937518..0eb6ba98041 100644
--- a/detections/cloud/azure_ad_block_user_consent_for_risky_apps_disabled.yml
+++ b/detections/cloud/azure_ad_block_user_consent_for_risky_apps_disabled.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. It monitors Azure Active Directory logs for the "Update authorization policy" operation, specifically changes to the "AllowUserConsentForRiskyApps" setting. This activity is significant because disabling this feature can expose the organization to OAuth phishing threats by allowing users to grant consent to potentially malicious applications. If confirmed malicious, attackers could gain unauthorized access to user data and sensitive information, leading to data breaches and further compromise within the organization.
 data_source:
     - Azure Active Directory Update authorization policy
-search: "`azure_monitor_aad` operationName=\"Update authorization policy\" | rename properties.* as * | eval index_number = if(mvfind('targetResources{}.modifiedProperties{}.displayName',\"AllowUserConsentForRiskyApps\") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName',\"AllowUserConsentForRiskyApps\"), -1) | search index_number >= 0 | eval AllowUserConsentForRiskyApps = mvindex('targetResources{}.modifiedProperties{}.newValue',index_number) | search AllowUserConsentForRiskyApps = \"[true]\" | rename userAgent as user_agent | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product user_agent signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_block_user_consent_for_risky_apps_disabled_filter`"
+search: |
+    `azure_monitor_aad` operationName=Update authorization policy index_number>=0 AllowUserConsentForRiskyApps="[true]" | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_block_user_consent_for_risky_apps_disabled_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
 known_false_positives: Legitimate changes to the 'risk-based step-up consent' setting by administrators, perhaps as part of a policy update or security assessment, may trigger this alert, necessitating verification of the change's intent and authorization
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ disabled the BlockUserConsentForRiskyApps Azure AD setting.
     entity:
diff --git a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml
index af473f0172e..41341016794 100644
--- a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml
+++ b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects an Azure AD account with concurrent sessions originating from multiple unique IP addresses within a 5-minute window. It leverages Azure Active Directory NonInteractiveUserSignInLogs to identify this behavior by analyzing successful authentication events and counting distinct source IPs. This activity is significant as it may indicate session hijacking, where an attacker uses stolen session cookies to access corporate resources from a different location. If confirmed malicious, this could lead to unauthorized access to sensitive information and potential data breaches.
 data_source:
     - Azure Active Directory
-search: |-
+search: |
     `azure_monitor_aad` properties.authenticationDetails{}.succeeded=true category=NonInteractiveUserSignInLogs action=success
       | rename properties.* as *
       | bucket span=5m _time
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has concurrent sessions from more than one unique IP address in the span of 5 minutes.
     entity:
diff --git a/detections/cloud/azure_ad_device_code_authentication.yml b/detections/cloud/azure_ad_device_code_authentication.yml
index ebe9864c608..24bf9b4d67f 100644
--- a/detections/cloud/azure_ad_device_code_authentication.yml
+++ b/detections/cloud/azure_ad_device_code_authentication.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies Azure Device Code Phishing attacks, which can lead to Azure Account Take-Over (ATO). It leverages Azure AD SignInLogs to detect suspicious authentication requests using the device code authentication protocol. This activity is significant as it indicates potential bypassing of Multi-Factor Authentication (MFA) and Conditional Access Policies (CAPs) through phishing emails. If confirmed malicious, attackers could gain unauthorized access to Azure AD, Exchange mailboxes, and Outlook Web Application (OWA), leading to potential data breaches and unauthorized data access.
 data_source:
     - Azure Active Directory
-search: |-
+search: |
     `azure_monitor_aad` category=SignInLogs "properties.authenticationProtocol"=deviceCode
       | rename properties.* as *
       | rename userAgent as user_agent
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Device code requested for $user$ from $src$
     entity:
diff --git a/detections/cloud/azure_ad_external_guest_user_invited.yml b/detections/cloud/azure_ad_external_guest_user_invited.yml
index 5860b56eb16..d6baee2c489 100644
--- a/detections/cloud/azure_ad_external_guest_user_invited.yml
+++ b/detections/cloud/azure_ad_external_guest_user_invited.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the invitation of an external guest user within Azure AD. It leverages Azure AD AuditLogs to identify events where an external user is invited, using fields such as operationName and initiatedBy. Monitoring these invitations is crucial as they can lead to unauthorized access if abused. If confirmed malicious, this activity could allow attackers to gain access to internal resources, potentially leading to data breaches or further exploitation of the environment.
 data_source:
     - Azure Active Directory Invite external user
-search: |-
+search: |
     `azure_monitor_aad` operationName="Invite external user"
       | rename properties.* as *
       | rename initiatedBy.user.userPrincipalName as initiatedBy
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: External Guest User $user$ initiated by $initiatedBy$
     entity:
diff --git a/detections/cloud/azure_ad_fullaccessasapp_permission_assigned.yml b/detections/cloud/azure_ad_fullaccessasapp_permission_assigned.yml
index 03581a60d51..698220c9e51 100644
--- a/detections/cloud/azure_ad_fullaccessasapp_permission_assigned.yml
+++ b/detections/cloud/azure_ad_fullaccessasapp_permission_assigned.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the assignment of the 'full_access_as_app' permission to an application within Office 365 Exchange Online. This is identified by the GUID 'dc890d15-9560-4a4c-9b7f-a736ec74ec40' and the ResourceAppId '00000002-0000-0ff1-ce00-000000000000'. The detection leverages the azure_monitor_aad data source, focusing on AuditLogs with the operation name 'Update application'. This activity is significant as it grants broad control over Office 365 operations, including full access to all mailboxes and the ability to send emails as any user. If malicious, this could lead to unauthorized access and data exfiltration.
 data_source:
     - Azure Active Directory Update application
-search: "`azure_monitor_aad` category=AuditLogs operationName=\"Update application\" | eval newvalue = mvindex('properties.targetResources{}.modifiedProperties{}.newValue',0) | spath input=newvalue | search \"{}.ResourceAppId\"=\"00000002-0000-0ff1-ce00-000000000000\" \"{}.RequiredAppPermissions{}.EntitlementId\"=\"dc890d15-9560-4a4c-9b7f-a736ec74ec40\" | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' | rename properties.userAgent as user_agent | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product user_agent Permissions object signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_fullaccessasapp_permission_assigned_filter`"
+search: |
+    `azure_monitor_aad` category=AuditLogs operationName="Update application" | eval newvalue = mvindex('properties.targetResources{}.modifiedProperties{}.newValue',0) | spath input=newvalue | search "{}.ResourceAppId"="00000002-0000-0ff1-ce00-000000000000" "{}.RequiredAppPermissions{}.EntitlementId"="dc890d15-9560-4a4c-9b7f-a736ec74ec40" | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' | rename properties.userAgent as user_agent | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product user_agent Permissions object signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_fullaccessasapp_permission_assigned_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.
 known_false_positives: The full_access_as_app API permission may be assigned to legitimate applications. Filter as needed.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ assigned the full_access_as_app permission to the app registration $object$
     entity:
diff --git a/detections/cloud/azure_ad_global_administrator_role_assigned.yml b/detections/cloud/azure_ad_global_administrator_role_assigned.yml
index 54a33678939..78815fd706a 100644
--- a/detections/cloud/azure_ad_global_administrator_role_assigned.yml
+++ b/detections/cloud/azure_ad_global_administrator_role_assigned.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the assignment of the Azure AD Global Administrator role to a user. It leverages Azure Active Directory AuditLogs to identify when the "Add member to role" operation includes the "Global Administrator" role. This activity is significant because the Global Administrator role grants extensive access to data, resources, and settings, similar to a Domain Administrator in traditional AD environments. If confirmed malicious, this could allow an attacker to establish persistence, escalate privileges, and potentially gain control over Azure resources, posing a severe security risk.
 data_source:
     - Azure Active Directory Add member to role
-search: |-
+search: |
     `azure_monitor_aad` operationName="Add member to role" properties.targetResources{}.modifiedProperties{}.newValue="*Global Administrator*"
       | rename properties.* as *
       | rename initiatedBy.user.userPrincipalName as initiatedBy
@@ -39,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Global Administrator Role assigned for User $user$ initiated by $initiatedBy$
     entity:
diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml
index b8b5d546496..b2aa853a03d 100644
--- a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml
+++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ failed to authenticate more than 20 times in the span of 10 minutes.
     entity:
diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml
index 39a7531cb93..7bb34c48210 100644
--- a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml
+++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $src$ failed to authenticate more than 20 times in the span of 10 minutes.
     entity:
diff --git a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml
index 3a3c8ea3384..43c208a3250 100644
--- a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml
+++ b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml
@@ -9,20 +9,8 @@ type: TTP
 description: The following analytic detects attempts to disable multi-factor authentication (MFA) for an Azure AD user. It leverages Azure Active Directory AuditLogs to identify the "Disable Strong Authentication" operation. This activity is significant because disabling MFA can allow adversaries to maintain persistence using compromised accounts without raising suspicion. If confirmed malicious, this action could enable attackers to bypass an essential security control, potentially leading to unauthorized access and prolonged undetected presence in the environment.
 data_source:
     - Azure Active Directory Disable Strong Authentication
-search: |-
-    `azure_monitor_aad` category=AuditLogs operationName="Disable Strong Authentication"
-      | rename properties.* as *
-      | rename targetResources{}.type as type
-      | rename initiatedBy.user.userPrincipalName as initiatedBy
-      | rename userAgent as user_agent
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest user src
-           vendor_account vendor_product user_agent
-           initiatedBy signature
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `azure_ad_multi_factor_authentication_disabled_filter`
+search: |
+    `azure_monitor_aad` operationName=Disable Strong Authentication category="AuditLogs" | eval initiatedBy='initiatedBy.user.userPrincipalName' | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_multi_factor_authentication_disabled_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.
 known_false_positives: Legitimate use case may require for users to disable MFA. Filter as needed.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: MFA disabled for User $user$ initiated by $initiatedBy$
     entity:
diff --git a/detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml b/detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml
index 2ed4e9d1f04..06357a03cf4 100644
--- a/detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml
+++ b/detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic detects potential distributed password spraying attacks in an Azure AD environment. It identifies a spike in failed authentication attempts across various user-and-IP combinations from multiple source IPs and countries, using different user agents. This detection leverages Azure AD SignInLogs, focusing on error code 50126 for failed authentications. This activity is significant as it indicates an adversary's attempt to bypass security controls by distributing login attempts. If confirmed malicious, this could lead to unauthorized access, data breaches, privilege escalation, and lateral movement within the organization's infrastructure.
 data_source:
     - Azure Active Directory
-search: |-
+search: |
     `azure_monitor_aad` category=*SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
       | rename properties.* as *
       | bucket span=5m _time
diff --git a/detections/cloud/azure_ad_multiple_appids_and_useragents_authentication_spike.yml b/detections/cloud/azure_ad_multiple_appids_and_useragents_authentication_spike.yml
index cabc1ce9d24..ef34b275a1b 100644
--- a/detections/cloud/azure_ad_multiple_appids_and_useragents_authentication_spike.yml
+++ b/detections/cloud/azure_ad_multiple_appids_and_useragents_authentication_spike.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects unusual authentication activity in Azure AD, specifically when a single user account has over 8 authentication attempts using 3+ unique application IDs and 5+ unique user agents within a short period. It leverages Azure AD audit logs, focusing on authentication events and using statistical thresholds. This behavior is significant as it may indicate an adversary probing for MFA requirements. If confirmed malicious, it suggests a compromised account, potentially leading to further exploitation, lateral movement, and data exfiltration. Early detection is crucial to prevent substantial harm.
 data_source:
     - Azure Active Directory Sign-in activity
-search: |-
+search: |
     `azure_monitor_aad` category=SignInLogs operationName="Sign-in activity" (properties.authenticationRequirement="multiFactorAuthentication" properties.status.additionalDetails="MFA required in Azure AD") OR (properties.authenticationRequirement=singleFactorAuthentication "properties.authenticationDetails{}.succeeded"=true)
       | bucket span=5m _time
       | rename properties.* as *
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/azure_ad_multiple_denied_mfa_requests_for_user.yml b/detections/cloud/azure_ad_multiple_denied_mfa_requests_for_user.yml
index d3a0d0ec295..cc512c5fd3b 100644
--- a/detections/cloud/azure_ad_multiple_denied_mfa_requests_for_user.yml
+++ b/detections/cloud/azure_ad_multiple_denied_mfa_requests_for_user.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects an unusually high number of denied Multi-Factor Authentication (MFA) requests for a single user within a 10-minute window, specifically when more than nine MFA prompts are declined. It leverages Azure Active Directory (Azure AD) sign-in logs, focusing on "Sign-in activity" events with error code 500121 and additional details indicating "MFA denied; user declined the authentication." This behavior is significant as it may indicate a targeted attack or account compromise attempt, with the user actively declining unauthorized access. If confirmed malicious, it could lead to data exfiltration, lateral movement, or further malicious activities.
 data_source:
     - Azure Active Directory Sign-in activity
-search: |-
+search: |
     `azure_monitor_aad` category=SignInLogs operationName="Sign-in activity"
       | rename properties.* as *
       | search status.errorCode=500121 status.additionalDetails="MFA denied; user declined the authentication"
@@ -40,7 +40,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ denied more than 9 MFA requests in a timespan of 10 minutes.
     entity:
diff --git a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml
index b598b4d441e..b5de22c739e 100644
--- a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml
+++ b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within an Azure AD tenant. It leverages Azure AD Sign-in Logs, specifically error code 500121, to detect more than 10 failed MFA attempts within 10 minutes. This behavior is significant as it may indicate an adversary attempting to bypass MFA by bombarding the user with repeated authentication prompts. If confirmed malicious, this activity could lead to unauthorized access, allowing attackers to compromise user accounts and potentially escalate their privileges within the environment.
 data_source:
     - Azure Active Directory Sign-in activity
-search: |-
+search: |
     `azure_monitor_aad` category=SignInLogs operationName="Sign-in activity" properties.status.errorCode=500121 properties.status.additionalDetails!="MFA denied; user declined the authentication"
       | rename properties.* as *
       | bucket span=10m _time
@@ -40,7 +40,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ failed to complete MFA authentication more than 9 times in a timespan of 10 minutes.
     entity:
diff --git a/detections/cloud/azure_ad_multiple_service_principals_created_by_sp.yml b/detections/cloud/azure_ad_multiple_service_principals_created_by_sp.yml
index 9f9de70f16a..85bd4ad0bdd 100644
--- a/detections/cloud/azure_ad_multiple_service_principals_created_by_sp.yml
+++ b/detections/cloud/azure_ad_multiple_service_principals_created_by_sp.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects when a single service principal in Azure AD creates more than three unique OAuth applications within a 10-minute span. It leverages Azure AD audit logs, specifically monitoring the 'Add service principal' operation initiated by service principals. This behavior is significant as it may indicate an attacker using a compromised or malicious service principal to rapidly establish multiple service principals, potentially staging an attack. If confirmed malicious, this activity could facilitate network infiltration or expansion, allowing the attacker to gain unauthorized access and persist within the environment.
 data_source:
     - Azure Active Directory Add service principal
-search: |-
+search: |
     `azure_monitor_aad` operationName="Add service principal" properties.initiatedBy.app.appId=*
       | rename properties.* as *
       | bucket span=10m _time
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src_user
diff --git a/detections/cloud/azure_ad_multiple_service_principals_created_by_user.yml b/detections/cloud/azure_ad_multiple_service_principals_created_by_user.yml
index d91fd4a2304..cfe6ae03b8f 100644
--- a/detections/cloud/azure_ad_multiple_service_principals_created_by_user.yml
+++ b/detections/cloud/azure_ad_multiple_service_principals_created_by_user.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies instances where a single user creates more than three unique OAuth applications within a 10-minute timeframe in Azure AD. It detects this activity by monitoring the 'Add service principal' operation and aggregating data in 10-minute intervals. This behavior is significant as it may indicate an adversary rapidly creating multiple service principals to stage an attack or expand their foothold within the network. If confirmed malicious, this activity could allow attackers to establish persistence, escalate privileges, or access sensitive information within the Azure environment.
 data_source:
     - Azure Active Directory Add service principal
-search: |-
+search: |
     `azure_monitor_aad` operationName="Add service principal" properties.initiatedBy.user.id=*
       | rename properties.* as *
       | bucket span=10m _time
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src_user
diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
index b341dd1f2ac..7c6e72bef44 100644
--- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
+++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects a single source IP failing to authenticate with 30 unique valid users within 5 minutes in Azure Active Directory. It leverages Azure AD SignInLogs with error code 50126, indicating invalid passwords. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges by trying common passwords across many accounts. If confirmed malicious, this activity could lead to unauthorized access, data breaches, or privilege escalation within the Azure AD environment.
 data_source:
     - Azure Active Directory
-search: |-
+search: |
     `azure_monitor_aad` category=SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
       | rename properties.* as *
       | bucket span=5m _time
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/azure_ad_new_custom_domain_added.yml b/detections/cloud/azure_ad_new_custom_domain_added.yml
index 8587f288868..9a90e66164c 100644
--- a/detections/cloud/azure_ad_new_custom_domain_added.yml
+++ b/detections/cloud/azure_ad_new_custom_domain_added.yml
@@ -9,19 +9,8 @@ type: TTP
 description: The following analytic detects the addition of a new custom domain within an Azure Active Directory (AD) tenant. It leverages Azure AD AuditLogs to identify successful "Add unverified domain" operations. This activity is significant as it may indicate an adversary attempting to establish persistence by setting up identity federation backdoors, allowing them to impersonate users and bypass authentication mechanisms. If confirmed malicious, this could enable attackers to gain unauthorized access, escalate privileges, and maintain long-term access to the Azure AD environment, posing a severe security risk.
 data_source:
     - Azure Active Directory Add unverified domain
-search: |-
-    `azure_monitor_aad` operationName="Add unverified domain" properties.result=success
-      | rename properties.* as *
-      | rename targetResources{}.displayName as domain
-      | rename userAgent as user_agent
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest user src
-           vendor_account vendor_product user_agent
-           domain signature
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `azure_ad_new_custom_domain_added_filter`
+search: |
+    `azure_monitor_aad` operationName=Add unverified domain properties.result="success" | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_new_custom_domain_added_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.
 known_false_positives: In most organizations, new customm domains will be updated infrequently. Filter as needed.
 references:
@@ -39,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new custom domain, $domain$ , was added by $user$
     entity:
diff --git a/detections/cloud/azure_ad_new_federated_domain_added.yml b/detections/cloud/azure_ad_new_federated_domain_added.yml
index 091bc6c0570..76f5af5ac5b 100644
--- a/detections/cloud/azure_ad_new_federated_domain_added.yml
+++ b/detections/cloud/azure_ad_new_federated_domain_added.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the addition of a new federated domain within an Azure Active Directory tenant. It leverages Azure AD AuditLogs to identify successful "Set domain authentication" operations. This activity is significant as it may indicate the use of the Azure AD identity federation backdoor technique, allowing an adversary to establish persistence. If confirmed malicious, the attacker could impersonate any user, bypassing password and MFA requirements, potentially leading to unauthorized access and control over the Azure AD environment.
 data_source:
     - Azure Active Directory Set domain authentication
-search: |-
+search: |
     `azure_monitor_aad` operationName="Set domain authentication" "properties.result"=success
       | rename properties.* as *
       | rename targetResources{}.displayName as domain
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new federated domain, $domain$ , was added by $user$
     entity:
diff --git a/detections/cloud/azure_ad_new_mfa_method_registered.yml b/detections/cloud/azure_ad_new_mfa_method_registered.yml
index 43c81010525..11d04f22d66 100644
--- a/detections/cloud/azure_ad_new_mfa_method_registered.yml
+++ b/detections/cloud/azure_ad_new_mfa_method_registered.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for a user account in Azure Active Directory. It leverages Azure AD audit logs to identify changes in MFA configurations. This activity is significant because adding a new MFA method can indicate an attacker's attempt to maintain persistence on a compromised account. If confirmed malicious, the attacker could bypass existing security measures, solidify their access, and potentially escalate privileges, access sensitive data, or make unauthorized changes. Immediate verification and remediation are required to secure the affected account.
 data_source:
     - Azure Active Directory Update user
-search: "`azure_monitor_aad` operationName=\"Update user\" | rename properties.* as * | eval propertyName = mvindex('targetResources{}.modifiedProperties{}.displayName',0) | search propertyName = StrongAuthenticationMethod | eval oldvalue = mvindex('targetResources{}.modifiedProperties{}.oldValue',0) | eval newvalue = mvindex('targetResources{}.modifiedProperties{}.newValue',0) | rex field=newvalue max_match=0 \"(?i)(?<new_method_type>\\\"MethodType\\\")\" | rex field=oldvalue max_match=0 \"(?i)(?<old_method_type>\\\"MethodType\\\")\" | eval count_new_method_type = coalesce(mvcount(new_method_type), 0) | eval count_old_method_type = coalesce(mvcount(old_method_type), 0) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product newvalue oldvalue signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_new_mfa_method_registered_filter`"
+search: |
+    `azure_monitor_aad` operationName="Update user" | rename properties.* as * | eval propertyName = mvindex('targetResources{}.modifiedProperties{}.displayName',0) | search propertyName = StrongAuthenticationMethod | eval oldvalue = mvindex('targetResources{}.modifiedProperties{}.oldValue',0) | eval newvalue = mvindex('targetResources{}.modifiedProperties{}.newValue',0) | rex field=newvalue max_match=0 "(?i)(?<new_method_type>\"MethodType\")" | rex field=oldvalue max_match=0 "(?i)(?<old_method_type>\"MethodType\")" | eval count_new_method_type = coalesce(mvcount(new_method_type), 0) | eval count_old_method_type = coalesce(mvcount(old_method_type), 0) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product newvalue oldvalue signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_new_mfa_method_registered_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
 known_false_positives: Users may register MFA methods legitimally, investigate and filter as needed.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new MFA method was registered for user $user$
     entity:
diff --git a/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml b/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml
index 5e0b1e892b3..5a68e255623 100644
--- a/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml
+++ b/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml
@@ -9,20 +9,8 @@ type: TTP
 description: The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for an Azure AD account. It leverages Azure AD AuditLogs to identify when a user registers new security information. This activity is significant because adversaries who gain unauthorized access to an account may add their own MFA method to maintain persistence. If confirmed malicious, this could allow attackers to bypass existing security controls, maintain long-term access, and potentially escalate their privileges within the environment.
 data_source:
     - Azure Active Directory User registered security info
-search: |-
-    `azure_monitor_aad` category=AuditLogs operationName="User registered security info" properties.operationType=Add
-      | rename properties.* as *
-      | rename targetResources{}.* as *
-      | rename userAgent as user_agent
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY action dest user
-           src vendor_account vendor_product
-           user_agent result resultDescription
-           signature
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `azure_ad_new_mfa_method_registered_for_user_filter`
+search: |
+    `azure_monitor_aad` operationName=User registered security info category="AuditLogs" properties.operationType="Add" | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_new_mfa_method_registered_for_user_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.
 known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new MFA method was registered for user $user$
     entity:
diff --git a/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml b/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml
index 7ac29c4a6b5..073d69046c3 100644
--- a/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml
+++ b/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml
@@ -6,13 +6,14 @@ modification_date: '2026-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects when a user in an Azure AD environment grants consent to an OAuth application. It leverages Azure AD audit logs to identify events where users approve application consents.
+description: 'The following analytic detects when a user in an Azure AD environment grants consent to an OAuth application. It leverages Azure AD audit logs to identify events where users approve application consents.
+
     This activity is significant as it can expose organizational data to third-party applications, a common tactic used by malicious actors to gain unauthorized access.
-    If confirmed malicious, this could lead to unauthorized access to sensitive information and resources. Immediate investigation is required to validate the application's legitimacy, review permissions, and mitigate potential risks.
+
+    If confirmed malicious, this could lead to unauthorized access to sensitive information and resources. Immediate investigation is required to validate the application''s legitimacy, review permissions, and mitigate potential risks.'
 data_source:
     - Azure Active Directory Consent to application
-search: |-
+search: |
     `azure_monitor_aad`
     operationName="Consent to application"
     properties.result=success
@@ -32,11 +33,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `azure_ad_oauth_application_consent_granted_by_user_filter`
-how_to_implement: |-
-    You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
-known_false_positives: |-
-    False positives may occur if users are granting consents as part of legitimate application integrations or setups.
-    It is crucial to review the application and the permissions it requests to ensure they align with organizational policies and security best practices.
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
+known_false_positives: 'False positives may occur if users are granting consents as part of legitimate application integrations or setups.
+
+    It is crucial to review the application and the permissions it requests to ensure they align with organizational policies and security best practices.'
 references:
     - https://attack.mitre.org/techniques/T1528/
     - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/
@@ -52,7 +52,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ consented an OAuth application.
     entity:
diff --git a/detections/cloud/azure_ad_pim_role_assigned.yml b/detections/cloud/azure_ad_pim_role_assigned.yml
index 1431dc847fe..22e991bbc06 100644
--- a/detections/cloud/azure_ad_pim_role_assigned.yml
+++ b/detections/cloud/azure_ad_pim_role_assigned.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects the assignment of an Azure AD Privileged Identity Management (PIM) role. It leverages Azure Active Directory events to identify when a user is added as an eligible member to a PIM role. This activity is significant because PIM roles grant elevated privileges, and their assignment should be closely monitored to prevent unauthorized access. If confirmed malicious, an attacker could exploit this to gain privileged access, potentially leading to unauthorized actions, data breaches, or further compromise of the environment.
 data_source:
     - Azure Active Directory
-search: |-
-    `azure_monitor_aad` operationName="Add eligible member to role in PIM completed*"
-      | rename properties.* as *
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest user src_user
-           vendor_account vendor_product signature
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `azure_ad_pim_role_assigned_filter`
+search: |
+    `azure_monitor_aad` operationName="Add eligible member to role in PIM completed*" | eval initiatedBy='initiatedBy.user.userPrincipalName' | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_pim_role_assigned_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
 known_false_positives: As part of legitimate administrative behavior, users may be assigned PIM roles. Filter as needed
 references:
@@ -33,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An Azure AD PIM role assignment was assiged to $user$
     entity:
diff --git a/detections/cloud/azure_ad_pim_role_assignment_activated.yml b/detections/cloud/azure_ad_pim_role_assignment_activated.yml
index a380e27dc2c..befed11159b 100644
--- a/detections/cloud/azure_ad_pim_role_assignment_activated.yml
+++ b/detections/cloud/azure_ad_pim_role_assignment_activated.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the activation of an Azure AD Privileged Identity Management (PIM) role. It leverages Azure Active Directory events to identify when a user activates a PIM role assignment, indicated by the "Add member to role completed (PIM activation)" operation. Monitoring this activity is crucial as PIM roles grant elevated privileges, and unauthorized activation could indicate an adversary attempting to gain privileged access. If confirmed malicious, this could lead to unauthorized administrative actions, data breaches, or further compromise of the Azure environment.
 data_source:
     - Azure Active Directory
-search: |-
-    `azure_monitor_aad` operationName="Add member to role completed (PIM activation)"
-      | rename properties.* as *
-      | rename initiatedBy.user.userPrincipalName as initiatedBy
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest user src
-           vendor_account vendor_product initiatedBy
-           signature
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `azure_ad_pim_role_assignment_activated_filter`
+search: |
+    `azure_monitor_aad` operationName="Add member to role completed (PIM activation)" | eval initiatedBy='initiatedBy.user.userPrincipalName' | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_pim_role_assignment_activated_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
 known_false_positives: As part of legitimate administrative behavior, users may activate PIM roles. Filter as needed
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An Azure AD PIM role assignment was activated by $initiatedBy$ by $user$
     entity:
diff --git a/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml b/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml
index 870208b2f77..1f165e41fba 100644
--- a/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml
+++ b/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the assignment of the Privileged Authentication Administrator role to an Azure AD user. It leverages Azure Active Directory audit logs to identify when this specific role is assigned. This activity is significant because users in this role can set or reset authentication methods for any user, including those in privileged roles like Global Administrators. If confirmed malicious, an attacker could change credentials and assume the identity and permissions of high-privilege users, potentially leading to unauthorized access to sensitive information and critical configurations.
 data_source:
     - Azure Active Directory Add member to role
-search: |-
+search: |
     `azure_monitor_aad` "operationName"="Add member to role" "properties.targetResources{}.modifiedProperties{}.newValue"="\"Privileged Authentication Administrator\""
       | rename properties.* as *
       | rename initiatedBy.user.userPrincipalName as initiatedBy
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The privileged Azure AD role Privileged Authentication Administrator was assigned for User $user$ initiated by $initiatedBy$
     entity:
diff --git a/detections/cloud/azure_ad_privileged_graph_api_permission_assigned.yml b/detections/cloud/azure_ad_privileged_graph_api_permission_assigned.yml
index fd6d2966d44..04e2a41761f 100644
--- a/detections/cloud/azure_ad_privileged_graph_api_permission_assigned.yml
+++ b/detections/cloud/azure_ad_privileged_graph_api_permission_assigned.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the assignment of high-risk Graph API permissions in Azure AD, specifically Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, and RoleManagement.ReadWrite.Directory. It uses azure_monitor_aad data to scan AuditLogs for 'Update application' operations, identifying when these permissions are assigned. This activity is significant as it grants broad control over Azure AD, including application and directory settings. If confirmed malicious, it could lead to unauthorized modifications and potential security breaches, compromising the integrity and security of the Azure AD environment. Immediate investigation is required.
 data_source:
     - Azure Active Directory Update application
-search: "`azure_monitor_aad` category=AuditLogs operationName=\"Update application\" | eval newvalue = mvindex('properties.targetResources{}.modifiedProperties{}.newValue',0) | spath input=newvalue | search \"{}.RequiredAppPermissions{}.EntitlementId\"=\" 1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9\" OR \"{}.RequiredAppPermissions{}.EntitlementId\" =\"06b708a9-e830-4db3-a914-8e69da51d44f\" OR \"{}.RequiredAppPermissions{}.EntitlementId\" =\"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\" | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product Permissions signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_privileged_graph_api_permission_assigned_filter`"
+search: |
+    `azure_monitor_aad` category=AuditLogs operationName="Update application" | eval newvalue = mvindex('properties.targetResources{}.modifiedProperties{}.newValue',0) | spath input=newvalue | search "{}.RequiredAppPermissions{}.EntitlementId"=" 1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9" OR "{}.RequiredAppPermissions{}.EntitlementId" ="06b708a9-e830-4db3-a914-8e69da51d44f" OR "{}.RequiredAppPermissions{}.EntitlementId" ="9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8" | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product Permissions signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_privileged_graph_api_permission_assigned_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
 known_false_positives: Privileged Graph API permissions may be assigned for legitimate purposes. Filter as needed.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ assigned privileged Graph API permissions to $Permissions$
     entity:
diff --git a/detections/cloud/azure_ad_privileged_role_assigned.yml b/detections/cloud/azure_ad_privileged_role_assigned.yml
index 29ccd68bf85..ee5328c1a5f 100644
--- a/detections/cloud/azure_ad_privileged_role_assigned.yml
+++ b/detections/cloud/azure_ad_privileged_role_assigned.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the assignment of privileged Azure Active Directory roles to a user. It leverages Azure AD audit logs, specifically monitoring the "Add member to role" operation. This activity is significant as adversaries may assign privileged roles to compromised accounts to maintain persistence within the Azure AD environment. If confirmed malicious, this could allow attackers to escalate privileges, access sensitive information, and maintain long-term control over the Azure AD infrastructure.
 data_source:
     - Azure Active Directory Add member to role
-search: |-
+search: |
     `azure_monitor_aad` "operationName"="Add member to role"
       | rename properties.* as *
       | rename initiatedBy.user.userPrincipalName as initiatedBy
@@ -42,7 +42,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A privileged Azure AD role was assigned for User $user$ initiated by $initiatedBy$
     entity:
diff --git a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml
index 9640b9bc5d6..8937f9dd9a8 100644
--- a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml
+++ b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the assignment of privileged roles to service principals in Azure Active Directory (AD). It leverages the AuditLogs log category from ingested Azure AD events. This activity is significant because assigning elevated permissions to non-human entities can lead to unauthorized access or malicious activities. If confirmed malicious, attackers could exploit these service principals to gain elevated access to Azure resources, potentially compromising sensitive data and critical infrastructure. Monitoring this behavior helps prevent privilege escalation and ensures the security of Azure environments.
 data_source:
     - Azure Active Directory Add member to role
-search: |-
+search: |
     `azure_monitor_aad` operationName="Add member to role"
       | rename properties.* as *
       | search "targetResources{}.type"=ServicePrincipal
@@ -41,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$initiatedBy$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$initiatedBy$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A privileged Azure AD role was assigned to the Service Principal $displayName$ initiated by $initiatedBy$
     entity:
diff --git a/detections/cloud/azure_ad_service_principal_authentication.yml b/detections/cloud/azure_ad_service_principal_authentication.yml
index f31f8fb3ab0..e20f05e0071 100644
--- a/detections/cloud/azure_ad_service_principal_authentication.yml
+++ b/detections/cloud/azure_ad_service_principal_authentication.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic identifies authentication events of service principals in Azure Active Directory. It leverages the `azure_monitor_aad` data source, specifically targeting "Sign-in activity" within ServicePrincipalSignInLogs. This detection gathers details such as sign-in frequency, timing, source IPs, and accessed resources. Monitoring these events is significant for SOC teams to distinguish between normal application authentication and potential anomalies, which could indicate compromised credentials or malicious activities. If confirmed malicious, attackers could gain unauthorized access to resources, leading to data breaches or further exploitation within the environment.
 data_source:
     - Azure Active Directory Sign-in activity
-search: |-
-    `azure_monitor_aad` operationName="Sign-in activity" category=ServicePrincipalSignInLogs
-      | rename properties.* as *
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest user src
-           vendor_account vendor_product resourceDisplayName
-           resourceId signature
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `azure_ad_service_principal_authentication_filter`
+search: |
+    `azure_monitor_aad` operationName=Sign-in activity category="ServicePrincipalSignInLogs" | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_service_principal_authentication_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
 known_false_positives: Service Principals will legitimally authenticate remotely to your tenant. Implementing this detection after establishing a baseline enables a more accurate identification of security threats, ensuring proactive and informed responses to safeguard the Azure AD environment. source ips.
 references:
@@ -33,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Service Principal $user$ authenticated from $src$
     entity:
diff --git a/detections/cloud/azure_ad_service_principal_created.yml b/detections/cloud/azure_ad_service_principal_created.yml
index e25b49dfc23..060215a6130 100644
--- a/detections/cloud/azure_ad_service_principal_created.yml
+++ b/detections/cloud/azure_ad_service_principal_created.yml
@@ -9,19 +9,8 @@ type: TTP
 description: The following analytic detects the creation of a Service Principal in an Azure AD environment. It leverages Azure Active Directory events ingested through EventHub, specifically monitoring the "Add service principal" operation. This activity is significant because Service Principals can be used by adversaries to establish persistence and bypass multi-factor authentication and conditional access policies. If confirmed malicious, this could allow attackers to maintain single-factor access to the Azure AD environment, potentially leading to unauthorized access to resources and prolonged undetected activity.
 data_source:
     - Azure Active Directory Add service principal
-search: |-
-    `azure_monitor_aad` operationName="Add service principal" properties.initiatedBy.user.id=*
-      | rename properties.* as *
-      | rename targetResources{}.displayName as displayName
-      | rename targetResources{}.type as type
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest user src
-           vendor_account vendor_product displayName
-           result signature
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `azure_ad_service_principal_created_filter`
+search: |
+    `azure_monitor_aad` operationName=Add service principal properties.initiatedBy.user.id="*" | eval displayName='targetResources{}.displayName' | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_service_principal_created_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment thorough an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
 known_false_positives: Administrator may legitimately create Service Principal. Filter as needed.
 references:
@@ -38,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$displayName$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$displayName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Service Principal named $displayName$ created by $user$
     entity:
diff --git a/detections/cloud/azure_ad_service_principal_enumeration.yml b/detections/cloud/azure_ad_service_principal_enumeration.yml
index a4b29153e3c..fbc25d71b52 100644
--- a/detections/cloud/azure_ad_service_principal_enumeration.yml
+++ b/detections/cloud/azure_ad_service_principal_enumeration.yml
@@ -6,12 +6,10 @@ modification_date: '2026-05-13'
 author: Dean Luxton
 status: production
 type: TTP
-description: >-
-    This detection leverages azure graph activity logs to identify when graph APIs have been used to identify 10 or more service principals.
-    This type of behaviour is associated with tools such as Azure enumberation tools such as AzureHound or ROADtools.
+description: This detection leverages azure graph activity logs to identify when graph APIs have been used to identify 10 or more service principals. This type of behaviour is associated with tools such as Azure enumberation tools such as AzureHound or ROADtools.
 data_source:
     - Azure Active Directory MicrosoftGraphActivityLogs
-search: |-
+search: |
     `azure_monitor_aad` category IN (MicrosoftGraphActivityLogs) TERM(servicePrincipals)
       | fillnull
       | rex field="properties.requestUri" "https\:\/\/graph.microsoft.com\/beta\/servicePrincipals\/(?P<servicePrincipalb>.*?)\/"
@@ -23,9 +21,7 @@ search: |-
            vendor_account vendor_product signature
       | where spn_count>9
       | `azure_ad_service_principal_enumeration_filter`
-how_to_implement: >-
-    Run this detection over historical data to identify then tune out any known services which may be performing this action. Thresholds can be lowered or raised to meet requirements.
-    The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest MicrosoftGraphActivityLogs via Azure EventHub. See reference for links for further details on how to onboard this log source.
+how_to_implement: Run this detection over historical data to identify then tune out any known services which may be performing this action. Thresholds can be lowered or raised to meet requirements. The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest MicrosoftGraphActivityLogs via Azure EventHub. See reference for links for further details on how to onboard this log source.
 known_false_positives: No false positives have been identified at this time.
 references:
     - https://github.com/SpecterOps/AzureHound
@@ -40,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $spn_count$ Service Principals have been enumerated by $user_id$ from IP $src$
     entity:
@@ -67,6 +63,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.004/azurehound/azurehound.log
-          sourcetype: azure:monitor:aad
           source: Azure AD
+          sourcetype: azure:monitor:aad
       test_type: unit
diff --git a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml
index e91d3912e3c..831d5bca3d2 100644
--- a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml
+++ b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the addition of new credentials to Service Principals and Applications in Azure AD. It leverages Azure AD AuditLogs, specifically monitoring the "Update application*Certificates and secrets management" operation. This activity is significant as it may indicate an adversary attempting to maintain persistent access or escalate privileges within the Azure environment. If confirmed malicious, attackers could use these new credentials to log in as the service principal, potentially compromising sensitive accounts and resources, leading to unauthorized access and control over the Azure environment.
 data_source:
     - Azure Active Directory
-search: |-
-    `azure_monitor_aad` category=AuditLogs operationName="Update application*Certificates and secrets management "
-      | rename properties.* as *
-      | rename targetResources{}.* as *
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest user src
-           vendor_account vendor_product modifiedProperties{}.newValue
-           signature
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `azure_ad_service_principal_new_client_credentials_filter`
+search: |
+    `azure_monitor_aad` category="AuditLogs" operationName="Update application*Certificates and secrets management " | eval initiatedBy='initiatedBy.user.userPrincipalName' | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_service_principal_new_client_credentials_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Signin log category.
 known_false_positives: Service Principal client credential modifications may be part of legitimate administrative operations. Filter as needed.
 references:
@@ -38,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: New credentials added for Service Principal by $user$
     entity:
diff --git a/detections/cloud/azure_ad_service_principal_owner_added.yml b/detections/cloud/azure_ad_service_principal_owner_added.yml
index 2bca3052d60..504ebdf99eb 100644
--- a/detections/cloud/azure_ad_service_principal_owner_added.yml
+++ b/detections/cloud/azure_ad_service_principal_owner_added.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the addition of a new owner to a Service Principal within an Azure AD tenant. It leverages Azure Active Directory events from the AuditLog log category to identify this activity. This behavior is significant because Service Principals do not support multi-factor authentication or conditional access policies, making them a target for adversaries seeking persistence or privilege escalation. If confirmed malicious, this activity could allow attackers to maintain access to the Azure AD environment with single-factor authentication, potentially leading to unauthorized access and control over critical resources.
 data_source:
     - Azure Active Directory Add owner to application
-search: |-
+search: |
     `azure_monitor_aad` operationName="Add owner to application"
       | rename properties.* as *
       | rename initiatedBy.user.userPrincipalName as initiatedBy
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$displayName$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$displayName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new owner was added for service principal $displayName$ by $initiatedBy$
     entity:
diff --git a/detections/cloud/azure_ad_service_principal_privilege_escalation.yml b/detections/cloud/azure_ad_service_principal_privilege_escalation.yml
index 585a39b0a6a..59ce40211d7 100644
--- a/detections/cloud/azure_ad_service_principal_privilege_escalation.yml
+++ b/detections/cloud/azure_ad_service_principal_privilege_escalation.yml
@@ -9,21 +9,8 @@ type: TTP
 description: This detection identifies when an Azure Service Principal elevates privileges by adding themself to a new app role assignment.
 data_source:
     - Azure Active Directory Add app role assignment to service principal
-search: >-
-    `azure_monitor_aad` category=AuditLogs operationName="Add app role assignment to service principal" properties.initiatedBy.app.displayName=* properties.result=Success
-    | spath path=properties{}.targetResources{}.modifiedProperties{} output=targetResources
-    | rename properties.* as *
-    | eval user="NA"
-    | eval src="NA"
-    | stats min(_time) as firstTime max(_time) as lastTime values(eval(mvfilter(match(targetResources, "AppRole.Value")))) as appRole, values(eval(mvfilter(match(targetResources, "ServicePrincipal.DisplayName")))) as targetServicePrincipal values(eval(mvindex('properties.targetResources{}.displayName',0))) as targetAppContext
-    values(user_agent) as user_agent values(identity) as servicePrincipal values(properties.initiatedBy.app.servicePrincipalId) as servicePrincipalId by dest user src vendor_account vendor_product signature
-    | spath input=appRole path=newValue output=appRole
-    | spath input=targetServicePrincipal path=newValue output=targetServicePrincipal
-    | eval appRole=trim(replace(appRole, "\"", "")), targetServicePrincipal=trim(replace(targetServicePrincipal, "\"", ""))
-    | where servicePrincipal=targetServicePrincipal
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `azure_ad_service_principal_privilege_escalation_filter`
+search: |
+    `azure_monitor_aad` category=AuditLogs operationName="Add app role assignment to service principal" properties.initiatedBy.app.displayName=* properties.result=Success | spath path=properties{}.targetResources{}.modifiedProperties{} output=targetResources | rename properties.* as * | eval user="NA" | eval src="NA" | stats min(_time) as firstTime max(_time) as lastTime values(eval(mvfilter(match(targetResources, "AppRole.Value")))) as appRole, values(eval(mvfilter(match(targetResources, "ServicePrincipal.DisplayName")))) as targetServicePrincipal values(eval(mvindex('properties.targetResources{}.displayName',0))) as targetAppContext values(user_agent) as user_agent values(identity) as servicePrincipal values(properties.initiatedBy.app.servicePrincipalId) as servicePrincipalId by dest user src vendor_account vendor_product signature | spath input=appRole path=newValue output=appRole | spath input=targetServicePrincipal path=newValue output=targetServicePrincipal | eval appRole=trim(replace(appRole, "\"", "")), targetServicePrincipal=trim(replace(targetServicePrincipal, "\"", "")) | where servicePrincipal=targetServicePrincipal | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_service_principal_privilege_escalation_filter`
 how_to_implement: The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest EntraID audit logs via Azure EventHub. See reference for links for further details on how to onboard this log source.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -40,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$servicePrincipal$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$servicePrincipal$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Service Principal $servicePrincipal$ has elevated privileges by adding themself to app role $appRole$
     entity:
@@ -65,6 +52,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_spn_privesc/azure_ad_spn_privesc.log
-          sourcetype: azure:monitor:aad
           source: Azure AD
+          sourcetype: azure:monitor:aad
       test_type: unit
diff --git a/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml b/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml
index ee44d1b550d..6c110a93d5e 100644
--- a/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml
+++ b/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects an Azure AD account successfully authenticating from multiple unique IP addresses within a 30-minute window. It leverages Azure AD SignInLogs to identify instances where the same user logs in from different IPs in a short time frame. This behavior is significant as it may indicate compromised credentials being used by an adversary, potentially following a phishing attack. If confirmed malicious, this activity could allow unauthorized access to corporate resources, leading to data breaches or further exploitation within the network.
 data_source:
     - Azure Active Directory
-search: |-
+search: |
     `azure_monitor_aad` properties.authenticationDetails{}.succeeded=true category=SignInLogs
       | rename properties.* as *
       | bucket span=30m _time
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has had successful authentication events from more than one unique IP address in the span of 30 minutes.
     entity:
diff --git a/detections/cloud/azure_ad_successful_powershell_authentication.yml b/detections/cloud/azure_ad_successful_powershell_authentication.yml
index 3d3122bca5a..42d39b22e80 100644
--- a/detections/cloud/azure_ad_successful_powershell_authentication.yml
+++ b/detections/cloud/azure_ad_successful_powershell_authentication.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell cmdlets. This detection leverages Azure AD SignInLogs to identify successful logins where the appDisplayName is "Microsoft Azure PowerShell." This activity is significant because it is uncommon for regular, non-administrative users to authenticate using PowerShell, and it may indicate enumeration and discovery techniques by an attacker. If confirmed malicious, this activity could allow attackers to perform extensive reconnaissance, potentially leading to privilege escalation or further exploitation within the Azure environment.
 data_source:
     - Azure Active Directory
-search: |-
+search: |
     `azure_monitor_aad` category=SignInLogs properties.authenticationDetails{}.succeeded=true properties.appDisplayName="Microsoft Azure PowerShell"
       | rename properties.* as *
       | rename userAgent as user_agent
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Successful authentication for user $user$ using PowerShell.
     entity:
diff --git a/detections/cloud/azure_ad_successful_single_factor_authentication.yml b/detections/cloud/azure_ad_successful_single_factor_authentication.yml
index b79b46c8c1b..46defb3ecdb 100644
--- a/detections/cloud/azure_ad_successful_single_factor_authentication.yml
+++ b/detections/cloud/azure_ad_successful_single_factor_authentication.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies a successful single-factor authentication event against Azure Active Directory. It leverages Azure SignInLogs data, specifically focusing on events where single-factor authentication succeeded. This activity is significant as it may indicate a misconfiguration, policy violation, or potential account takeover attempt. If confirmed malicious, an attacker could gain unauthorized access to the account, potentially leading to data breaches, privilege escalation, or further exploitation within the environment.
 data_source:
     - Azure Active Directory
-search: |-
+search: |
     `azure_monitor_aad` category=SignInLogs properties.authenticationRequirement=singleFactorAuthentication properties.authenticationDetails{}.succeeded=true
       | rename properties.* as *
       | rename userAgent as user_agent
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Successful authentication for user $user$ without MFA
     entity:
diff --git a/detections/cloud/azure_ad_tenant_wide_admin_consent_granted.yml b/detections/cloud/azure_ad_tenant_wide_admin_consent_granted.yml
index 757dcad49f6..38185e6dd47 100644
--- a/detections/cloud/azure_ad_tenant_wide_admin_consent_granted.yml
+++ b/detections/cloud/azure_ad_tenant_wide_admin_consent_granted.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies instances where admin consent is granted to an application within an Azure AD tenant. It leverages Azure AD audit logs, specifically events related to the admin consent action within the ApplicationManagement category. This activity is significant because admin consent allows applications to access data across the entire tenant, potentially exposing vast amounts of organizational data. If confirmed malicious, an attacker could gain extensive and persistent access to sensitive data, leading to data exfiltration, espionage, further malicious activities, and potential compliance violations.
 data_source:
     - Azure Active Directory Consent to application
-search: "`azure_monitor_aad` operationName=\"Consent to application\" | eval new_field=mvindex('properties.targetResources{}.modifiedProperties{}.newValue',4) | rename properties.* as * | rex field=new_field \"ConsentType:(?<ConsentType> [^\\,]+)\" | rex field=new_field \"Scope:(?<Scope> [^\\,]+)\" | search ConsentType = \"*AllPrincipals*\" | rename userAgent as user_agent | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product ConsentType Scope signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_tenant_wide_admin_consent_granted_filter`"
+search: |
+    `azure_monitor_aad` operationName="Consent to application" | eval new_field=mvindex('properties.targetResources{}.modifiedProperties{}.newValue',4) | rename properties.* as * | rex field=new_field "ConsentType:(?<ConsentType> [^\,]+)" | rex field=new_field "Scope:(?<Scope> [^\,]+)" | search ConsentType = "*AllPrincipals*" | rename userAgent as user_agent | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product ConsentType Scope signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_tenant_wide_admin_consent_granted_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Auditlogs log category.
 known_false_positives: Legitimate applications may be granted tenant wide consent, filter as needed.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Administrator $user$ consented an OAuth application for the tenant.
     entity:
diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
index 544218d0a6b..5e227e85db9 100644
--- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
+++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a single source IP failing to authenticate with multiple valid users, potentially indicating a Password Spraying attack against an Azure Active Directory tenant. It uses Azure SignInLogs data and calculates the standard deviation for source IPs, applying the 3-sigma rule to detect unusual numbers of failed authentication attempts. This activity is significant as it may signal an adversary attempting to gain initial access or elevate privileges. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information.
 data_source:
     - Azure Active Directory
-search: |-
+search: |
     `azure_monitor_aad` category=SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
       | rename properties.* as *
       | bucket span=5m _time
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$userPrincipalName$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$userPrincipalName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: userPrincipalName
diff --git a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml
index 34fb99e3aed..9d74cb97e7c 100644
--- a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml
+++ b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml
@@ -6,14 +6,16 @@ modification_date: '2026-09-24'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application.
+description: 'The following analytic detects instances where Azure AD has blocked a user''s attempt to grant consent to a risky or potentially malicious application.
+
     This detection leverages Azure AD audit logs, focusing on user consent actions and system-driven blocks.
+
     Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization.
-    If confirmed malicious, this activity suggests that Azure's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation to understand the context and take preventive measures.
+
+    If confirmed malicious, this activity suggests that Azure''s security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation to understand the context and take preventive measures.'
 data_source:
     - Azure Active Directory Consent to application
-search: |-
+search: |
     `azure_monitor_aad`
     operationName="Consent to application"
     properties.result=failure
@@ -35,10 +37,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `azure_ad_user_consent_blocked_for_risky_application_filter`
-how_to_implement: |-
-    You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
-known_false_positives: |-
-    No false positives have been identified at this time.
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://attack.mitre.org/techniques/T1528/
     - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/
@@ -54,7 +54,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Azure AD has blocked $user$ attempt to grant to consent to an application deemed risky.
     entity:
diff --git a/detections/cloud/azure_ad_user_consent_denied_for_oauth_application.yml b/detections/cloud/azure_ad_user_consent_denied_for_oauth_application.yml
index 0d443cde940..76681073342 100644
--- a/detections/cloud/azure_ad_user_consent_denied_for_oauth_application.yml
+++ b/detections/cloud/azure_ad_user_consent_denied_for_oauth_application.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic identifies instances where a user has denied consent to an OAuth application seeking permissions within the Azure AD environment. This detection leverages Azure AD's audit logs, specifically focusing on user consent actions with error code 65004. Monitoring denied consent actions is significant as it can indicate users recognizing potentially suspicious or untrusted applications. If confirmed malicious, this activity could suggest attempts by unauthorized applications to gain access, potentially leading to data breaches or unauthorized actions within the environment. Understanding these denials helps refine security policies and enhance user awareness.
 data_source:
     - Azure Active Directory Sign-in activity
-search: |-
-    `azure_monitor_aad` operationName="Sign-in activity" properties.status.errorCode=65004
-      | rename properties.* as *
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest user src
-           vendor_account vendor_product appDisplayName
-           status.failureReason signature
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `azure_ad_user_consent_denied_for_oauth_application_filter`
+search: |
+    `azure_monitor_aad` operationName=Sign-in activity properties.status.errorCode="65004" | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_user_consent_denied_for_oauth_application_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
 known_false_positives: Users may deny consent for legitimate applications by mistake, filter as needed.
 references:
@@ -37,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ denied consent for an OAuth application.
     entity:
diff --git a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml
index 1f74fa1f2d9..9ee27d88866 100644
--- a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml
+++ b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml
@@ -11,7 +11,7 @@ data_source:
     - Azure Active Directory Enable account
     - Azure Active Directory Reset password (by admin)
     - Azure Active Directory Update user
-search: |-
+search: |
     `azure_monitor_aad` (operationName="Enable account" OR operationName="Reset password (by admin)" OR operationName="Update user")
       | transaction user startsWith=(operationName="Enable account") endsWith=(operationName="Reset password (by admin)") maxspan=2m
       | rename properties.* as *
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A user account, $user$, was enabled and its password reset within 2 minutes by $initiatedBy$
     entity:
diff --git a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml
index 4302eb132d1..b52a31d3720 100644
--- a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml
+++ b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies the modification of the SourceAnchor (ImmutableId) attribute for an Azure Active Directory user. This detection leverages Azure AD audit logs, specifically monitoring the "Update user" operation and changes to the SourceAnchor attribute. This activity is significant as it is a step in setting up an Azure AD identity federation backdoor, allowing an adversary to establish persistence. If confirmed malicious, the attacker could impersonate any user, bypassing password and MFA requirements, leading to unauthorized access and potential data breaches.
 data_source:
     - Azure Active Directory Update user
-search: |-
+search: |
     `azure_monitor_aad` operationName="Update user" properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor
       | rename properties.* as *
       | rename initiatedBy.user.userPrincipalName as initiatedBy
@@ -39,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The SourceAnchor or ImmutableID attribute has been modified for user $user$ by $initiatedBy$
     entity:
diff --git a/detections/cloud/azure_automation_account_created.yml b/detections/cloud/azure_automation_account_created.yml
index 03215583813..3a27f363a12 100644
--- a/detections/cloud/azure_automation_account_created.yml
+++ b/detections/cloud/azure_automation_account_created.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic detects the creation of a new Azure Automation account within an Azure tenant. It leverages Azure Audit events, specifically the Azure Activity log category, to identify when an account is created or updated. This activity is significant because Azure Automation accounts can be used to automate tasks and orchestrate actions across Azure and on-premise environments. If an attacker creates an Automation account with elevated privileges, they could maintain persistence, execute malicious runbooks, and potentially escalate privileges or execute code on virtual machines, posing a significant security risk.
 data_source:
     - Azure Audit Create or Update an Azure Automation account
-search: |-
-    `azure_audit` operationName.value="Microsoft.Automation/automationAccounts/write" status.value=Succeeded
-      | dedup object
-      | rename claims.ipaddr as src, subscriptionId as vendor_account, operationName.value as signature
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest user src
-           vendor_account vendor_product object
-           object_path signature
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `azure_automation_account_created_filter`
+search: |
+    `azure_audit` operationName.localizedValue=Create or Update an Azure Automation account operationName.value="Microsoft.Automation/automationAccounts/write" status.value="Succeeded" | eval object=object | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_automation_account_created_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category.
 known_false_positives: Administrators may legitimately create Azure Automation accounts. Filter as needed.
 references:
@@ -38,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new Azure Automation account $object$ was created by $user$
     entity:
diff --git a/detections/cloud/azure_automation_runbook_created.yml b/detections/cloud/azure_automation_runbook_created.yml
index f47fdab2bd3..b54da84b777 100644
--- a/detections/cloud/azure_automation_runbook_created.yml
+++ b/detections/cloud/azure_automation_runbook_created.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic detects the creation of a new Azure Automation Runbook within an Azure tenant. It leverages Azure Audit events, specifically the Azure Activity log category, to identify when a new Runbook is created or updated. This activity is significant because adversaries with privileged access can use Runbooks to maintain persistence, escalate privileges, or execute malicious code. If confirmed malicious, this could lead to unauthorized actions such as creating Global Administrators, executing code on VMs, and compromising the entire Azure environment.
 data_source:
     - Azure Audit Create or Update an Azure Automation Runbook
-search: |-
-    `azure_audit` operationName.value="Microsoft.Automation/automationAccounts/runbooks/write" object!=AzureAutomationTutorial* status.value=Succeeded
-      | dedup object
-      | rename claims.ipaddr as src, subscriptionId as vendor_account, operationName.value as operationName
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest user src
-           vendor_account vendor_product object
-           object_path
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `azure_automation_runbook_created_filter`
+search: |
+    `azure_audit` operationName.localizedValue=Create or Update an Azure Automation Runbook operationName.value="Microsoft.Automation/automationAccounts/runbooks/write" NOT object="AzureAutomationTutorial*" status.value="Succeeded" | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_automation_runbook_created_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category.
 known_false_positives: Administrators may legitimately create Azure Automation Runbooks. Filter as needed.
 references:
@@ -38,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new Azure Automation Runbook $object$ was created by $user$
     entity:
diff --git a/detections/cloud/azure_runbook_webhook_created.yml b/detections/cloud/azure_runbook_webhook_created.yml
index 6b9ac67d9be..425e5a76e50 100644
--- a/detections/cloud/azure_runbook_webhook_created.yml
+++ b/detections/cloud/azure_runbook_webhook_created.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic detects the creation of a new Automation Runbook Webhook within an Azure tenant. It leverages Azure Audit events, specifically the "Create or Update an Azure Automation webhook" operation, to identify this activity. This behavior is significant because Webhooks can trigger Automation Runbooks via unauthenticated URLs exposed to the Internet, posing a security risk. If confirmed malicious, an attacker could use this to execute code, create users, or maintain persistence within the environment, potentially leading to unauthorized access and control over Azure resources.
 data_source:
     - Azure Audit Create or Update an Azure Automation webhook
-search: |-
-    `azure_audit` operationName.value="Microsoft.Automation/automationAccounts/webhooks/write" status.value=Succeeded
-      | dedup object
-      | rename claims.ipaddr as src_ip
-      | rename caller as user
-      | stats count min(_time) as firstTime max(_time) as lastTime values(dest) as dest
-        BY object user, src_ip,
-           resourceGroupName, object_path
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `azure_runbook_webhook_created_filter`
+search: |
+    `azure_audit` operationName.localizedValue=Create or Update an Azure Automation webhook operationName.value="Microsoft.Automation/automationAccounts/webhooks/write" status.value="Succeeded" | eval object=object | stats count min(_time) as firstTime max(_time) as lastTime by dest user src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_runbook_webhook_created_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category.
 known_false_positives: Administrators may legitimately create Azure Runbook Webhooks. Filter as needed.
 references:
@@ -38,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new Azure Runbook Webhook $object$ was created by $user$
     entity:
diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
index ddd55187d0a..6777f252492 100644
--- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
+++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects cloud API calls executed by user roles that have not previously run these commands. It leverages the Change data model in Splunk to identify commands executed by users with the user_type of AssumedRole and a status of success. This activity is significant because new commands from different user roles can indicate potential malicious activity or unauthorized actions. If confirmed malicious, this behavior could lead to unauthorized access, data breaches, or other damaging outcomes by exploiting new or unmonitored commands within the cloud environment.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     | tstats earliest(_time) as firstTime, latest(_time) as lastTime FROM datamodel=Change
       WHERE All_Changes.user_type=AssumedRole
         AND
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -61,7 +61,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       description: PORTED MANUAL TEST - This search needs the baseline `Previously Seen Cloud API Calls Per User Role - Initial` to be run first.
       test_type: experimental
diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
index 223a8926b2e..a132faa4c17 100644
--- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
+++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies the creation of cloud compute instances by users who have not previously created them. It leverages data from the Change data model, focusing on 'create' actions by users, and cross-references with a baseline of known user activities. This activity is significant as it may indicate unauthorized access or misuse of cloud resources by new or compromised accounts. If confirmed malicious, attackers could deploy unauthorized compute instances, leading to potential data exfiltration, increased costs, or further exploitation within the cloud environment.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     | tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object) as dest FROM datamodel=Change
       WHERE All_Changes.action=created
       BY All_Changes.user All_Changes.vendor_region
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -62,7 +62,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       description: PORTED MANUAL TEST - This search needs the baseline `Previously Seen Cloud Compute Creations By User` to be run first.
       test_type: experimental
diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
index 9d8da86c8ea..062b057fbf2 100644
--- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
+++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the creation of a cloud compute instance in a region that has not been previously used within the last hour. It leverages cloud infrastructure logs and compares the regions of newly created instances against a lookup file of historically used regions. This activity is significant because the creation of instances in new regions can indicate unauthorized or suspicious activity, such as an attacker attempting to evade detection or establish a foothold in a less monitored area. If confirmed malicious, this could lead to unauthorized resource usage, data exfiltration, or further compromise of the cloud environment.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     | tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id) as dest, count FROM datamodel=Change
       WHERE All_Changes.action=created
       BY All_Changes.vendor_region, All_Changes.user
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -62,7 +62,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       description: PORTED MANUAL TEST - This search needs the baseline `Previously Seen Cloud Regions - Update` to be run first.
       test_type: experimental
diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
index 98bcc0d7b31..0e7357eb037 100644
--- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
+++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the creation of cloud compute instances using previously unseen image IDs. It leverages cloud infrastructure logs to identify new image IDs that have not been observed before. This activity is significant because it may indicate unauthorized or suspicious activity, such as the deployment of malicious payloads or unauthorized access to sensitive information. If confirmed malicious, this could lead to data breaches, unauthorized access, or further compromise of the cloud environment. Immediate investigation is required to determine the legitimacy of the instance creation and to mitigate potential threats.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     | tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest FROM datamodel=Change
       WHERE All_Changes.action=created
       BY All_Changes.Instance_Changes.image_id, All_Changes.user
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -63,7 +63,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       description: PORTED MANUAL TEST - This search needs the baseline `Previously Seen Cloud Compute Images - Initial` to be run first.
       test_type: experimental
diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
index d6277404767..8b632f10b7c 100644
--- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
+++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
@@ -6,14 +6,16 @@ modification_date: '2026-09-22'
 author: David Dorsey, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the creation of EC2 instances with previously unseen instance types.
-    It leverages Splunk's tstats command to analyze data from the Change data model, identifying instance types that have not been previously recorded.
+description: 'The following analytic detects the creation of EC2 instances with previously unseen instance types.
+
+    It leverages Splunk''s tstats command to analyze data from the Change data model, identifying instance types that have not been previously recorded.
+
     This activity is significant for a SOC because it may indicate unauthorized or suspicious activity, such as an attacker attempting to create instances for malicious purposes.
-    If confirmed malicious, this could lead to unauthorized access, data exfiltration, system compromise, or service disruption. Immediate investigation is required to determine the legitimacy of the instance creation.
+
+    If confirmed malicious, this could lead to unauthorized access, data exfiltration, system compromise, or service disruption. Immediate investigation is required to determine the legitimacy of the instance creation.'
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     | tstats count earliest(_time) as firstTime
                    latest(_time) as lastTime
                    values(All_Changes.object_id) as dest
@@ -34,10 +36,8 @@ search: |-
     | table firstTime, user, dest, count, instance_type
     | `security_content_ctime(firstTime)`
     | `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`
-how_to_implement: |-
-    You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Compute Instance Types - Initial` to build the initial table of instance types observed and times. You must also enable the second baseline search `Previously Seen Cloud Compute Instance Types - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` macro.
-known_false_positives: |-
-    It is possible that an admin will create a new system using a new instance type that has never been used before. Verify with the creator that they intended to create the system with the new instance type.
+how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Compute Instance Types - Initial` to build the initial table of instance types observed and times. You must also enable the second baseline search `Previously Seen Cloud Compute Instance Types - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` macro.
+known_false_positives: It is possible that an admin will create a new system using a new instance type that has never been used before. Verify with the creator that they intended to create the system with the new instance type.
 references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
@@ -47,7 +47,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -76,7 +76,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       description: PORTED MANUAL TEST - This search needs the baseline `Previously Seen Cloud Compute Instance Types - Initial` to be run first.
       test_type: experimental
diff --git a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml
index 2ff5d407c10..dba806ac4b6 100644
--- a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml
+++ b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies cloud instances being modified by users who have not previously modified them. It leverages data from the Change data model, focusing on successful modifications of EC2 instances. This activity is significant because it can indicate unauthorized or suspicious changes by potentially compromised or malicious users. If confirmed malicious, this could lead to unauthorized access, configuration changes, or potential disruption of cloud services, posing a significant risk to the organization's cloud infrastructure.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     | tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command) as command FROM datamodel=Change
       WHERE All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success
       BY All_Changes.user
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -58,7 +58,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       description: PORTED MANUAL TEST - This search needs the baseline `Previously Seen Cloud Instance Modifications By User - Update` to be run first.
       test_type: experimental
diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml
index 986561019d7..0ca751f257b 100644
--- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml
+++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects cloud provisioning activities originating from previously unseen cities. It leverages cloud infrastructure logs and compares the geographic location of the source IP address against a baseline of known locations. This activity is significant as it may indicate unauthorized access or misuse of cloud resources from an unexpected location. If confirmed malicious, this could lead to unauthorized resource creation, potential data exfiltration, or further compromise of cloud infrastructure.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     | tstats earliest(_time) as firstTime, latest(_time) as lastTime FROM datamodel=Change
       WHERE (
             All_Changes.action=started
@@ -31,7 +31,9 @@ search: |-
     | table firstTime, src, City, user, object, command
     | `cloud_provisioning_activity_from_previously_unseen_city_filter`
 how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_city_filter` macro.
-known_false_positives: "This is a strictly behavioral search, so we define \"false positive\" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no \"false positives\" in a traditional sense, there is definitely lots of noise.\nThis search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you."
+known_false_positives: 'This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you''re searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.
+
+    This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.'
 references: []
 drilldown_searches:
     - name: View the detection results for - "$user$" and "$object$"
@@ -41,7 +43,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -73,7 +75,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       description: PORTED MANUAL TEST - This search needs the baseline to be run first to create a lookup
       test_type: experimental
diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml
index a59431fb49a..be0c0dda27c 100644
--- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml
+++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects cloud provisioning activities originating from previously unseen countries. It leverages cloud infrastructure logs and compares the geographic location of the source IP address against a baseline of known locations. This activity is significant as it may indicate unauthorized access or potential compromise of cloud resources. If confirmed malicious, an attacker could gain control over cloud assets, leading to data breaches, service disruptions, or further infiltration into the network.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     | tstats earliest(_time) as firstTime, latest(_time) as lastTime FROM datamodel=Change
       WHERE (
             All_Changes.action=started
@@ -31,7 +31,9 @@ search: |-
     | table firstTime, src, Country, user, object, command
     | `cloud_provisioning_activity_from_previously_unseen_country_filter`
 how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter` macro.
-known_false_positives: "This is a strictly behavioral search, so we define \"false positive\" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no \"false positives\" in a traditional sense, there is definitely lots of noise.\nThis search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you."
+known_false_positives: 'This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you''re searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.
+
+    This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.'
 references: []
 drilldown_searches:
     - name: View the detection results for - "$object$"
@@ -41,7 +43,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: object
@@ -73,7 +75,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       description: PORTED MANUAL TEST - This search needs the baseline to be run first to create a lookup
       test_type: experimental
diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml
index 94db84a678f..61ba8816efc 100644
--- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml
+++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects cloud provisioning activities originating from previously unseen IP addresses. It leverages cloud infrastructure logs to identify events where resources are created or started, and cross-references these with a baseline of known IP addresses. This activity is significant as it may indicate unauthorized access or potential misuse of cloud resources. If confirmed malicious, an attacker could gain unauthorized control over cloud resources, leading to data breaches, service disruptions, or increased operational costs.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     | tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id) as object_id FROM datamodel=Change
       WHERE (
             All_Changes.action=started
@@ -28,7 +28,9 @@ search: |-
     | table firstTime, src, user, object_id, command
     | `cloud_provisioning_activity_from_previously_unseen_ip_address_filter`
 how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` macro.
-known_false_positives: "This is a strictly behavioral search, so we define \"false positive\" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no \"false positives\" in a traditional sense, there is definitely lots of noise.\nThis search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you."
+known_false_positives: 'This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you''re searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.
+
+    This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.'
 references: []
 drilldown_searches:
     - name: View the detection results for - "$object_id$"
@@ -38,7 +40,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$object_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$object_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: object_id
@@ -70,7 +72,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       description: PORTED MANUAL TEST - This search needs the baseline to be run first to create a lookup
       test_type: experimental
diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml
index ecd39cf37de..cfd2f00d011 100644
--- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml
+++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects cloud provisioning activities originating from previously unseen regions. It leverages cloud infrastructure logs to identify events where resources are started or created, and cross-references these with a baseline of known regions. This activity is significant as it may indicate unauthorized access or misuse of cloud resources from unfamiliar locations. If confirmed malicious, this could lead to unauthorized resource creation, potential data exfiltration, or further compromise of cloud infrastructure.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     | tstats earliest(_time) as firstTime, latest(_time) as lastTime FROM datamodel=Change
       WHERE (
             All_Changes.action=started
@@ -31,7 +31,9 @@ search: |-
     | table firstTime, src, Region, user, object, command
     | `cloud_provisioning_activity_from_previously_unseen_region_filter`
 how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_region_filter` macro.
-known_false_positives: "This is a strictly behavioral search, so we define \"false positive\" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no \"false positives\" in a traditional sense, there is definitely lots of noise.\nThis search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you."
+known_false_positives: 'This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you''re searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.
+
+    This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.'
 references: []
 drilldown_searches:
     - name: View the detection results for - "$object$"
@@ -41,7 +43,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: object
@@ -73,7 +75,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       description: PORTED MANUAL TEST - This search needs the baseline to be run first to create a lookup
       test_type: experimental
diff --git a/detections/cloud/cloud_security_groups_modifications_by_user.yml b/detections/cloud/cloud_security_groups_modifications_by_user.yml
index 45948f8c3db..faa397ef6a7 100644
--- a/detections/cloud/cloud_security_groups_modifications_by_user.yml
+++ b/detections/cloud/cloud_security_groups_modifications_by_user.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies unusual modifications to security groups in your cloud environment by users, focusing on actions such as modifications, deletions, or creations over 30-minute intervals. It leverages cloud infrastructure logs and calculates the standard deviation for each user, using the 3-sigma rule to detect anomalies. This activity is significant as it may indicate a compromised account or insider threat. If confirmed malicious, attackers could alter security group configurations, potentially exposing sensitive resources or disrupting services.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     | tstats dc(All_Changes.object) as unique_security_groups values(All_Changes.src) as src values(All_Changes.user_type) as user_type values(All_Changes.object_category) as object_category values(All_Changes.object) as objects values(All_Changes.action) as action  values(All_Changes.user_agent) as user_agent values(All_Changes.command) as command FROM datamodel=Change
       WHERE All_Changes.object_category = "security_group" (All_Changes.action = modified
         OR
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -58,6 +58,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1578.005/aws_authorize_security_group/aws_authorize_security_group.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml
index a4bf03f11d0..32eb2e68bd6 100644
--- a/detections/cloud/detect_aws_console_login_by_new_user.yml
+++ b/detections/cloud/detect_aws_console_login_by_new_user.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic detects AWS console login events by new users. It leverages AWS CloudTrail events and compares them against a lookup file of previously seen users based on ARN values. This detection is significant because a new user logging into the AWS console could indicate the creation of new accounts or potential unauthorized access. If confirmed malicious, this activity could lead to unauthorized access to AWS resources, data exfiltration, or further exploitation within the cloud environment.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     | tstats earliest(_time) as firstTime latest(_time) as lastTime FROM datamodel=Authentication
       WHERE Authentication.signature=ConsoleLogin
       BY Authentication.user
@@ -46,7 +46,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       description: PORTED MANUAL TEST - This search needs the baseline `Previously Seen Users in CloudTrail - Initial` to be run first.
       test_type: experimental
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
index 924333e4578..194db8f8f40 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic identifies AWS console login events by users from a new city within the last hour. It leverages AWS CloudTrail events and compares them against a lookup file of previously seen user locations. This activity is significant for a SOC as it may indicate unauthorized access or credential compromise, especially if the login originates from an unusual location. If confirmed malicious, this could lead to unauthorized access to AWS resources, data exfiltration, or further exploitation within the cloud environment.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     | tstats earliest(_time) as firstTime latest(_time) as lastTime FROM datamodel=Authentication
       WHERE Authentication.signature=ConsoleLogin
       BY Authentication.user Authentication.src
@@ -54,7 +54,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       description: PORTED MANUAL TEST - This search needs the baseline to be run first to create a lookup. It also requires that the timestamps in the dataset be updated.
       test_type: experimental
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
index cd581f5e4cd..bd8af874929 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic identifies AWS console login events by users from a new country. It leverages AWS CloudTrail events and compares them against a lookup file of previously seen users and their login locations. This activity is significant because logins from new countries can indicate potential unauthorized access or compromised accounts. If confirmed malicious, this could lead to unauthorized access to AWS resources, data exfiltration, or further exploitation within the AWS environment.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     | tstats earliest(_time) as firstTime latest(_time) as lastTime FROM datamodel=Authentication
       WHERE Authentication.signature=ConsoleLogin
       BY Authentication.user Authentication.src
@@ -54,7 +54,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       description: PORTED MANUAL TEST - This search needs the baseline to be run first to create a lookup. It also requires that the timestamps in the dataset be updated.
       test_type: experimental
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
index a24f103f206..5087462d7ce 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic identifies AWS console login attempts by users from a new region. It leverages AWS CloudTrail events and compares current login regions against a baseline of previously seen regions for each user. This activity is significant as it may indicate unauthorized access attempts or compromised credentials. If confirmed malicious, an attacker could gain unauthorized access to AWS resources, potentially leading to data breaches, resource manipulation, or further lateral movement within the cloud environment.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     | tstats earliest(_time) as firstTime latest(_time) as lastTime FROM datamodel=Authentication
       WHERE Authentication.signature=ConsoleLogin
       BY Authentication.user Authentication.src
@@ -54,7 +54,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       description: PORTED MANUAL TEST - This search needs the baseline to be run first to create a lookup. It also requires that the timestamps in the dataset be updated.
       test_type: experimental
diff --git a/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml b/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml
index 11b83486b86..d407a8a2697 100644
--- a/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml
+++ b/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies access to GCP Storage buckets from new or previously unseen remote IP addresses. It leverages GCP Storage bucket-access logs ingested via Cloud Pub/Sub and compares current access events against a lookup table of previously seen IP addresses. This activity is significant as it may indicate unauthorized access or potential reconnaissance by an attacker. If confirmed malicious, this could lead to data exfiltration, unauthorized data manipulation, or further compromise of the GCP environment.
 data_source: []
-search: |-
+search: |
     `google_gcp_pubsub_message`
       | multikv
       | rename sc_status_ as status
diff --git a/detections/cloud/detect_new_open_gcp_storage_buckets.yml b/detections/cloud/detect_new_open_gcp_storage_buckets.yml
index b997d1c6f93..32882974d36 100644
--- a/detections/cloud/detect_new_open_gcp_storage_buckets.yml
+++ b/detections/cloud/detect_new_open_gcp_storage_buckets.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic identifies the creation of new open/public GCP Storage buckets. It leverages GCP PubSub events, specifically monitoring for the `storage.setIamPermissions` method and checks if the `allUsers` member is added. This activity is significant because open storage buckets can expose sensitive data to the public, posing a severe security risk. If confirmed malicious, an attacker could access, modify, or delete data within the bucket, leading to data breaches and potential compliance violations.
 data_source: []
-search: |-
+search: |
     `google_gcp_pubsub_message` data.resource.type=gcs_bucket data.protoPayload.methodName=storage.setIamPermissions
       | spath output=action path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.action
       | spath output=user path=data.protoPayload.authenticationInfo.principalEmail
@@ -24,8 +24,9 @@ how_to_implement: This search relies on the Splunk Add-on for Google Cloud Platf
 known_false_positives: While this search has no known false positives, it is possible that a GCP admin has legitimately created a public bucket for a specific purpose. That said, GCP strongly advises against granting full control to the "allUsers" group.
 references: []
 finding:
-    title: |
-        "allUser" member added to $bucketName$ by $user$ making the bucket available to the public
+    title: '"allUser" member added to $bucketName$ by $user$ making the bucket available to the public
+
+'
     entity:
         field: user
         type: user
diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml
index e81afac2b51..ef45d40b3e1 100644
--- a/detections/cloud/detect_new_open_s3_buckets.yml
+++ b/detections/cloud/detect_new_open_s3_buckets.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies the creation of open/public S3 buckets in AWS. It detects this activity by analyzing AWS CloudTrail events for `PutBucketAcl` actions where the access control list (ACL) grants permissions to all users or authenticated users. This activity is significant because open S3 buckets can expose sensitive data to unauthorized access, leading to data breaches. If confirmed malicious, an attacker could read, write, or fully control the contents of the bucket, potentially leading to data exfiltration or tampering.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl
       | rex field=_raw "(?<json_field>{.+})"
       | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{}
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_arn$" and "$bucketName$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_arn$", "$bucketName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user_arn$ has created an open/public bucket $bucketName$ with the following permissions $permission$
     entity:
@@ -59,6 +59,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
index 6f54d9dce32..12ae98f407d 100644
--- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
+++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
@@ -6,78 +6,17 @@ modification_date: '2026-05-13'
 author: Patrick Bareiss, Splunk, vshcherbakov
 status: production
 type: TTP
-description: |-
-    The following analytic detects the creation of open/public S3 buckets via the AWS CLI.
+description: 'The following analytic detects the creation of open/public S3 buckets via the AWS CLI.
+
     It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches.
-    If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk.
+
+    If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk.'
 data_source:
     - AWS CloudTrail
-search: |-
-    `cloudtrail`
-    eventSource="s3.amazonaws.com"
-    eventName="PutBucketAcl"
-    errorCode=success
-    userAgent IN ("[aws-cli*", "aws-cli*")
-
-    | rename requestParameters.bucketName AS bucketName
-             requestParameters.accessControlList.x-amz-grant-read AS grantRead
-             requestParameters.accessControlList.x-amz-grant-read-acp AS grantReadAcp
-             requestParameters.accessControlList.x-amz-grant-write AS grantWrite
-             requestParameters.accessControlList.x-amz-grant-write-acp AS grantWriteAcp
-             requestParameters.accessControlList.x-amz-grant-full-control AS grantFullControl
-             requestParameters.x-amz-acl AS cannedAcl,
-             userIdentity.principalId AS principalId
-             userIdentity.userName AS userName
-             userIdentity.arn AS userArn
-
-    | eval grantRead=coalesce(grantRead,"-"),
-           grantReadAcp=coalesce(grantReadAcp,"-"),
-           grantWrite=coalesce(grantWrite,"-"),
-           grantWriteAcp=coalesce(grantWriteAcp,"-"),
-           grantFullControl=coalesce(grantFullControl,"-"),
-           cannedAcl=coalesce(cannedAcl,"-"),
-           user=coalesce(userName,userArn)
-
-    | eval publicGrant = if(
-                            match(grantRead, "(?i)AllUsers|AuthenticatedUsers")
-                            OR
-                            match(grantReadAcp, "(?i)AllUsers|AuthenticatedUsers")
-                            OR
-                            match(grantWrite, "(?i)AllUsers|AuthenticatedUsers")
-                            OR
-                            match(grantWriteAcp, "(?i)AllUsers|AuthenticatedUsers")
-                            OR
-                            match(grantFullControl, "(?i)AllUsers|AuthenticatedUsers"),
-                            1,
-                            0
-                        )
-
-    | eval publicCanned = if(cannedAcl IN ("public-read", "public-read-write", "authenticated-read"), 1, 0)
-
-    | where publicGrant=1 OR publicCanned=1
-
-    | eval exposure=case(cannedAcl=="public-read-write","public-write", match(grantWrite."".grantWriteAcp."".grantFullControl,"(?i)AllUsers"),"public-write", cannedAcl=="public-read" OR match(grantRead,"(?i)AllUsers"),"public-read", cannedAcl=="authenticated-read" OR match(grantRead,"(?i)AuthenticatedUsers"),"authenticated-read", true(),"custom-grant")
-
-    | stats count
-            min(_time) AS firstTime
-            max(_time) AS lastTime
-            values(cannedAcl) AS cannedAcl
-            values(grantRead) AS grantRead
-            values(grantReadAcp) AS grantReadAcp
-            values(grantWrite) AS grantWrite
-            values(grantWriteAcp) AS grantWriteAcp
-            values(grantFullControl) AS grantFullControl
-            values(eventName) AS eventName
-
-      BY user principalId userAgent bucketName exposure
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_new_open_s3_buckets_over_aws_cli_filter`
-how_to_implement: |-
-    The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
-known_false_positives: |-
-    It is possible that an AWS admin has legitimately created a public bucket for a specific purpose. AWS strongly advises against granting full control to the "All Users" group. Investigate and apply the necessary filters as needed.
+search: |
+    `cloudtrail` eventSource="s3.amazonaws.com" eventName="PutBucketAcl" errorCode="success" userAgent IN ("[aws-cli*", "aws-cli*") | eval user=user_name, src=src, dc_events=dc_events, signature=signature | stats count min(_time) as firstTime max(_time) as lastTime by eventSource eventName errorCode userAgent bucketName grantRead grantReadAcp grantWrite grantWriteAcp grantFullControl cannedAcl | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter`
+how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
+known_false_positives: It is possible that an AWS admin has legitimately created a public bucket for a specific purpose. AWS strongly advises against granting full control to the "All Users" group. Investigate and apply the necessary filters as needed.
 references:
     - https://docs.aws.amazon.com/cli/latest/reference/s3api/create-bucket.html
 drilldown_searches:
@@ -88,16 +27,14 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User [$user$] has created an open/public S3 Bucket [$bucketName$] using AWS CLI with the following permissions - [$grantRead$] [$grantReadAcp$] [$grantWrite$] [$grantWriteAcp$] [$grantFullControl$] [$cannedAcl$]
     entity:
         field: user
         type: user
         score: 50
-threat_objects:
-    - field: bucketName
-      type: bucket_name
+threat_objects: []
 analytic_story:
     - Suspicious AWS S3 Activities
 asset_type: S3 Bucket
@@ -113,6 +50,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json
-          sourcetype: aws:cloudtrail
           source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
       test_type: unit
diff --git a/detections/cloud/detect_s3_access_from_a_new_ip.yml b/detections/cloud/detect_s3_access_from_a_new_ip.yml
index 368101748ce..10463e27abc 100644
--- a/detections/cloud/detect_s3_access_from_a_new_ip.yml
+++ b/detections/cloud/detect_s3_access_from_a_new_ip.yml
@@ -8,11 +8,10 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies access to an S3 bucket from a new or previously unseen remote IP address. It leverages S3 bucket-access logs, specifically focusing on successful access events (http_status=200). This activity is significant because access from unfamiliar IP addresses could indicate unauthorized access or potential data exfiltration attempts. If confirmed malicious, this activity could lead to unauthorized data access, data theft, or further exploitation of the compromised S3 bucket, posing a significant risk to sensitive information stored within the bucket.
 data_source: []
-search: |-
+search: |
     `aws_s3_accesslogs` http_status=200  [search `aws_s3_accesslogs` http_status=200
       | stats earliest(_time) as firstTime latest(_time) as lastTime
-        BY bucket_name remote_ip
-      | inputlookup append=t previously_seen_S3_access_from_remote_ip
+        BY bucket_name remote_ip bucketName | inputlookup append=t previously_seen_S3_access_from_remote_ip
       | stats min(firstTime) as firstTime, max(lastTime) as lastTime
         BY bucket_name remote_ip
       | outputlookup previously_seen_S3_access_from_remote_ip
diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
index ace2c536c87..f3489b14c6f 100644
--- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
+++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a spike in the number of AWS Security Hub alerts for an EC2 instance within a 4-hour interval. It leverages AWS Security Hub findings data, calculating the average and standard deviation of alerts to detect anomalies. This activity is significant for a SOC as a sudden increase in alerts may indicate potential security incidents or misconfigurations requiring immediate attention. If confirmed malicious, this could signify an ongoing attack, leading to unauthorized access, data exfiltration, or disruption of services on the affected EC2 instance.
 data_source:
     - AWS Security Hub
-search: |-
+search: |
     `aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance
       | bucket span=4h _time
       | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -53,6 +53,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/security_hub_ec2_spike/security_hub_ec2_spike.json
-          sourcetype: aws:securityhub:finding
           source: aws_securityhub_finding
+          sourcetype: aws:securityhub:finding
       test_type: unit
diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml
index 7995ffc36e2..12580a62117 100644
--- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml
+++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a spike in the number of AWS Security Hub alerts for an AWS IAM User within a 4-hour interval. It leverages AWS Security Hub findings data, calculating the average and standard deviation of alerts to detect significant deviations. This activity is significant as a sudden increase in alerts for a specific user may indicate suspicious behavior or a potential security incident. If confirmed malicious, this could signify an ongoing attack, unauthorized access, or misuse of IAM credentials, potentially leading to data breaches or further exploitation.
 data_source:
     - AWS Security Hub
-search: |-
+search: |
     `aws_securityhub_finding` "findings{}.Resources{}.Type"= AwsIamUser
       | rename findings{}.Resources{}.Id as user
       | bucket span=4h _time
diff --git a/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml b/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
index c39cf70796f..430eb253736 100644
--- a/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
+++ b/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies spikes in blocked outbound network connections originating from within your AWS environment. It leverages VPC Flow Logs data from CloudWatch, focusing on blocked actions from internal IP ranges to external destinations. This detection is significant as it can indicate potential exfiltration attempts or misconfigurations leading to data leakage. If confirmed malicious, such activity could allow attackers to bypass network defenses, leading to unauthorized data transfer or communication with malicious external entities.
 data_source: []
-search: |-
+search: |
     `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16)  [search  `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16)
       | stats count as numberOfBlockedConnections
         BY src_ip
diff --git a/detections/cloud/detect_spike_in_s3_bucket_deletion.yml b/detections/cloud/detect_spike_in_s3_bucket_deletion.yml
index 61d2d45b7a7..afcba160113 100644
--- a/detections/cloud/detect_spike_in_s3_bucket_deletion.yml
+++ b/detections/cloud/detect_spike_in_s3_bucket_deletion.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a spike in API activity related to the deletion of S3 buckets in your AWS environment. It leverages AWS CloudTrail logs to detect anomalies by comparing current deletion activity against a historical baseline. This activity is significant as unusual spikes in S3 bucket deletions could indicate malicious actions such as data exfiltration or unauthorized data destruction. If confirmed malicious, this could lead to significant data loss, disruption of services, and potential exposure of sensitive information. Immediate investigation is required to determine the legitimacy of the activity.
 data_source:
     - AWS CloudTrail
-search: |-
+search: |
     `cloudtrail` eventName=DeleteBucket [search `cloudtrail` eventName=DeleteBucket
       | spath output=arn path=userIdentity.arn
       | stats count as apiCalls
diff --git a/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml b/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml
index ca22a13b504..ddebf290661 100644
--- a/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml
+++ b/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects failed authentication attempts during the Multi-Factor Authentication (MFA) challenge on a Google Cloud Platform (GCP) tenant. It uses Google Workspace login failure events to identify instances where MFA methods were challenged but not successfully completed. This activity is significant as it may indicate an adversary attempting to access an account with compromised credentials despite MFA protection. If confirmed malicious, this could lead to unauthorized access attempts, potentially compromising sensitive data and resources within the GCP environment.
 data_source:
     - Google Workspace login_failure
-search: |-
+search: |
     `gws_reports_login` event.name=login_failure `gws_login_mfa_methods`
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY user, src_ip, login_challenge_method
@@ -27,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ failed to pass MFA challenge
     entity:
diff --git a/detections/cloud/gcp_detect_gcploit_framework.yml b/detections/cloud/gcp_detect_gcploit_framework.yml
index 3575899f684..943816ad186 100644
--- a/detections/cloud/gcp_detect_gcploit_framework.yml
+++ b/detections/cloud/gcp_detect_gcploit_framework.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic identifies the use of the GCPloit exploitation framework within Google Cloud Platform (GCP). It detects specific GCP Pub/Sub messages with a function timeout of 539 seconds, which is indicative of GCPloit activity. This detection is significant as GCPloit can be used to escalate privileges and facilitate lateral movement from compromised high-privilege accounts. If confirmed malicious, this activity could allow attackers to gain unauthorized access, escalate their privileges, and move laterally within the GCP environment, potentially compromising sensitive data and critical resources.
 data_source: []
-search: |-
+search: |
     `google_gcp_pubsub_message` data.protoPayload.request.function.timeout=539s
       | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent
       | `gcp_detect_gcploit_framework_filter`
diff --git a/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml b/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml
index 68e0bd876db..7916a9b7f70 100644
--- a/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml
+++ b/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Hunting
 description: The following analytic identifies unauthenticated requests to Kubernetes cluster pods. It detects this activity by analyzing GCP Pub/Sub messages for audit logs where the response status code is 401, indicating unauthorized access attempts. This activity is significant for a SOC because it may indicate reconnaissance or scanning attempts by an attacker trying to identify vulnerable pods. If confirmed malicious, this activity could lead to unauthorized access, allowing the attacker to exploit vulnerabilities within the cluster, potentially compromising sensitive data or gaining control over the Kubernetes environment.
 data_source: []
-search: |-
+search: |
     `google_gcp_pubsub_message` category=kube-audit
       | spath input=properties.log
       | search responseStatus.code=401
diff --git a/detections/cloud/gcp_multi_factor_authentication_disabled.yml b/detections/cloud/gcp_multi_factor_authentication_disabled.yml
index c9f8563677a..b4f35ed738e 100644
--- a/detections/cloud/gcp_multi_factor_authentication_disabled.yml
+++ b/detections/cloud/gcp_multi_factor_authentication_disabled.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic detects an attempt to disable multi-factor authentication (MFA) for a Google Cloud Platform (GCP) user. It leverages Google Workspace Admin log events, specifically the `UNENROLL_USER_FROM_STRONG_AUTH` command. This activity is significant because disabling MFA can allow an adversary to maintain persistence within the environment using a compromised account without raising suspicion. If confirmed malicious, this action could enable attackers to bypass additional security layers, potentially leading to unauthorized access, data exfiltration, or further exploitation of the compromised account.
 data_source:
     - Google Workspace
-search: |-
-    `gws_reports_admin` command=UNENROLL_USER_FROM_STRONG_AUTH
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY user, command, actor.email,
-           status, id.applicationName, event.name,
-           vendor_account, action
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `gcp_multi_factor_authentication_disabled_filter`
+search: |
+    `gws_reports_login` command="UNENROLL_USER_FROM_STRONG_AUTH" | eval 'actor.email'='actor.email', user=User | stats count min(_time) as firstTime max(_time) as lastTime by command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gcp_multi_factor_authentication_disabled_filter`
 how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. Specifically, this analytic leverages the Admin log events.
 known_false_positives: Legitimate use case may require for users to disable MFA. Filter as needed.
 references:
@@ -32,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: MFA disabled for User $user$ initiated by $actor.email$
     entity:
diff --git a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml
index 6106d6a1d59..f1a4e4c4c75 100644
--- a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml
+++ b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects multiple failed multi-factor authentication (MFA) requests for a single user within a Google Cloud Platform (GCP) tenant. It triggers when 10 or more MFA prompts fail within a 5-minute window, using Google Workspace login failure events. This behavior is significant as it may indicate an adversary attempting to bypass MFA by bombarding the user with repeated authentication requests. If confirmed malicious, this activity could lead to unauthorized access, allowing attackers to compromise accounts and potentially escalate privileges within the GCP environment.
 data_source:
     - Google Workspace
-search: |-
+search: |
     `gws_reports_login` event.name=login_failure `gws_login_mfa_methods`
       | bucket span=5m _time
       | stats dc(_raw) AS mfa_prompts values(user) AS user
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Multiple Failed MFA requests for user $user$
     entity:
diff --git a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml
index f1ed0d17fe8..daf5e3595c7 100644
--- a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml
+++ b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects a single source IP address failing to authenticate into more than 20 unique Google Workspace user accounts within a 5-minute window. It leverages Google Workspace login failure events to identify potential password spraying attacks. This activity is significant as it may indicate an adversary attempting to gain unauthorized access or elevate privileges within the Google Cloud Platform. If confirmed malicious, this behavior could lead to unauthorized access to sensitive resources, data breaches, or further exploitation within the environment.
 data_source:
     - Google Workspace
-search: |-
+search: |
     `gws_reports_login` event.type = login event.name = login_failure
       | bucket span=5m _time
       | stats count dc(user) AS unique_accounts values(user) as tried_accounts values(authentication_method) AS authentication_method earliest(_time) as firstTime latest(_time) as lastTime
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$tried_accounts$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$tried_accounts$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: tried_accounts
diff --git a/detections/cloud/gcp_successful_single_factor_authentication.yml b/detections/cloud/gcp_successful_single_factor_authentication.yml
index 80313b0cb48..945cd6b2da0 100644
--- a/detections/cloud/gcp_successful_single_factor_authentication.yml
+++ b/detections/cloud/gcp_successful_single_factor_authentication.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies a successful single-factor authentication event against Google Cloud Platform (GCP) for an account without Multi-Factor Authentication (MFA) enabled. It uses Google Workspace login event data to detect instances where MFA is not utilized. This activity is significant as it may indicate a misconfiguration, policy violation, or potential account takeover attempt. If confirmed malicious, an attacker could gain unauthorized access to GCP resources, potentially leading to data breaches, service disruptions, or further exploitation within the cloud environment.
 data_source:
     - Google Workspace
-search: |-
+search: |
     `gws_reports_login` event.name=login_success NOT `gws_login_mfa_methods`
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY user, src_ip, login_challenge_method,
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Successful authentication for user $user$ without MFA
     entity:
diff --git a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml
index 97279e579e3..2fde37aaa2b 100644
--- a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml
+++ b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a single source IP failing to authenticate into Google Workspace with multiple valid users, potentially indicating a Password Spraying attack. It uses Google Workspace login failure events and calculates the standard deviation for source IPs, applying the 3-sigma rule to detect unusual failed authentication attempts. This activity is significant as it may signal an adversary attempting to gain initial access or elevate privileges. If confirmed malicious, this could lead to unauthorized access, data breaches, or further exploitation within the environment.
 data_source:
     - Google Workspace
-search: |-
+search: |
     `gws_reports_login` event.type = login event.name = login_failure
       | bucket span=5m _time
       | stats  dc(user_name) AS unique_accounts values(user_name) as tried_accounts values(authentication_method) AS authentication_method
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$tried_accounts$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$tried_accounts$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: tried_accounts
diff --git a/detections/cloud/gdrive_suspicious_file_sharing.yml b/detections/cloud/gdrive_suspicious_file_sharing.yml
index 5879ae48bf0..687ce7964cc 100644
--- a/detections/cloud/gdrive_suspicious_file_sharing.yml
+++ b/detections/cloud/gdrive_suspicious_file_sharing.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Hunting
 description: The following analytic identifies suspicious file-sharing activity on Google Drive, where internal users share documents with more than 50 external recipients. It leverages GSuite Drive logs, focusing on changes in user access and filtering for emails outside the organization's domain. This activity is significant as it may indicate compromised accounts or intentional data exfiltration. If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, data leaks, and potential compliance violations.
 data_source: []
-search: |-
+search: |
     `gsuite_drive` name=change_user_access
       | rename parameters.* as *
       | search email = "*@yourdomain.com" target_user != "*@yourdomain.com"
diff --git a/detections/cloud/geographic_improbable_location.yml b/detections/cloud/geographic_improbable_location.yml
index 915e3e66994..b2d28ae0738 100644
--- a/detections/cloud/geographic_improbable_location.yml
+++ b/detections/cloud/geographic_improbable_location.yml
@@ -9,9 +9,11 @@ type: Anomaly
 description: Geolocation data can be inaccurate or easily spoofed by Remote Employment Fraud (REF) workers. REF actors sometimes slip up and reveal their true location, creating what we call 'improbable travel' scenarios — logins from opposite sides of the world within minutes. This identifies situations where these travel scenarios occur.
 data_source:
     - Okta
-search: '| tstats summariesonly=true values(Authentication.app) as app from datamodel=Authentication.Authentication where (`okta` OR (index="firewall" AND sourcetype="pan:globalprotect")) AND Authentication.action="success" AND Authentication.app IN ("Workday", "Slack", "*GlobalProtect", "Jira*", "Atlassian Cloud", "Zoom") AND NOT Authentication.user="unknown" by _time index sourcetype host Authentication.user Authentication.src span=1s | `drop_dm_object_name("Authentication")` | fields user,src,app,_time,count,host | eval user=lower(replace(user, "((^.*\\\)|(@.*$))", "")) | join type=outer user [| inputlookup identity_lookup_expanded where user_status=active | rex field=email "^(?<user>[a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$" | rename email as user_email bunit as user_bunit priority as user_priority work_country as user_work_country work_city as user_work_city | fields user user_email user_bunit user_priority user_work_country user_work_city] | eventstats dc(src) as src_count by user | eventstats dc(user) as user_count by src | sort 0 + _time | iplocation src | lookup local=true asn_lookup_by_cidr ip as src OUTPUT ip asn description | eval session_lat=if(isnull(src_lat), lat, src_lat), session_lon=if(isnull(src_long), lon, src_long), session_city=if(isnull(src_city), City, src_city), session_country=if(isnull(src_country), Country, src_country), session_region=if(isnull(src_region), Region, src_region) | eval session_city=if(isnull(session_city) OR match(session_city,"^\s+|^$"), null(), session_city), session_country=if(isnull(session_country) OR match(session_country,"^\s+|^$"), null(), session_country), session_region=if(isnull(session_region) OR match(session_region,"^\s+|^$"), null(), session_region) | where isnotnull(session_lat) and isnotnull(session_lon) | eval session_city=if(isnull(session_city),"-",session_city), session_country=if(isnull(session_country),"-",session_country), session_region=if(isnull(session_region),"-",session_region) | streamstats current=t window=2 earliest(session_region) as prev_region,earliest(session_lat) as prev_lat, earliest(session_lon) as prev_lon, earliest(session_city) as prev_city, earliest(session_country) as prev_country, earliest(_time) as prev_time, earliest(src) as prev_src, latest(user_bunit) as user_bunit, earliest(app) as prev_app values(user_work_country) as user_work_country by user | where (src!=prev_src) AND !(prev_city=session_city AND prev_country=session_country) AND ((isnotnull(prev_city) AND isnotnull(session_city)) OR prev_country!=session_country) | `globedistance(session_lat,session_lon,prev_lat,prev_lon,"m")` | eval time_diff=if((_time-prev_time)==0, 1, _time - prev_time) | eval speed = round(distance*3600/time_diff,2) | eval distance= round(distance,2) | eval user_work_country=case(user_work_country="usa","United States", user_work_country="cze","Czechia", user_work_country="pol","Poland", user_work_country="ind","India", user_work_country="fra","France", user_work_country="can","Canada", user_work_country="mys","Malaysia", user_work_country="kor","South Korea", user_work_country="aus","Australia", user_work_country="bel","Belgium", user_work_country="dnk","Denmark", user_work_country="bra","Brazil", user_work_country="deu","Germany", user_work_country="jpn","Japan", user_work_country="che","Switzerland", user_work_country="swe","Sweden", user_work_country="zaf","South Africa", user_work_country="irl","Ireland", user_work_country="ita","Italy", user_work_country="nor","Norway", user_work_country="gbr","United Kingdom", user_work_country="hkg","Hong Kong", user_work_country="chn","China", user_work_country="esp","Spain", user_work_country="nld", "Netherlands", user_work_country="twn","Taiwan", user_work_country="est","Estonia", user_work_country="sgp","Singapore", user_work_country="are","United Arab Emirates", 1=1,"N/A") | lookup local=true asn_lookup_by_cidr ip as prev_src OUTPUT ip as prev_ip asn as prev_asn description as prev_description | eval suspect=if(!user_work_country==session_country,"Sketchy","Normal") | search (speed>500 AND distance>750) | table _time,prev_time,user,host,src,prev_src,app,prev_app,distance,speed,suspect,session_city,session_region, session_country,prev_city,prev_region,prev_country,user_priority,user_work_*,prev_ip,ip,asn,prev_asn,prev_description,description | rename _time as event_time | convert ctime(event_time) timeformat="%Y-%m-%d %H:%M:%S" | convert ctime(prev_time) timeformat="%Y-%m-%d %H:%M:%S" | eval problem=if(!session_country==prev_country AND (!session_country==user_work_country),"Yes","Nope") | search NOT (prev_city="-" OR session_city="-") AND NOT [inputlookup known_devices_public_ip_filter.csv | fields ip | rename ip as src] | dedup user host prev_src src | fillnull value="N/A" | search problem="Yes"| `geographic_improbable_location_filter`'
+search: |
+    | tstats summariesonly=true values(Authentication.app) as app from datamodel=Authentication.Authentication where (`okta` OR (index="firewall" AND sourcetype="pan:globalprotect")) AND Authentication.action="success" AND Authentication.app IN ("Workday", "Slack", "*GlobalProtect", "Jira*", "Atlassian Cloud", "Zoom") AND NOT Authentication.user="unknown" by _time index sourcetype host Authentication.user Authentication.src span=1s | `drop_dm_object_name("Authentication")` | fields user,src,app,_time,count,host | eval user=lower(replace(user, "((^.*\\\)|(@.*$))", "")) | join type=outer user [| inputlookup identity_lookup_expanded where user_status=active | rex field=email "^(?<user>[a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$" | rename email as user_email bunit as user_bunit priority as user_priority work_country as user_work_country work_city as user_work_city | fields user user_email user_bunit user_priority user_work_country user_work_city] | eventstats dc(src) as src_count by user | eventstats dc(user) as user_count by src | sort 0 + _time | iplocation src | lookup local=true asn_lookup_by_cidr ip as src OUTPUT ip asn description | eval session_lat=if(isnull(src_lat), lat, src_lat), session_lon=if(isnull(src_long), lon, src_long), session_city=if(isnull(src_city), City, src_city), session_country=if(isnull(src_country), Country, src_country), session_region=if(isnull(src_region), Region, src_region) | eval session_city=if(isnull(session_city) OR match(session_city,"^\s+|^$"), null(), session_city), session_country=if(isnull(session_country) OR match(session_country,"^\s+|^$"), null(), session_country), session_region=if(isnull(session_region) OR match(session_region,"^\s+|^$"), null(), session_region) | where isnotnull(session_lat) and isnotnull(session_lon) | eval session_city=if(isnull(session_city),"-",session_city), session_country=if(isnull(session_country),"-",session_country), session_region=if(isnull(session_region),"-",session_region) | streamstats current=t window=2 earliest(session_region) as prev_region,earliest(session_lat) as prev_lat, earliest(session_lon) as prev_lon, earliest(session_city) as prev_city, earliest(session_country) as prev_country, earliest(_time) as prev_time, earliest(src) as prev_src, latest(user_bunit) as user_bunit, earliest(app) as prev_app values(user_work_country) as user_work_country by user | where (src!=prev_src) AND !(prev_city=session_city AND prev_country=session_country) AND ((isnotnull(prev_city) AND isnotnull(session_city)) OR prev_country!=session_country) | `globedistance(session_lat,session_lon,prev_lat,prev_lon,"m")` | eval time_diff=if((_time-prev_time)==0, 1, _time - prev_time) | eval speed = round(distance*3600/time_diff,2) | eval distance= round(distance,2) | eval user_work_country=case(user_work_country="usa","United States", user_work_country="cze","Czechia", user_work_country="pol","Poland", user_work_country="ind","India", user_work_country="fra","France", user_work_country="can","Canada", user_work_country="mys","Malaysia", user_work_country="kor","South Korea", user_work_country="aus","Australia", user_work_country="bel","Belgium", user_work_country="dnk","Denmark", user_work_country="bra","Brazil", user_work_country="deu","Germany", user_work_country="jpn","Japan", user_work_country="che","Switzerland", user_work_country="swe","Sweden", user_work_country="zaf","South Africa", user_work_country="irl","Ireland", user_work_country="ita","Italy", user_work_country="nor","Norway", user_work_country="gbr","United Kingdom", user_work_country="hkg","Hong Kong", user_work_country="chn","China", user_work_country="esp","Spain", user_work_country="nld", "Netherlands", user_work_country="twn","Taiwan", user_work_country="est","Estonia", user_work_country="sgp","Singapore", user_work_country="are","United Arab Emirates", 1=1,"N/A") | lookup local=true asn_lookup_by_cidr ip as prev_src OUTPUT ip as prev_ip asn as prev_asn description as prev_description | eval suspect=if(!user_work_country==session_country,"Sketchy","Normal") | search (speed>500 AND distance>750) | table _time,prev_time,user,host,src,prev_src,app,prev_app,distance,speed,suspect,session_city,session_region, session_country,prev_city,prev_region,prev_country,user_priority,user_work_*,prev_ip,ip,asn,prev_asn,prev_description,description | rename _time as event_time | convert ctime(event_time) timeformat="%Y-%m-%d %H:%M:%S" | convert ctime(prev_time) timeformat="%Y-%m-%d %H:%M:%S" | eval problem=if(!session_country==prev_country AND (!session_country==user_work_country),"Yes","Nope") | search NOT (prev_city="-" OR session_city="-") AND NOT [inputlookup known_devices_public_ip_filter.csv | fields ip | rename ip as src] | dedup user host prev_src src | fillnull value="N/A" | search problem="Yes"| `geographic_improbable_location_filter`
 how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553). This also utilizes Splunk Enterprise Security Suite for several macros and lookups. The known_devices_public_ip_filter lookup is a placeholder for known public edge devices in your network.
 known_false_positives: Legitimate usage of some VPNs may cause false positives. Tune as needed.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$user$"
       search: '%original_detection_search% | search  Authentication.user = "$user$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_enterprise_delete_branch_ruleset.yml b/detections/cloud/github_enterprise_delete_branch_ruleset.yml
index 3b2e2b98411..1493ca27966 100644
--- a/detections/cloud/github_enterprise_delete_branch_ruleset.yml
+++ b/detections/cloud/github_enterprise_delete_branch_ruleset.yml
@@ -9,19 +9,8 @@ type: Anomaly
 description: The following analytic detects when branch rules are deleted in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for branch rule deletion events by tracking actor details, repository information, and associated metadata. For a SOC, identifying deleted branch rules is critical as it could indicate attempts to bypass code review requirements and security controls. Branch deletion rules are essential security controls that enforce code review, prevent force pushes, and maintain code quality. Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting to inject malicious code.
 data_source:
     - GitHub Enterprise Audit Logs
-search: |-
-    `github_enterprise` action=repository_ruleset.destroy
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_ip,
-           actor_is_bot, actor_location.country_code, business,
-           business_id, org, org_id,
-           repo, repo_id, user_agent,
-           action, ruleset_name
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_enterprise_delete_branch_ruleset_filter`
+search: |
+    `github_enterprise` action="repository_ruleset.destroy" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_enterprise_delete_branch_ruleset_filter`
 how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -35,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_enterprise_disable_2fa_requirement.yml b/detections/cloud/github_enterprise_disable_2fa_requirement.yml
index e5b34be19ba..dd6239b9b0d 100644
--- a/detections/cloud/github_enterprise_disable_2fa_requirement.yml
+++ b/detections/cloud/github_enterprise_disable_2fa_requirement.yml
@@ -9,17 +9,8 @@ type: Anomaly
 description: The following analytic detects when two-factor authentication (2FA) requirements are disabled in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for 2FA requirement changes by tracking actor details, organization information, and associated metadata. For a SOC, identifying disabled 2FA requirements is critical as it could indicate attempts to weaken account security controls. Two-factor authentication is a fundamental security control that helps prevent unauthorized access even if passwords are compromised. Disabling 2FA requirements could allow attackers to more easily compromise accounts through password-based attacks. The impact of disabled 2FA includes increased risk of account takeover, potential access to sensitive code and intellectual property, and compromise of the software supply chain. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting broader account compromises.
 data_source:
     - GitHub Enterprise Audit Logs
-search: |-
-    `github_enterprise` action=org.disable_two_factor_requirement OR action=business.disable_two_factor_requirement
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_is_bot,
-           actor_location.country_code, business, business_id,
-           user_agent, action
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_enterprise_disable_2fa_requirement_filter`
+search: |
+    `github_enterprise` action IN ("org.disable_two_factor_requirement", "business.disable_two_factor_requirement") | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_enterprise_disable_2fa_requirement_filter`
 how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -33,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_enterprise_disable_audit_log_event_stream.yml b/detections/cloud/github_enterprise_disable_audit_log_event_stream.yml
index 3b4ccb778ce..0d345fce1bd 100644
--- a/detections/cloud/github_enterprise_disable_audit_log_event_stream.yml
+++ b/detections/cloud/github_enterprise_disable_audit_log_event_stream.yml
@@ -9,17 +9,8 @@ type: Anomaly
 description: The following analytic detects when a user disables audit log event streaming in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for configuration changes that disable the audit log streaming functionality, which is used to send audit events to security monitoring platforms. This behavior could indicate an attacker attempting to prevent their malicious activities from being logged and detected by disabling the audit trail. For a SOC, identifying the disabling of audit logging is critical as it may be a precursor to other attacks where adversaries want to operate undetected. The impact could be severe as organizations lose visibility into user actions, configuration changes, and security events within their GitHub Enterprise environment, potentially allowing attackers to perform malicious activities without detection. This creates a significant blind spot in security monitoring and incident response capabilities.
 data_source:
     - GitHub Enterprise Audit Logs
-search: |-
-    `github_enterprise` action=audit_log_streaming.destroy
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_ip,
-           actor_is_bot, actor_location.country_code, business,
-           business_id, user_agent, action
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_enterprise_disable_audit_log_event_stream_filter`
+search: |
+    `github_enterprise` action="audit_log_streaming.destroy" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_enterprise_disable_audit_log_event_stream_filter`
 how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -33,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_enterprise_disable_classic_branch_protection_rule.yml b/detections/cloud/github_enterprise_disable_classic_branch_protection_rule.yml
index d9da88713e1..796a66ee958 100644
--- a/detections/cloud/github_enterprise_disable_classic_branch_protection_rule.yml
+++ b/detections/cloud/github_enterprise_disable_classic_branch_protection_rule.yml
@@ -9,19 +9,8 @@ type: Anomaly
 description: The following analytic detects when classic branch protection rules are disabled in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for branch protection removal events by tracking actor details, repository information, and associated metadata. For a SOC, identifying disabled branch protection is critical as it could indicate attempts to bypass code review requirements and security controls. Branch protection rules are essential security controls that enforce code review, prevent force pushes, and maintain code quality. Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting to inject malicious code.
 data_source:
     - GitHub Enterprise Audit Logs
-search: |-
-    `github_enterprise` action=protected_branch.destroy
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_ip,
-           actor_is_bot, actor_location.country_code, business,
-           business_id, org, org_id,
-           repo, repo_id, user_agent,
-           action, name
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_enterprise_disable_classic_branch_protection_rule_filter`
+search: |
+    `github_enterprise` action="protected_branch.destroy" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_enterprise_disable_classic_branch_protection_rule_filter`
 how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -35,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_enterprise_disable_dependabot.yml b/detections/cloud/github_enterprise_disable_dependabot.yml
index 9149e337d61..ca031cbb76e 100644
--- a/detections/cloud/github_enterprise_disable_dependabot.yml
+++ b/detections/cloud/github_enterprise_disable_dependabot.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects when a user disables Dependabot security features within a GitHub repository. Dependabot helps automatically identify and fix security vulnerabilities in dependencies. The detection monitors GitHub Enterprise logs for configuration changes that disable Dependabot functionality. This behavior could indicate an attacker attempting to prevent the automatic detection of vulnerable dependencies, which would allow them to exploit known vulnerabilities that would otherwise be patched. For a SOC, identifying the disabling of security features like Dependabot is critical as it may be a precursor to supply chain attacks where attackers exploit vulnerable dependencies. The impact could be severe if vulnerabilities remain unpatched, potentially leading to code execution, data theft, or other compromises through the software supply chain.
 data_source:
     - GitHub Enterprise Audit Logs
-search: |-
-    `github_enterprise` action=repository_vulnerability_alerts.disable
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_ip,
-           actor_is_bot, actor_location.country_code, business,
-           business_id, org, org_id,
-           repo, repo_id, user,
-           user_agent, user_id, action
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_enterprise_disable_dependabot_filter`
+search: |
+    `github_enterprise` action="repository_vulnerability_alerts.disable" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_enterprise_disable_dependabot_filter`
 how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_enterprise_disable_ip_allow_list.yml b/detections/cloud/github_enterprise_disable_ip_allow_list.yml
index 45321dbf0fd..5e853265fd2 100644
--- a/detections/cloud/github_enterprise_disable_ip_allow_list.yml
+++ b/detections/cloud/github_enterprise_disable_ip_allow_list.yml
@@ -9,17 +9,8 @@ type: Anomaly
 description: The following analytic identifies when an IP allow list is disabled in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for actions related to disabling IP allow lists at the organization or enterprise level. This behavior is concerning because IP allow lists are a critical security control that restricts access to GitHub Enterprise resources to only trusted IP addresses. When disabled, it could indicate an attacker attempting to bypass access controls to gain unauthorized access from untrusted networks. The impact includes potential exposure of sensitive code repositories and GitHub Enterprise resources to access from any IP address. SOC teams should investigate such events, especially if they were not pre-approved changes, as they may indicate compromise of admin credentials or malicious insider activity.
 data_source:
     - GitHub Enterprise Audit Logs
-search: |-
-    `github_enterprise` action=ip_allow_list.disable
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_is_bot,
-           actor_location.country_code, business, business_id,
-           user_agent, user_id, action
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_enterprise_disable_ip_allow_list_filter`
+search: |
+    `github_enterprise` action="ip_allow_list.disable" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_enterprise_disable_ip_allow_list_filter`
 how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -33,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_enterprise_modify_audit_log_event_stream.yml b/detections/cloud/github_enterprise_modify_audit_log_event_stream.yml
index 966f4ca677e..72f1085f93e 100644
--- a/detections/cloud/github_enterprise_modify_audit_log_event_stream.yml
+++ b/detections/cloud/github_enterprise_modify_audit_log_event_stream.yml
@@ -9,17 +9,8 @@ type: Anomaly
 description: The following analytic detects when a user modifies or disables audit log event streaming in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for configuration changes that affect the audit log streaming functionality, which is used to send audit events to security monitoring platforms. This behavior could indicate an attacker attempting to prevent their malicious activities from being logged and detected by tampering with the audit trail. For a SOC, identifying modifications to audit logging is critical as it may be a precursor to other attacks where adversaries want to operate undetected. The impact could be severe as organizations lose visibility into user actions, configuration changes, and security events within their GitHub Enterprise environment, potentially allowing attackers to perform malicious activities without detection. This creates a significant blind spot in security monitoring and incident response capabilities.
 data_source:
     - GitHub Enterprise Audit Logs
-search: |-
-    `github_enterprise` action=audit_log_streaming.update
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_ip,
-           actor_is_bot, actor_location.country_code, business,
-           business_id, user_agent, action
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_enterprise_modify_audit_log_event_stream_filter`
+search: |
+    `github_enterprise` action="audit_log_streaming.update" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_enterprise_modify_audit_log_event_stream_filter`
 how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -33,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_enterprise_pause_audit_log_event_stream.yml b/detections/cloud/github_enterprise_pause_audit_log_event_stream.yml
index 54eaf33acf8..3c3777b7ecf 100644
--- a/detections/cloud/github_enterprise_pause_audit_log_event_stream.yml
+++ b/detections/cloud/github_enterprise_pause_audit_log_event_stream.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects when a user pauses audit log event streaming in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for configuration changes that temporarily suspend the audit log streaming functionality, which is used to send audit events to security monitoring platforms. This behavior could indicate an attacker attempting to prevent their malicious activities from being logged and detected by temporarily disabling the audit trail. For a SOC, identifying the pausing of audit logging is critical as it may be a precursor to other attacks where adversaries want to operate undetected during the pause window. The impact could be severe as organizations temporarily lose visibility into user actions, configuration changes, and security events within their GitHub Enterprise environment, potentially allowing attackers to perform malicious activities without detection during the pause period. This creates a temporary blind spot in security monitoring and incident response capabilities.
 data_source:
     - GitHub Enterprise Audit Logs
-search: |-
-    `github_enterprise` action=audit_log_streaming.update reason="User initiated pause"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_ip,
-           actor_is_bot, actor_location.country_code, business,
-           business_id, user_agent, action,
-           reason
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_enterprise_pause_audit_log_event_stream_filter`
+search: |
+    `github_enterprise` action="audit_log_streaming.update" reason="User initiated pause" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by reason user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_enterprise_pause_audit_log_event_stream_filter`
 how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_enterprise_register_self_hosted_runner.yml b/detections/cloud/github_enterprise_register_self_hosted_runner.yml
index 62cbf2ac234..f5c4faa736a 100644
--- a/detections/cloud/github_enterprise_register_self_hosted_runner.yml
+++ b/detections/cloud/github_enterprise_register_self_hosted_runner.yml
@@ -9,17 +9,8 @@ type: Anomaly
 description: The following analytic identifies when a self-hosted runner is created in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for actions related to creating new self-hosted runners at the organization or enterprise level. his behavior warrants monitoring because self-hosted runners execute workflow jobs on customer-controlled infrastructure, which could be exploited by attackers to execute malicious code, access sensitive data, or pivot to other systems. While self-hosted runners are a legitimate feature, their creation should be carefully controlled as compromised runners pose significant security risks. The impact includes potential remote code execution, data exfiltration, and lateral movement within the environment if a runner is compromised. SOC teams should investigate unexpected runner creation events to verify they are authorized and properly secured, especially if created by unfamiliar users or in unusual contexts.
 data_source:
     - GitHub Enterprise Audit Logs
-search: |-
-    `github_enterprise` action=enterprise.register_self_hosted_runner
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_is_bot,
-           actor_location.country_code, business, business_id,
-           user_agent, action
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_enterprise_register_self_hosted_runner_filter`
+search: |
+    `github_enterprise` action="enterprise.register_self_hosted_runner" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_enterprise_register_self_hosted_runner_filter`
 how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -34,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_enterprise_remove_organization.yml b/detections/cloud/github_enterprise_remove_organization.yml
index df24a6095ce..2734b37cde3 100644
--- a/detections/cloud/github_enterprise_remove_organization.yml
+++ b/detections/cloud/github_enterprise_remove_organization.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects when a user removes an organization from GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for organization deletion events, which could indicate unauthorized removal of critical business resources. For a SOC, identifying organization removals is crucial as it may signal account compromise, insider threats, or malicious attempts to disrupt business operations by deleting entire organizational structures. The impact could be severe, potentially resulting in loss of source code, repositories, team structures, access controls, and other critical organizational assets. This disruption could halt development workflows, cause data loss, and require significant effort to restore from backups if available. Additionally, unauthorized organization removal could be part of a larger attack campaign aimed at destroying or compromising enterprise assets.
 data_source:
     - GitHub Enterprise Audit Logs
-search: |-
-    `github_enterprise` action=business.remove_organization
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_is_bot,
-           actor_location.country_code, business, business_id,
-           org, org_id, user_agent,
-           action
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_enterprise_remove_organization_filter`
+search: |
+    `github_enterprise` action="business.remove_organization" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_enterprise_remove_organization_filter`
 how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_enterprise_repository_archived.yml b/detections/cloud/github_enterprise_repository_archived.yml
index f90150cdb23..2d42cd96ef2 100644
--- a/detections/cloud/github_enterprise_repository_archived.yml
+++ b/detections/cloud/github_enterprise_repository_archived.yml
@@ -9,19 +9,8 @@ type: Anomaly
 description: The following analytic detects when a repository is archived in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for repository archival events by tracking actor details, repository information, and associated metadata. For a SOC, identifying repository archival is important as it could indicate attempts to make critical code inaccessible or preparation for repository deletion. While archiving is a legitimate feature, unauthorized archival of active repositories could signal account compromise, insider threats, or attempts to disrupt development operations. The impact of unauthorized repository archival includes loss of active development access, disruption to workflows and CI/CD pipelines, and potential business delays if critical repositories are affected. Additionally, archived repositories may be targeted for subsequent deletion, potentially resulting in permanent loss of intellectual property if proper backups are not maintained.
 data_source:
     - GitHub Enterprise Audit Logs
-search: |-
-    `github_enterprise` action=repo.archived
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_is_bot,
-           actor_location.country_code, business, business_id,
-           org, org_id, repo,
-           repo_id, user_agent, visibility,
-           action
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_enterprise_repository_archived_filter`
+search: |
+    `github_enterprise` action="repo.archived" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_enterprise_repository_archived_filter`
 how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -35,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_enterprise_repository_deleted.yml b/detections/cloud/github_enterprise_repository_deleted.yml
index c224e5de4ad..151fc89253e 100644
--- a/detections/cloud/github_enterprise_repository_deleted.yml
+++ b/detections/cloud/github_enterprise_repository_deleted.yml
@@ -9,19 +9,8 @@ type: Anomaly
 description: The following analytic detects when a user deletes a repository in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for repository deletion events, which could indicate unauthorized removal of critical source code and project resources. For a SOC, identifying repository deletions is crucial as it may signal account compromise, insider threats, or malicious attempts to destroy intellectual property and disrupt development operations. The impact could be severe, potentially resulting in permanent loss of source code, documentation, project history, and other critical assets if proper backups are not maintained. Repository deletion could halt development workflows, cause significant business disruption, and require substantial effort to restore from backups if available. Additionally, unauthorized repository removal could be part of a larger attack campaign aimed at destroying or compromising enterprise assets.
 data_source:
     - GitHub Enterprise Audit Logs
-search: |-
-    `github_enterprise` action=repo.destroy
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_is_bot,
-           actor_location.country_code, business, business_id,
-           org, org_id, repo,
-           repo_id, user_agent, visibility,
-           action
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_enterprise_repository_deleted_filter`
+search: |
+    `github_enterprise` action="repo.destroy" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_enterprise_repository_deleted_filter`
 how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -35,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_organizations_delete_branch_ruleset.yml b/detections/cloud/github_organizations_delete_branch_ruleset.yml
index f4db552b5f2..5a7981e0610 100644
--- a/detections/cloud/github_organizations_delete_branch_ruleset.yml
+++ b/detections/cloud/github_organizations_delete_branch_ruleset.yml
@@ -9,19 +9,8 @@ type: Anomaly
 description: The following analytic detects when branch rulesets are deleted in GitHub Organizations. The detection monitors GitHub Organizations audit logs for branch ruleset deletion events by tracking actor details, repository information, and associated metadata. For a SOC, identifying deleted branch rulesets is critical as it could indicate attempts to bypass code review requirements and security controls. Branch rulesets are essential security controls that enforce code review, prevent force pushes, and maintain code quality. Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting to inject malicious code.
 data_source:
     - GitHub Organizations Audit Logs
-search: |-
-    `github_organizations` vendor_action=repository_ruleset.destroy
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_ip,
-           actor_is_bot, actor_location.country_code, business,
-           business_id, org, org_id,
-           repo, repo_id, user_agent,
-           vendor_action, ruleset_name
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_organizations_delete_branch_ruleset_filter`
+search: |
+    `github_organizations` vendor_action="repository_ruleset.destroy" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by vendor_action user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_organizations_delete_branch_ruleset_filter`
 how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/ .
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -35,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_organizations_disable_2fa_requirement.yml b/detections/cloud/github_organizations_disable_2fa_requirement.yml
index 8a484fbec66..5a828d5b7fa 100644
--- a/detections/cloud/github_organizations_disable_2fa_requirement.yml
+++ b/detections/cloud/github_organizations_disable_2fa_requirement.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects when two-factor authentication (2FA) requirements are disabled in GitHub Organizations. The detection monitors GitHub Organizations audit logs for 2FA requirement changes by tracking actor details, organization information, and associated metadata. For a SOC, identifying disabled 2FA requirements is critical as it could indicate attempts to weaken account security controls. Two-factor authentication is a fundamental security control that helps prevent unauthorized access even if passwords are compromised. Disabling 2FA requirements could allow attackers to more easily compromise accounts through password-based attacks. The impact of disabled 2FA includes increased risk of account takeover, potential access to sensitive code and intellectual property, and compromise of the software supply chain. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting broader account compromises.
 data_source:
     - GitHub Organizations Audit Logs
-search: |-
-    `github_organizations` vendor_action=org.disable_two_factor_requirement
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_ip,
-           actor_is_bot, actor_location.country_code, business,
-           business_id, org, org_id,
-           user_agent, vendor_action
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_organizations_disable_2fa_requirement_filter`
+search: |
+    `github_organizations` vendor_action="org.disable_two_factor_requirement" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by vendor_action user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_organizations_disable_2fa_requirement_filter`
 how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/ .
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_organizations_disable_classic_branch_protection_rule.yml b/detections/cloud/github_organizations_disable_classic_branch_protection_rule.yml
index 42c50fdfe56..3205549b788 100644
--- a/detections/cloud/github_organizations_disable_classic_branch_protection_rule.yml
+++ b/detections/cloud/github_organizations_disable_classic_branch_protection_rule.yml
@@ -9,19 +9,8 @@ type: Anomaly
 description: The following analytic detects when classic branch protection rules are disabled in GitHub Organizations. The detection monitors GitHub Organizations audit logs for branch protection removal events by tracking actor details, repository information, and associated metadata. For a SOC, identifying disabled branch protection is critical as it could indicate attempts to bypass code review requirements and security controls. Branch protection rules are essential security controls that enforce code review, prevent force pushes, and maintain code quality. Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting to inject malicious code.
 data_source:
     - GitHub Organizations Audit Logs
-search: |-
-    `github_organizations` vendor_action=protected_branch.destroy
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_ip,
-           actor_is_bot, actor_location.country_code, business,
-           business_id, org, org_id,
-           repo, repo_id, user_agent,
-           vendor_action, name
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_organizations_disable_classic_branch_protection_rule_filter`
+search: |
+    `github_organizations` vendor_action="protected_branch.destroy" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by vendor_action user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_organizations_disable_classic_branch_protection_rule_filter`
 how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/ .
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -35,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_organizations_disable_dependabot.yml b/detections/cloud/github_organizations_disable_dependabot.yml
index 4a380dd512d..bddb1c099f5 100644
--- a/detections/cloud/github_organizations_disable_dependabot.yml
+++ b/detections/cloud/github_organizations_disable_dependabot.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects when a user disables Dependabot security features within a GitHub repository. Dependabot helps automatically identify and fix security vulnerabilities in dependencies. The detection monitors GitHub Enterprise logs for configuration changes that disable Dependabot functionality. This behavior could indicate an attacker attempting to prevent the automatic detection of vulnerable dependencies, which would allow them to exploit known vulnerabilities that would otherwise be patched. For a SOC, identifying the disabling of security features like Dependabot is critical as it may be a precursor to supply chain attacks where attackers exploit vulnerable dependencies. The impact could be severe if vulnerabilities remain unpatched, potentially leading to code execution, data theft, or other compromises through the software supply chain.
 data_source:
     - GitHub Organizations Audit Logs
-search: |-
-    `github_organizations` vendor_action=repository_vulnerability_alerts.disable
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_ip,
-           actor_is_bot, actor_location.country_code, business,
-           business_id, org, org_id,
-           repo, repo_id, user,
-           user_agent, user_id, vendor_action
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_organizations_disable_dependabot_filter`
+search: |
+    `github_organizations` vendor_action="repository_vulnerability_alerts.disable" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by vendor_action user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_organizations_disable_dependabot_filter`
 how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/ .
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_organizations_repository_archived.yml b/detections/cloud/github_organizations_repository_archived.yml
index a13714ad1ea..4ba14038312 100644
--- a/detections/cloud/github_organizations_repository_archived.yml
+++ b/detections/cloud/github_organizations_repository_archived.yml
@@ -9,19 +9,8 @@ type: Anomaly
 description: The following analytic detects when a repository is archived in GitHub Organizations. The detection monitors GitHub Organizations audit logs for repository archival events by tracking actor details, repository information, and associated metadata. For a SOC, identifying repository archival is important as it could indicate attempts to make critical code inaccessible or preparation for repository deletion. While archiving is a legitimate feature, unauthorized archival of active repositories could signal account compromise, insider threats, or attempts to disrupt development operations. The impact of unauthorized repository archival includes loss of active development access, disruption to workflows and CI/CD pipelines, and potential business delays if critical repositories are affected. Additionally, archived repositories may be targeted for subsequent deletion, potentially resulting in permanent loss of intellectual property if proper backups are not maintained.
 data_source:
     - GitHub Organizations Audit Logs
-search: |-
-    `github_organizations` vendor_action=repo.archived
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_is_bot,
-           actor_location.country_code, business, business_id,
-           org, org_id, repo,
-           repo_id, user_agent, visibility,
-           vendor_action
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_organizations_repository_archived_filter`
+search: |
+    `github_organizations` vendor_action="repo.archived" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by vendor_action user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_organizations_repository_archived_filter`
 how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/ .
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -35,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/github_organizations_repository_deleted.yml b/detections/cloud/github_organizations_repository_deleted.yml
index c6480fd3d66..4192457c1a0 100644
--- a/detections/cloud/github_organizations_repository_deleted.yml
+++ b/detections/cloud/github_organizations_repository_deleted.yml
@@ -9,19 +9,8 @@ type: Anomaly
 description: The following analytic identifies when a repository is deleted within a GitHub organization. The detection monitors GitHub Organizations audit logs for repository deletion events by tracking actor details, repository information, and associated metadata. This behavior is concerning for SOC teams as malicious actors may attempt to delete repositories to destroy source code, intellectual property, or evidence of compromise. Repository deletion can result in permanent loss of code, documentation, and project history if proper backups are not maintained. Additionally, unauthorized repository deletion could indicate account compromise, insider threats, or attempts to disrupt business operations. The impact of a repository deletion attack includes loss of intellectual property, disruption to development workflows, and potential financial losses from lost work. Early detection of unauthorized repository deletions allows security teams to investigate potential compromises and restore from backups if needed.
 data_source:
     - GitHub Organizations Audit Logs
-search: |-
-    `github_organizations` vendor_action=repo.destroy
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY actor, actor_id, actor_is_bot,
-           actor_location.country_code, business, business_id,
-           org, org_id, repo,
-           repo_id, user_agent, visibility,
-           vendor_action
-      | eval user=actor
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `github_organizations_repository_deleted_filter`
+search: |
+    `github_organizations` vendor_action="repo.destroy" | eval user=actor, repo=repo | stats count min(_time) as firstTime max(_time) as lastTime by vendor_action user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_organizations_repository_deleted_filter`
 how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/ .
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -35,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml
index d7a5239ebe0..e08603694d5 100644
--- a/detections/cloud/gsuite_drive_share_in_external_email.yml
+++ b/detections/cloud/gsuite_drive_share_in_external_email.yml
@@ -40,7 +40,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dst_email_list
@@ -70,5 +70,5 @@ tests:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567.002/gsuite_share_drive/gdrive_share_external.log
           source: http:gsuite
           sourcetype: gws:reports:drive
-      test_type: experimental
       description: This test is a legacy experimental test and may not be accurate.
+      test_type: experimental
diff --git a/detections/cloud/gsuite_email_suspicious_attachment.yml b/detections/cloud/gsuite_email_suspicious_attachment.yml
index 5c111aefdf1..20f41d00d45 100644
--- a/detections/cloud/gsuite_email_suspicious_attachment.yml
+++ b/detections/cloud/gsuite_email_suspicious_attachment.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects suspicious attachment file extensions in GSuite emails, potentially indicating a spear-phishing attack. It leverages GSuite Gmail logs to identify emails with attachments having file extensions commonly associated with malware, such as .exe, .bat, and .js. This activity is significant as these file types are often used to deliver malicious payloads, posing a risk of compromising targeted machines. If confirmed malicious, this could lead to unauthorized code execution, data breaches, or further network infiltration.
 data_source:
     - G Suite Gmail
-search: |-
+search: |
     `gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh", "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go")
       | eval phase="plan"
       | eval severity="medium"
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$destination{}.address$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$destination{}.address$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: destination{}.address
diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
index 8f8a9438c39..38bf3bba862 100644
--- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
+++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies Gsuite emails with suspicious subjects and attachments commonly used in spear phishing attacks. It leverages Gsuite email logs, focusing on specific keywords in the subject line and known malicious file types in attachments. This activity is significant for a SOC as spear phishing is a prevalent method for initial compromise, often leading to further malicious actions. If confirmed malicious, this activity could result in unauthorized access, data exfiltration, or further malware deployment, posing a significant risk to the organization's security.
 data_source:
     - G Suite Gmail
-search: |-
+search: |
     `gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "* fedex *", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta")
       | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"
       | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$destination{}.address$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$destination{}.address$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: destination{}.address
diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
index 7abdbb271ec..7a870e4d6b8 100644
--- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
+++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects emails in Gsuite containing links to known abuse web services such as Pastebin, Telegram, and Discord. It leverages Gsuite Gmail logs to identify emails with these specific domains in their links. This activity is significant because these services are commonly used by attackers to deliver malicious payloads. If confirmed malicious, this could lead to the delivery of malware, phishing attacks, or other harmful activities, potentially compromising sensitive information or systems within the organization.
 data_source:
     - G Suite Gmail
-search: |-
+search: |
     `gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me")
       | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"
       | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$destination{}.address$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$destination{}.address$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: destination{}.address
diff --git a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml
index 430bc10871a..d868701dcaf 100644
--- a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml
+++ b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic detects outbound emails with attachments sent from an internal email domain to an external domain. It leverages Gsuite Gmail logs, parsing the source and destination email domains, and flags emails with fewer than 20 outbound instances. This activity is significant as it may indicate potential data exfiltration or insider threats. If confirmed malicious, an attacker could use this method to exfiltrate sensitive information, leading to data breaches and compliance violations.
 data_source:
     - G Suite Gmail
-search: |-
+search: |
     `gsuite_gmail` num_message_attachments > 0
       | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"
       | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"
diff --git a/detections/cloud/gsuite_suspicious_calendar_invite.yml b/detections/cloud/gsuite_suspicious_calendar_invite.yml
index 0ae86c5ee48..27ac7b684ba 100644
--- a/detections/cloud/gsuite_suspicious_calendar_invite.yml
+++ b/detections/cloud/gsuite_suspicious_calendar_invite.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Hunting
 description: The following analytic detects suspicious calendar invites sent via GSuite, potentially indicating compromised accounts or malicious internal activity. It leverages GSuite calendar logs, focusing on events where a high volume of invites (over 100) is sent within a 5-minute window. This behavior is significant as it may involve the distribution of malicious links or attachments, posing a security risk. If confirmed malicious, this activity could lead to widespread phishing attacks, unauthorized access, or malware distribution within the organization.
 data_source: []
-search: |-
+search: |
     `gsuite_calendar`
       | bin span=5m _time
       | rename parameters.* as *
diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml
index cc1a771a57a..d83442f1bc6 100644
--- a/detections/cloud/gsuite_suspicious_shared_file_name.yml
+++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects shared files in Google Drive with suspicious filenames commonly used in spear phishing campaigns. It leverages GSuite Drive logs to identify documents with titles that include keywords like "dhl," "ups," "invoice," and "shipment." This activity is significant because such filenames are often used to lure users into opening malicious documents or clicking harmful links. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further compromise of the user's system.
 data_source:
     - G Suite Drive
-search: |-
+search: |
     `gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation")
       | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)"
       | rex field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)"
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$email$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$email$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: email
@@ -65,5 +65,5 @@ tests:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log
           source: http:gsuite
           sourcetype: gws:reports:drive
-      test_type: experimental
       description: This test is a legacy experimental test and may not be accurate.
+      test_type: experimental
diff --git a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml b/detections/cloud/high_number_of_login_failures_from_a_single_source.yml
index 8e9b43c4710..fa4d0585da5 100644
--- a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml
+++ b/detections/cloud/high_number_of_login_failures_from_a_single_source.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects multiple failed login attempts in Office365 Azure Active Directory from a single source IP address. It leverages Office365 management activity logs, specifically AzureActiveDirectoryStsLogon records, aggregating these logs in 5-minute intervals to count failed login attempts. This activity is significant as it may indicate brute-force attacks or password spraying, which are critical to monitor. If confirmed malicious, an attacker could gain unauthorized access to Office365 accounts, leading to potential data breaches, lateral movement within the organization, or further malicious activities using the compromised account.
 data_source:
     - O365 UserLoginFailed
-search: |-
+search: |
     `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon
       | bucket span=5m _time
       | stats dc(_raw) AS failed_attempts values(user) as user values(LogonError) as LogonError values(signature) as signature values(UserAgent) as UserAgent values(dest) as dest values(vendor_account) as vendor_account values(vendor_product) as vendor_product
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_location.yml b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_location.yml
index dc86d7c9797..9d1805a1519 100644
--- a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_location.yml
+++ b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_location.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects unauthorized access or misuse of Kubernetes Secrets from unusual locations. It leverages Kubernetes Audit logs to identify anomalies in access patterns by analyzing the source of requests by country. This activity is significant for a SOC as Kubernetes Secrets store sensitive information like passwords, OAuth tokens, and SSH keys, making them critical assets. If confirmed malicious, this behavior could indicate an attacker attempting to exfiltrate or misuse these secrets, potentially leading to unauthorized access to sensitive systems or data.
 data_source:
     - Kubernetes Audit
-search: |-
+search: |
     `kube_audit` objectRef.resource=secrets verb=get
       | iplocation sourceIPs{}
       | fillnull
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -59,6 +59,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.007/kube_audit_get_secret/kube_audit_get_secret.json
-          sourcetype: _json
           source: kubernetes
+          sourcetype: _json
       test_type: unit
diff --git a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_agent.yml b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_agent.yml
index 370f0fdaed2..ae6a92f33ef 100644
--- a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_agent.yml
+++ b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_agent.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects unauthorized access or misuse of Kubernetes Secrets by unusual user agents. It leverages Kubernetes Audit logs to identify anomalies in access patterns by analyzing the source of requests based on user agents. This activity is significant for a SOC because Kubernetes Secrets store sensitive information like passwords, OAuth tokens, and SSH keys, making them critical assets. If confirmed malicious, this activity could lead to unauthorized access to sensitive systems or data, potentially resulting in significant security breaches and exfiltration of critical information.
 data_source:
     - Kubernetes Audit
-search: |-
-    `kube_audit` objectRef.resource=secrets verb=get
-      | search NOT `kube_allowed_user_agents`
-      | fillnull
-      | stats count
-        BY objectRef.name objectRef.namespace objectRef.resource
-           requestReceivedTimestamp requestURI responseStatus.code
-           sourceIPs{} stage user.groups{}
-           user.uid user.username userAgent
-           verb
-      | rename sourceIPs{} as src_ip, user.username as user
-      | `kubernetes_abuse_of_secret_by_unusual_user_agent_filter`
+search: |
+    `kube_audit` objectRef.resource="secrets" verb="get" NOT userAgent="Helm/3.13.2" | eval 'objectRef.name'='objectRef.name', user=User, src_ip='sourceIPs{}' | stats count min(_time) as firstTime max(_time) as lastTime by resource verb userAgent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_abuse_of_secret_by_unusual_user_agent_filter`
 how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -58,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.007/kube_audit_get_secret/kube_audit_get_secret.json
-          sourcetype: _json
           source: kubernetes
+          sourcetype: _json
       test_type: unit
diff --git a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_group.yml b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_group.yml
index 86f62b75e97..1599bf510ed 100644
--- a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_group.yml
+++ b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_group.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects unauthorized access or misuse of Kubernetes Secrets by unusual user groups. It leverages Kubernetes Audit logs to identify anomalies in access patterns by analyzing the source of requests and user groups. This activity is significant for a SOC as Kubernetes Secrets store sensitive information like passwords, OAuth tokens, and SSH keys. If confirmed malicious, this behavior could indicate an attacker attempting to exfiltrate or misuse these secrets, potentially leading to unauthorized access to sensitive systems or data.
 data_source:
     - Kubernetes Audit
-search: |-
+search: |
     `kube_audit` objectRef.resource=secrets verb=get
       | search NOT `kube_allowed_user_groups`
       | fillnull
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -58,6 +58,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.007/kube_audit_get_secret/kube_audit_get_secret.json
-          sourcetype: _json
           source: kubernetes
+          sourcetype: _json
       test_type: unit
diff --git a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_name.yml b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_name.yml
index 9171eb30f32..b29abab5dab 100644
--- a/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_name.yml
+++ b/detections/cloud/kubernetes_abuse_of_secret_by_unusual_user_name.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects unauthorized access or misuse of Kubernetes Secrets by unusual user names. It leverages Kubernetes Audit logs to identify anomalies in access patterns by analyzing the source of requests based on user names. This activity is significant for a SOC as Kubernetes Secrets store sensitive information like passwords, OAuth tokens, and SSH keys, making them critical assets. If confirmed malicious, this activity could lead to unauthorized access to sensitive systems or data, potentially resulting in significant security breaches and exfiltration of sensitive information.
 data_source:
     - Kubernetes Audit
-search: |-
-    `kube_audit` objectRef.resource=secrets verb=get
-      | search NOT `kube_allowed_user_names`
-      | fillnull
-      | stats count
-        BY objectRef.name objectRef.namespace objectRef.resource
-           requestReceivedTimestamp requestURI responseStatus.code
-           sourceIPs{} stage user.groups{}
-           user.uid user.username userAgent
-           verb
-      | rename sourceIPs{} as src_ip, user.username as user
-      | `kubernetes_abuse_of_secret_by_unusual_user_name_filter`
+search: |
+    `kube_audit` objectRef.resource="secrets" verb="get" NOT user.username="admin" | eval 'objectRef.name'='objectRef.name', user=User, src_ip='sourceIPs{}' | stats count min(_time) as firstTime max(_time) as lastTime by resource verb username | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_abuse_of_secret_by_unusual_user_name_filter`
 how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -58,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.007/kube_audit_get_secret/kube_audit_get_secret.json
-          sourcetype: _json
           source: kubernetes
+          sourcetype: _json
       test_type: unit
diff --git a/detections/cloud/kubernetes_access_scanning.yml b/detections/cloud/kubernetes_access_scanning.yml
index ef43bdd6bfd..833ad0f0b7f 100644
--- a/detections/cloud/kubernetes_access_scanning.yml
+++ b/detections/cloud/kubernetes_access_scanning.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects potential scanning activities within a Kubernetes environment. It identifies unauthorized access attempts, probing of public APIs, or attempts to exploit known vulnerabilities by monitoring Kubernetes audit logs for repeated failed access attempts or unusual API requests. This activity is significant for a SOC as it may indicate an attacker's preliminary reconnaissance to gather information about the system. If confirmed malicious, this activity could lead to unauthorized access to sensitive systems or data, posing a severe security risk.
 data_source:
     - Kubernetes Audit
-search: |-
+search: |
     `kube_audit` "user.groups{}"="system:unauthenticated" "responseStatus.code"=403
       | iplocation sourceIPs{}
       | stats count values(userAgent) as userAgent values(user.username) as user.username values(user.groups{}) as user.groups{} values(verb) as verb values(requestURI) as requestURI values(responseStatus.code) as responseStatus.code values(responseStatus.message) as responseStatus.message values(responseStatus.reason) as responseStatus.reason values(responseStatus.status) as responseStatus.status
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -54,6 +54,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/kubernetes_scanning/kubernetes_scanning.json
-          sourcetype: _json
           source: kubernetes
+          sourcetype: _json
       test_type: unit
diff --git a/detections/cloud/kubernetes_anomalous_inbound_network_activity_from_process.yml b/detections/cloud/kubernetes_anomalous_inbound_network_activity_from_process.yml
index b22917e7fc3..e10e378ac3e 100644
--- a/detections/cloud/kubernetes_anomalous_inbound_network_activity_from_process.yml
+++ b/detections/cloud/kubernetes_anomalous_inbound_network_activity_from_process.yml
@@ -8,7 +8,8 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies anomalous inbound network traffic volumes from processes within containerized workloads. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. The detection compares recent metrics (tcp.bytes, tcp.new_sockets, tcp.packets, udp.bytes, udp.packets) over the last hour with the average over the past 30 days. This activity is significant as it may indicate unauthorized data reception, potential breaches, vulnerability exploitation, or malware propagation. If confirmed malicious, it could lead to command and control installation, data integrity damage, container escape, and further environment compromise.
 data_source: []
-search: "| mstats avg(tcp.*) as tcp.* avg(udp.*) as udp.* where `kubernetes_metrics` AND earliest=-1h by k8s.cluster.name dest.workload.name dest.process.name  span=10s | eval key='dest.workload.name' + \":\" + 'dest.process.name' | join type=left key [ mstats avg(tcp.*) as avg_tcp.* avg(udp.*) as avg_udp.* stdev(tcp.*) as stdev_tcp.* avg(udp.*) as stdev_udp.* where `kubernetes_metrics` AND earliest=-30d latest=-1h by dest.workload.name dest.process.name | eval key='dest.workload.name' + \":\" + 'dest.process.name' ] | eval anomalies = \"\" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 3 * 'stdev_<<MATCHSTR>>'), anomalies + \"<<MATCHSTR>> higher than average by \" + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + \" Standard Deviations. <<MATCHSTR>>=\" + tostring('<<MATCHSTR>>') + \" avg_<<MATCHSTR>>=\" + tostring('avg_<<MATCHSTR>>') + \" 'stdev_<<MATCHSTR>>'=\" + tostring('stdev_<<MATCHSTR>>') + \", \" , anomalies) ] | fillnull | eval anomalies = split(replace(anomalies, \",\\s$$$$\", \"\") ,\", \") | where anomalies!=\"\" | stats count(anomalies) as count values(anomalies) as anomalies by k8s.cluster.name dest.workload.name dest.process.name | where count > 5 | rename k8s.cluster.name as host | `kubernetes_anomalous_inbound_network_activity_from_process_filter`"
+search: |
+    | mstats avg(tcp.*) as tcp.* avg(udp.*) as udp.* where `kubernetes_metrics` AND earliest=-1h by k8s.cluster.name dest.workload.name dest.process.name  span=10s | eval key='dest.workload.name' + ":" + 'dest.process.name' | join type=left key [ mstats avg(tcp.*) as avg_tcp.* avg(udp.*) as avg_udp.* stdev(tcp.*) as stdev_tcp.* avg(udp.*) as stdev_udp.* where `kubernetes_metrics` AND earliest=-30d latest=-1h by dest.workload.name dest.process.name | eval key='dest.workload.name' + ":" + 'dest.process.name' ] | eval anomalies = "" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 3 * 'stdev_<<MATCHSTR>>'), anomalies + "<<MATCHSTR>> higher than average by " + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + " Standard Deviations. <<MATCHSTR>>=" + tostring('<<MATCHSTR>>') + " avg_<<MATCHSTR>>=" + tostring('avg_<<MATCHSTR>>') + " 'stdev_<<MATCHSTR>>'=" + tostring('stdev_<<MATCHSTR>>') + ", " , anomalies) ] | fillnull | eval anomalies = split(replace(anomalies, ",\s$$$$", "") ,", ") | where anomalies!="" | stats count(anomalies) as count values(anomalies) as anomalies by k8s.cluster.name dest.workload.name dest.process.name | where count > 5 | rename k8s.cluster.name as host | `kubernetes_anomalous_inbound_network_activity_from_process_filter`
 how_to_implement: "To gather NPM metrics the Open Telemetry to the Kubernetes Cluster and enable Network Performance Monitoring according to instructions found in Splunk Docs https://help.splunk.com/en/splunk-observability-cloud/monitor-infrastructure/network-explorer/set-up-network-explorer-in-kubernetes#network-explorer-setup In order to access those metrics from within Splunk Enterprise and ES, the Splunk Infrastructure Monitoring add-on must be installed and configured on a Splunk Search Head.  Once installed, first configure the add-on with your O11y Cloud Org ID and Access Token. Lastly set up the add-on to ingest metrics from O11y cloud using the following settings, and any other settings left at default:\n* Name sim_npm_metrics_to_metrics_index\n * Metric Resolution 10000"
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/cloud/kubernetes_anomalous_inbound_outbound_network_io.yml b/detections/cloud/kubernetes_anomalous_inbound_outbound_network_io.yml
index 5ae99ed1e25..6a784791404 100644
--- a/detections/cloud/kubernetes_anomalous_inbound_outbound_network_io.yml
+++ b/detections/cloud/kubernetes_anomalous_inbound_outbound_network_io.yml
@@ -8,7 +8,8 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies high inbound or outbound network I/O anomalies in Kubernetes containers. It leverages process metrics from an OTEL collector and Kubelet Stats Receiver, along with data from Splunk Observability Cloud. A lookup table with average and standard deviation values for network I/O is used to detect anomalies persisting over a 1-hour period. This activity is significant as it may indicate data exfiltration, command and control communication, or unauthorized data transfers. If confirmed malicious, it could lead to data breaches, service outages, financial losses, and reputational damage.
 data_source: []
-search: "| mstats avg(k8s.pod.network.io) as io where `kubernetes_metrics` by k8s.cluster.name k8s.pod.name k8s.node.name direction span=10s | eval service = replace('k8s.pod.name', \"-\\w{5}$$|-[abcdef0-9]{8,10}-\\w{5}$$\", \"\") | stats avg(eval(if(direction=\"transmit\", io,null()))) as outbound_network_io avg(eval(if(direction=\"receive\", io,null()))) as inbound_network_io by k8s.cluster.name k8s.node.name k8s.pod.name service _time | eval key = 'k8s.cluster.name' + \":\" + 'service' | lookup k8s_container_network_io_baseline key | eval anomalies = \"\" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 4 * 'stdev_<<MATCHSTR>>'), anomalies + \"<<MATCHSTR>> higher than average by \" + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + \" Standard Deviations. <<MATCHSTR>>=\" + tostring('<<MATCHSTR>>') + \" avg_<<MATCHSTR>>=\" + tostring('avg_<<MATCHSTR>>') + \" 'stdev_<<MATCHSTR>>'=\" + tostring('stdev_<<MATCHSTR>>') + \", \" , anomalies) ] | eval anomalies = replace(anomalies, \",\\s$$\", \"\") | where anomalies!=\"\" | stats count values(anomalies) as anomalies by k8s.cluster.name k8s.node.name k8s.pod.name service | rename service as k8s.service | where count > 5 | rename k8s.node.name as host | `kubernetes_anomalous_inbound_outbound_network_io_filter`"
+search: |
+    | mstats avg(k8s.pod.network.io) as io where `kubernetes_metrics` by k8s.cluster.name k8s.pod.name k8s.node.name direction span=10s | eval service = replace('k8s.pod.name', "-\w{5}$$|-[abcdef0-9]{8,10}-\w{5}$$", "") | stats avg(eval(if(direction="transmit", io,null()))) as outbound_network_io avg(eval(if(direction="receive", io,null()))) as inbound_network_io by k8s.cluster.name k8s.node.name k8s.pod.name service _time | eval key = 'k8s.cluster.name' + ":" + 'service' | lookup k8s_container_network_io_baseline key | eval anomalies = "" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 4 * 'stdev_<<MATCHSTR>>'), anomalies + "<<MATCHSTR>> higher than average by " + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + " Standard Deviations. <<MATCHSTR>>=" + tostring('<<MATCHSTR>>') + " avg_<<MATCHSTR>>=" + tostring('avg_<<MATCHSTR>>') + " 'stdev_<<MATCHSTR>>'=" + tostring('stdev_<<MATCHSTR>>') + ", " , anomalies) ] | eval anomalies = replace(anomalies, ",\s$$", "") | where anomalies!="" | stats count values(anomalies) as anomalies by k8s.cluster.name k8s.node.name k8s.pod.name service | rename service as k8s.service | where count > 5 | rename k8s.node.name as host | `kubernetes_anomalous_inbound_outbound_network_io_filter`
 how_to_implement: "To implement this detection, follow these steps:\n* Deploy the OpenTelemetry Collector (OTEL) to your Kubernetes cluster.\n* Enable the hostmetrics/process receiver in the OTEL configuration.\n* Ensure that the process metrics, specifically Process.cpu.utilization and process.memory.utilization, are enabled.\n* Install the Splunk Infrastructure Monitoring (SIM) add-on. (ref: https://splunkbase.splunk.com/app/5247)\n * Configure the SIM add-on with your Observability Cloud Organization ID and Access Token.\n* Set up the SIM modular input to ingest Process Metrics. Name this input \"sim_process_metrics_to_metrics_index\".\n* In the SIM configuration, set the Organization ID to your Observability Cloud Organization ID.\n* Set the Signal Flow Program to the following: data('process.threads').publish(label='A'); data('process.cpu.utilization').publish(label='B'); data('process.cpu.time').publish(label='C'); data('process.disk.io').publish(label='D'); data('process.memory.usage').publish(label='E'); data('process.memory.virtual').publish(label='F'); data('process.memory.utilization').publish(label='G'); data('process.cpu.utilization').publish(label='H'); data('process.disk.operations').publish(label='I'); data('process.handles').publish(label='J'); data('process.threads').publish(label='K')\n* Set the Metric Resolution to 10000.\n * Leave all other settings at their default values.\n* Run the Search Baseline Of Kubernetes Container Network IO Ratio"
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/cloud/kubernetes_anomalous_inbound_to_outbound_network_io_ratio.yml b/detections/cloud/kubernetes_anomalous_inbound_to_outbound_network_io_ratio.yml
index 7f58b83c959..a8f40f0feb2 100644
--- a/detections/cloud/kubernetes_anomalous_inbound_to_outbound_network_io_ratio.yml
+++ b/detections/cloud/kubernetes_anomalous_inbound_to_outbound_network_io_ratio.yml
@@ -8,7 +8,8 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies significant changes in network communication behavior within Kubernetes containers by examining the inbound to outbound network IO ratios. It leverages process metrics from an OTEL collector and Kubelet Stats Receiver, along with data from Splunk Observability Cloud. Anomalies are detected using a lookup table containing average and standard deviation values for network IO, triggering an event if the anomaly persists for over an hour. This activity is significant as it may indicate data exfiltration, command and control communication, or compromised container behavior. If confirmed malicious, it could lead to data breaches, service outages, and unauthorized access within the Kubernetes cluster.
 data_source: []
-search: "| mstats avg(k8s.pod.network.io) as io where `kubernetes_metrics` by k8s.cluster.name k8s.pod.name k8s.node.name direction span=10s | eval service = replace('k8s.pod.name', \"-\\w{5}$|-[abcdef0-9]{8,10}-\\w{5}$\", \"\") | eval key = 'k8s.cluster.name' + \":\" + 'service' | stats avg(eval(if(direction=\"transmit\", io,null()))) as outbound_network_io avg(eval(if(direction=\"receive\", io,null()))) as inbound_network_io by key service k8s.cluster.name k8s.pod.name k8s.node.name _time | eval inbound:outbound = inbound_network_io/outbound_network_io | eval outbound:inbound = outbound_network_io/inbound_network_io | fields - *network_io | lookup k8s_container_network_io_ratio_baseline key | eval anomalies = \"\" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 4 * 'stdev_<<MATCHSTR>>'), anomalies + \"<<MATCHSTR>> ratio higher than average by \" + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + \" Standard Deviations. <<MATCHSTR>>=\" + tostring('<<MATCHSTR>>') + \" avg_<<MATCHSTR>>=\" + tostring('avg_<<MATCHSTR>>') + \" 'stdev_<<MATCHSTR>>'=\" + tostring('stdev_<<MATCHSTR>>') + \", \" , anomalies) ] | eval anomalies = replace(anomalies, \",\\s$\", \"\") | where anomalies!=\"\" | stats count values(anomalies) as anomalies by k8s.cluster.name k8s.node.name k8s.pod.name service | rename service as k8s.service | where count > 5 | rename k8s.node.name as host | `kubernetes_anomalous_inbound_to_outbound_network_io_ratio_filter`"
+search: |
+    | mstats avg(k8s.pod.network.io) as io where `kubernetes_metrics` by k8s.cluster.name k8s.pod.name k8s.node.name direction span=10s | eval service = replace('k8s.pod.name', "-\w{5}$|-[abcdef0-9]{8,10}-\w{5}$", "") | eval key = 'k8s.cluster.name' + ":" + 'service' | stats avg(eval(if(direction="transmit", io,null()))) as outbound_network_io avg(eval(if(direction="receive", io,null()))) as inbound_network_io by key service k8s.cluster.name k8s.pod.name k8s.node.name _time | eval inbound:outbound = inbound_network_io/outbound_network_io | eval outbound:inbound = outbound_network_io/inbound_network_io | fields - *network_io | lookup k8s_container_network_io_ratio_baseline key | eval anomalies = "" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 4 * 'stdev_<<MATCHSTR>>'), anomalies + "<<MATCHSTR>> ratio higher than average by " + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + " Standard Deviations. <<MATCHSTR>>=" + tostring('<<MATCHSTR>>') + " avg_<<MATCHSTR>>=" + tostring('avg_<<MATCHSTR>>') + " 'stdev_<<MATCHSTR>>'=" + tostring('stdev_<<MATCHSTR>>') + ", " , anomalies) ] | eval anomalies = replace(anomalies, ",\s$", "") | where anomalies!="" | stats count values(anomalies) as anomalies by k8s.cluster.name k8s.node.name k8s.pod.name service | rename service as k8s.service | where count > 5 | rename k8s.node.name as host | `kubernetes_anomalous_inbound_to_outbound_network_io_ratio_filter`
 how_to_implement: "To implement this detection, follow these steps:\n* Deploy the OpenTelemetry Collector (OTEL) to your Kubernetes cluster.\n* Enable the hostmetrics/process receiver in the OTEL configuration.\n* Ensure that the process metrics, specifically Process.cpu.utilization and process.memory.utilization, are enabled.\n* Install the Splunk Infrastructure Monitoring (SIM) add-on. (ref: https://splunkbase.splunk.com/app/5247)\n * Configure the SIM add-on with your Observability Cloud Organization ID and Access Token.\n* Set up the SIM modular input to ingest Process Metrics. Name this input \"sim_process_metrics_to_metrics_index\".\n* In the SIM configuration, set the Organization ID to your Observability Cloud Organization ID.\n* Set the Signal Flow Program to the following: data('process.threads').publish(label='A'); data('process.cpu.utilization').publish(label='B'); data('process.cpu.time').publish(label='C'); data('process.disk.io').publish(label='D'); data('process.memory.usage').publish(label='E'); data('process.memory.virtual').publish(label='F'); data('process.memory.utilization').publish(label='G'); data('process.cpu.utilization').publish(label='H'); data('process.disk.operations').publish(label='I'); data('process.handles').publish(label='J'); data('process.threads').publish(label='K')\n* Set the Metric Resolution to 10000.\n * Leave all other settings at their default values.\n* Run the Search Baseline Of Kubernetes Container Network IO Ratio"
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/cloud/kubernetes_anomalous_outbound_network_activity_from_process.yml b/detections/cloud/kubernetes_anomalous_outbound_network_activity_from_process.yml
index fce2efe64c3..057b33300f8 100644
--- a/detections/cloud/kubernetes_anomalous_outbound_network_activity_from_process.yml
+++ b/detections/cloud/kubernetes_anomalous_outbound_network_activity_from_process.yml
@@ -8,7 +8,8 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies anomalously high outbound network activity from processes running within containerized workloads in a Kubernetes environment. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. The detection compares recent network metrics (tcp.bytes, tcp.new_sockets, tcp.packets, udp.bytes, udp.packets) over the last hour with the average metrics over the past 30 days. This activity is significant as it may indicate data exfiltration, process modification, or container compromise. If confirmed malicious, it could lead to unauthorized data exfiltration, communication with malicious entities, or further attacks within the containerized environment.
 data_source: []
-search: "| mstats avg(tcp.*) as tcp.* avg(udp.*) as udp.* where `kubernetes_metrics` AND earliest=-1h by k8s.cluster.name source.workload.name source.process.name  span=10s | eval key='source.workload.name' + \":\" + 'source.process.name' | join type=left key [ mstats avg(tcp.*) as avg_tcp.* avg(udp.*) as avg_udp.* stdev(tcp.*) as stdev_tcp.* avg(udp.*) as stdev_udp.* where `kubernetes_metrics` AND earliest=-30d latest=-1h by source.workload.name source.process.name | eval key='source.workload.name' + \":\" + 'source.process.name' ] | eval anomalies = \"\" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 3 * 'stdev_<<MATCHSTR>>'), anomalies + \"<<MATCHSTR>> higher than average by \" + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + \" Standard Deviations. <<MATCHSTR>>=\" + tostring('<<MATCHSTR>>') + \" avg_<<MATCHSTR>>=\" + tostring('avg_<<MATCHSTR>>') + \" 'stdev_<<MATCHSTR>>'=\" + tostring('stdev_<<MATCHSTR>>') + \", \" , anomalies) ] | fillnull | eval anomalies = split(replace(anomalies, \",\\s$$$$\", \"\") ,\", \") | where anomalies!=\"\" | stats count(anomalies) as count values(anomalies) as anomalies by k8s.cluster.name source.workload.name source.process.name | where count > 5 | rename k8s.cluster.name as host | `kubernetes_anomalous_outbound_network_activity_from_process_filter`"
+search: |
+    | mstats avg(tcp.*) as tcp.* avg(udp.*) as udp.* where `kubernetes_metrics` AND earliest=-1h by k8s.cluster.name source.workload.name source.process.name  span=10s | eval key='source.workload.name' + ":" + 'source.process.name' | join type=left key [ mstats avg(tcp.*) as avg_tcp.* avg(udp.*) as avg_udp.* stdev(tcp.*) as stdev_tcp.* avg(udp.*) as stdev_udp.* where `kubernetes_metrics` AND earliest=-30d latest=-1h by source.workload.name source.process.name | eval key='source.workload.name' + ":" + 'source.process.name' ] | eval anomalies = "" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 3 * 'stdev_<<MATCHSTR>>'), anomalies + "<<MATCHSTR>> higher than average by " + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + " Standard Deviations. <<MATCHSTR>>=" + tostring('<<MATCHSTR>>') + " avg_<<MATCHSTR>>=" + tostring('avg_<<MATCHSTR>>') + " 'stdev_<<MATCHSTR>>'=" + tostring('stdev_<<MATCHSTR>>') + ", " , anomalies) ] | fillnull | eval anomalies = split(replace(anomalies, ",\s$$$$", "") ,", ") | where anomalies!="" | stats count(anomalies) as count values(anomalies) as anomalies by k8s.cluster.name source.workload.name source.process.name | where count > 5 | rename k8s.cluster.name as host | `kubernetes_anomalous_outbound_network_activity_from_process_filter`
 how_to_implement: "To gather NPM metrics the Open Telemetry to the Kubernetes Cluster and enable Network Performance Monitoring according to instructions found in Splunk Docs https://help.splunk.com/en/splunk-observability-cloud/monitor-infrastructure/network-explorer/set-up-network-explorer-in-kubernetes#network-explorer-setup In order to access those metrics from within Splunk Enterprise and ES, the Splunk Infrastructure Monitoring add-on must be installed and configured on a Splunk Search Head.  Once installed, first configure the add-on with your O11y Cloud Org ID and Access Token. Lastly set up the add-on to ingest metrics from O11y cloud using the following settings, and any other settings left at default:\n* Name sim_npm_metrics_to_metrics_index\n * Metric Resolution 10000"
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/cloud/kubernetes_anomalous_traffic_on_network_edge.yml b/detections/cloud/kubernetes_anomalous_traffic_on_network_edge.yml
index 587dd7c55a5..6b3d372457c 100644
--- a/detections/cloud/kubernetes_anomalous_traffic_on_network_edge.yml
+++ b/detections/cloud/kubernetes_anomalous_traffic_on_network_edge.yml
@@ -8,7 +8,8 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies anomalous network traffic volumes between Kubernetes workloads or between a workload and external sources. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. The detection compares recent network metrics (tcp.bytes, tcp.new_sockets, tcp.packets, udp.bytes, udp.packets) over the last hour with the average over the past 30 days to identify significant deviations. This activity is significant as unexpected spikes may indicate unauthorized data transfers or lateral movement. If confirmed malicious, it could lead to data exfiltration or compromise of additional services, potentially resulting in data breaches.
 data_source: []
-search: "| mstats avg(tcp.*) as tcp.* avg(udp.*) as udp.* where `kubernetes_metrics` AND earliest=-1h by k8s.cluster.name source.workload.name dest.workload.name span=10s | eval key='source.workload.name' + \":\" + 'dest.workload.name' | join type=left key [ mstats avg(tcp.*) as avg_tcp.* avg(udp.*) as avg_udp.* stdev(tcp.*) as stdev_tcp.* avg(udp.*) as stdev_udp.* where `kubernetes_metrics` AND earliest=-30d latest=-1h by source.workload.name dest.workload.name | eval key='source.workload.name' + \":\" + 'dest.workload.name' ] | eval anomalies = \"\" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 3 * 'stdev_<<MATCHSTR>>'), anomalies + \"<<MATCHSTR>> higher than average by \" + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + \" Standard Deviations. <<MATCHSTR>>=\" + tostring('<<MATCHSTR>>') + \" avg_<<MATCHSTR>>=\" + tostring('avg_<<MATCHSTR>>') + \" 'stdev_<<MATCHSTR>>'=\" + tostring('stdev_<<MATCHSTR>>') + \", \" , anomalies) ] | fillnull | eval anomalies = split(replace(anomalies, \",\\s$$$$\", \"\") ,\", \") | where anomalies!=\"\" | stats count(anomalies) as count values(anomalies) as anomalies by k8s.cluster.name source.workload.name dest.workload.name | rename service as k8s.service | where count > 5 | rename k8s.cluster.name as host | `kubernetes_anomalous_traffic_on_network_edge_filter`"
+search: |
+    | mstats avg(tcp.*) as tcp.* avg(udp.*) as udp.* where `kubernetes_metrics` AND earliest=-1h by k8s.cluster.name source.workload.name dest.workload.name span=10s | eval key='source.workload.name' + ":" + 'dest.workload.name' | join type=left key [ mstats avg(tcp.*) as avg_tcp.* avg(udp.*) as avg_udp.* stdev(tcp.*) as stdev_tcp.* avg(udp.*) as stdev_udp.* where `kubernetes_metrics` AND earliest=-30d latest=-1h by source.workload.name dest.workload.name | eval key='source.workload.name' + ":" + 'dest.workload.name' ] | eval anomalies = "" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 3 * 'stdev_<<MATCHSTR>>'), anomalies + "<<MATCHSTR>> higher than average by " + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + " Standard Deviations. <<MATCHSTR>>=" + tostring('<<MATCHSTR>>') + " avg_<<MATCHSTR>>=" + tostring('avg_<<MATCHSTR>>') + " 'stdev_<<MATCHSTR>>'=" + tostring('stdev_<<MATCHSTR>>') + ", " , anomalies) ] | fillnull | eval anomalies = split(replace(anomalies, ",\s$$$$", "") ,", ") | where anomalies!="" | stats count(anomalies) as count values(anomalies) as anomalies by k8s.cluster.name source.workload.name dest.workload.name | rename service as k8s.service | where count > 5 | rename k8s.cluster.name as host | `kubernetes_anomalous_traffic_on_network_edge_filter`
 how_to_implement: "To gather NPM metrics the Open Telemetry to the Kubernetes Cluster and enable Network Performance Monitoring according to instructions found in Splunk Docs https://help.splunk.com/en/splunk-observability-cloud/monitor-infrastructure/network-explorer/set-up-network-explorer-in-kubernetes#network-explorer-setup In order to access those metrics from within Splunk Enterprise and ES, the Splunk Infrastructure Monitoring add-on must be installed and configured on a Splunk Search Head.  Once installed, first configure the add-on with your O11y Cloud Org ID and Access Token. Lastly set up the add-on to ingest metrics from O11y cloud using the following settings, and any other settings left at default:\n* Name sim_npm_metrics_to_metrics_index\n * Metric Resolution 10000"
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml b/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml
index cbee130342b..e0ee099e0df 100644
--- a/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml
+++ b/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects anonymous and unauthenticated requests to a Kubernetes cluster. It identifies this behavior by monitoring API calls from users who have not provided any token or password in their request, using data from `kube_audit` logs. This activity is significant for a SOC as it indicates a severe misconfiguration, allowing unfettered access to the cluster with no traceability. If confirmed malicious, an attacker could gain access to sensitive data or control over the cluster, posing a substantial security risk.
 data_source:
     - Kubernetes Audit
-search: |-
+search: |
     `kube_audit` user.username="system:anonymous" user.groups{} IN ("system:unauthenticated")
       | fillnull
       | stats count
diff --git a/detections/cloud/kubernetes_create_or_update_privileged_pod.yml b/detections/cloud/kubernetes_create_or_update_privileged_pod.yml
index c4fe3049848..337d4db21cf 100644
--- a/detections/cloud/kubernetes_create_or_update_privileged_pod.yml
+++ b/detections/cloud/kubernetes_create_or_update_privileged_pod.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the creation or update of privileged pods in Kubernetes. It identifies this activity by monitoring Kubernetes Audit logs for pod configurations that include root privileges. This behavior is significant for a SOC as it could indicate an attempt to escalate privileges, exploit the kernel, and gain full access to the host's namespace and devices. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, data breaches, and service disruptions, posing a severe threat to the environment.
 data_source:
     - Kubernetes Audit
-search: |-
+search: |
     `kube_audit` objectRef.resource=pods verb=create OR verb=update requestObject.metadata.annotations.kubectl.kubernetes.io/last-applied-configuration=*\"privileged\":true*
       | fillnull
       | stats count values(user.groups{}) as user_groups
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -56,6 +56,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/kubernetes_privileged_pod/kubernetes_privileged_pod.json
-          sourcetype: _json
           source: kubernetes
+          sourcetype: _json
       test_type: unit
diff --git a/detections/cloud/kubernetes_cron_job_creation.yml b/detections/cloud/kubernetes_cron_job_creation.yml
index b2a03ec3622..4cf86dcab37 100644
--- a/detections/cloud/kubernetes_cron_job_creation.yml
+++ b/detections/cloud/kubernetes_cron_job_creation.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the creation of a Kubernetes cron job, which is a task scheduled to run automatically at specified intervals. It identifies this activity by monitoring Kubernetes Audit logs for the creation events of cron jobs. This behavior is significant for a SOC as it could allow an attacker to execute malicious tasks repeatedly and automatically, posing a threat to the Kubernetes infrastructure. If confirmed malicious, this activity could lead to persistent attacks, service disruptions, or unauthorized access to sensitive information.
 data_source:
     - Kubernetes Audit
-search: |-
+search: |
     `kube_audit` verb=create "objectRef.resource"=cronjobs
       | fillnull
       | stats count values(user.groups{}) as user_groups
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -57,6 +57,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.007/kubernetes_audit_cron_job_creation/kubernetes_audit_cron_job_creation.json
-          sourcetype: _json
           source: kubernetes
+          sourcetype: _json
       test_type: unit
diff --git a/detections/cloud/kubernetes_daemonset_deployed.yml b/detections/cloud/kubernetes_daemonset_deployed.yml
index 38eac2de708..0310336926b 100644
--- a/detections/cloud/kubernetes_daemonset_deployed.yml
+++ b/detections/cloud/kubernetes_daemonset_deployed.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the creation of a DaemonSet in a Kubernetes cluster. This behavior is identified by monitoring Kubernetes Audit logs for the creation event of a DaemonSet. DaemonSets ensure a specific pod runs on every node, making them a potential vector for persistent access. This activity is significant for a SOC as it could indicate an attempt to maintain persistent access to the Kubernetes infrastructure. If confirmed malicious, it could lead to persistent attacks, service disruptions, or unauthorized access to sensitive information.
 data_source:
     - Kubernetes Audit
-search: |-
+search: |
     `kube_audit` "objectRef.resource"=daemonsets verb=create
       | fillnull
       | stats count values(user.groups{}) as user_groups
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -56,6 +56,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/kubernetes_audit_daemonset_created/kubernetes_audit_daemonset_created.json
-          sourcetype: _json
           source: kubernetes
+          sourcetype: _json
       test_type: unit
diff --git a/detections/cloud/kubernetes_falco_shell_spawned.yml b/detections/cloud/kubernetes_falco_shell_spawned.yml
index 7cebb998ef7..89cb13558c4 100644
--- a/detections/cloud/kubernetes_falco_shell_spawned.yml
+++ b/detections/cloud/kubernetes_falco_shell_spawned.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects instances where a shell is spawned within a Kubernetes container. Leveraging Falco, a cloud-native runtime security tool, this analytic monitors system calls within the Kubernetes environment and flags when a shell is spawned. This activity is significant for a SOC as it may indicate unauthorized access, allowing an attacker to execute arbitrary commands, manipulate container processes, or escalate privileges. If confirmed malicious, this could lead to data breaches, service disruptions, or unauthorized access to sensitive information, severely impacting the Kubernetes infrastructure's integrity and security.
 data_source:
     - Kubernetes Falco
-search: |-
+search: |
     `kube_container_falco` "A shell was spawned in a container"
     |  fillnull
     | stats count by container_image container_image_tag container_name parent proc_exepath process user
@@ -26,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -48,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/kubernetes_falco_shell_spawned/kubernetes_falco_shell_spawned.log
-          sourcetype: kube:container:falco
           source: kubernetes
+          sourcetype: kube:container:falco
       test_type: unit
diff --git a/detections/cloud/kubernetes_newly_seen_tcp_edge.yml b/detections/cloud/kubernetes_newly_seen_tcp_edge.yml
index fbcc0fe64c7..ec399eeb2e4 100644
--- a/detections/cloud/kubernetes_newly_seen_tcp_edge.yml
+++ b/detections/cloud/kubernetes_newly_seen_tcp_edge.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies newly seen TCP communication between source and destination workload pairs within a Kubernetes cluster. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. The detection compares network activity over the last hour with the past 30 days to spot new inter-workload communications. This is significant as new connections can indicate changes in application behavior or potential security threats. If malicious, unauthorized connections could lead to data breaches, privilege escalation, lateral movement, or disruption of critical services, compromising the application's integrity, availability, and confidentiality.
 data_source: []
-search: |-
+search: |
     | mstats count(tcp.packets) as tcp.packets_count where `kubernetes_metrics` AND earliest=-1h by k8s.cluster.name source.workload.name dest.workload.name
     | eval current="True"
     | append [ mstats count(tcp.packets) as tcp.packets_count where `kubernetes_metrics` AND earliest=-30d latest=-1h by source.workload.name dest.workload.name
diff --git a/detections/cloud/kubernetes_newly_seen_udp_edge.yml b/detections/cloud/kubernetes_newly_seen_udp_edge.yml
index 5bfab233f6b..9b719a9f5a6 100644
--- a/detections/cloud/kubernetes_newly_seen_udp_edge.yml
+++ b/detections/cloud/kubernetes_newly_seen_udp_edge.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Anomaly
 description: The following analytic detects UDP communication between a newly seen source and destination workload pair within a Kubernetes cluster. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. This detection compares network activity over the last hour with the past 30 days to identify new inter-workload communication. Such changes in network behavior can indicate potential security threats or anomalies. If confirmed malicious, unauthorized connections may enable attackers to infiltrate the application ecosystem, leading to data breaches, privilege escalation, lateral movement, or disruption of critical services.
 data_source: []
-search: |-
+search: |
     | mstats count(udp.packets) as udp.packets_count where `kubernetes_metrics` AND earliest=-1h by k8s.cluster.name source.workload.name dest.workload.name
     | eval current="True"
     | append [ mstats count(udp.packets) as udp.packets_count where `kubernetes_metrics` AND earliest=-30d latest=-1h by source.workload.name dest.workload.name
diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml
index 0cc3b3e3437..cc5d9e1c8c9 100644
--- a/detections/cloud/kubernetes_nginx_ingress_lfi.yml
+++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml
@@ -8,7 +8,8 @@ status: production
 type: TTP
 description: The following analytic detects local file inclusion (LFI) attacks targeting Kubernetes Nginx ingress controllers. It leverages Kubernetes logs, parsing fields such as `request` and `status` to identify suspicious patterns indicative of LFI attempts. This activity is significant because LFI attacks can allow attackers to read sensitive files from the server, potentially exposing critical information. If confirmed malicious, this could lead to unauthorized access to sensitive data, further exploitation, and potential compromise of the Kubernetes environment.
 data_source: []
-search: '`kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)" | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?<http_method>\S+)\s(?<url>\S+)\s" | eval phase="operate" | eval severity="high" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase, severity, request | lookup local=t local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`'
+search: |
+    `kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)" | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?<http_method>\S+)\s(?<url>\S+)\s" | eval phase="operate" | eval severity="high" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase, severity, request | lookup local=t local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`
 how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$host$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Local File Inclusion Attack detected on $host$
     entity:
@@ -47,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack.log
-          sourcetype: kube:container:controller
           source: kubernetes
+          sourcetype: kube:container:controller
       test_type: unit
diff --git a/detections/cloud/kubernetes_nginx_ingress_rfi.yml b/detections/cloud/kubernetes_nginx_ingress_rfi.yml
index d26aea5600e..8b0fa64487e 100644
--- a/detections/cloud/kubernetes_nginx_ingress_rfi.yml
+++ b/detections/cloud/kubernetes_nginx_ingress_rfi.yml
@@ -8,7 +8,8 @@ status: production
 type: TTP
 description: The following analytic detects remote file inclusion (RFI) attacks targeting Kubernetes Nginx ingress controllers. It leverages Kubernetes logs from the Nginx ingress controller, parsing fields such as `remote_addr`, `request`, and `url` to identify suspicious activity. This activity is significant because RFI attacks can allow attackers to execute arbitrary code or access sensitive files on the server. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or further compromise of the Kubernetes environment.
 data_source: []
-search: '`kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)" | rex field=request "^(?<http_method>\S+)?\s(?<url>\S+)\s" | rex field=url "(?<dest_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | search dest_ip=* | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | eval phase="operate" | eval severity="medium" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, dest_ip status, url, http_method, host, http_user_agent, proxy, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_rfi_filter`'
+search: |
+    `kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)" | rex field=request "^(?<http_method>\S+)?\s(?<url>\S+)\s" | rex field=url "(?<dest_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | search dest_ip=* | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | eval phase="operate" | eval severity="medium" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, dest_ip status, url, http_method, host, http_user_agent, proxy, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_rfi_filter`
 how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$host$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Remote File Inclusion Attack detected on $host$
     entity:
@@ -47,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack.log
-          sourcetype: kube:container:controller
           source: kubernetes
+          sourcetype: kube:container:controller
       test_type: unit
diff --git a/detections/cloud/kubernetes_node_port_creation.yml b/detections/cloud/kubernetes_node_port_creation.yml
index d8c7f282e56..46c715fc5e4 100644
--- a/detections/cloud/kubernetes_node_port_creation.yml
+++ b/detections/cloud/kubernetes_node_port_creation.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the creation of a Kubernetes NodePort service, which exposes a service to the external network. It identifies this activity by monitoring Kubernetes Audit logs for the creation of NodePort services. This behavior is significant for a SOC as it could allow an attacker to access internal services, posing a threat to the Kubernetes infrastructure's integrity and security. If confirmed malicious, this activity could lead to data breaches, service disruptions, or unauthorized access to sensitive information.
 data_source:
     - Kubernetes Audit
-search: |-
+search: |
     `kube_audit` "objectRef.resource"=services verb=create requestObject.spec.type=NodePort
       | fillnull
       | stats count values(user.groups{}) as user_groups
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -56,6 +56,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/kube_audit_create_node_port_service/kube_audit_create_node_port_service.json
-          sourcetype: _json
           source: kubernetes
+          sourcetype: _json
       test_type: unit
diff --git a/detections/cloud/kubernetes_pod_created_in_default_namespace.yml b/detections/cloud/kubernetes_pod_created_in_default_namespace.yml
index 19d3a9bd53d..cb0b1f03938 100644
--- a/detections/cloud/kubernetes_pod_created_in_default_namespace.yml
+++ b/detections/cloud/kubernetes_pod_created_in_default_namespace.yml
@@ -9,17 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of Kubernetes pods in the default, kube-system, or kube-public namespaces. It leverages Kubernetes audit logs to identify pod creation events within these specific namespaces. This activity is significant for a SOC as it may indicate an attacker attempting to hide their presence or evade defenses. Unauthorized pod creation in these namespaces can suggest a successful cluster breach, potentially leading to privilege escalation, persistent access, or further malicious activities within the cluster.
 data_source:
     - Kubernetes Audit
-search: |-
-    `kube_audit` objectRef.resource=pods verb=create objectRef.namespace IN ("default", "kube-system", "kube-public")
-      | fillnull
-      | stats count
-        BY objectRef.name objectRef.namespace objectRef.resource
-           requestReceivedTimestamp requestURI responseStatus.code
-           sourceIPs{} stage user.groups{}
-           user.uid user.username userAgent
-           verb
-      | rename sourceIPs{} as src_ip, user.username as user
-      | `kubernetes_pod_created_in_default_namespace_filter`
+search: |
+    `kube_audit` objectRef.resource="pods" verb="create" objectRef.namespace IN ("default", "kube-system", "kube-public") | eval 'objectRef.name'='objectRef.name', user=User, src_ip='sourceIPs{}' | stats count min(_time) as firstTime max(_time) as lastTime by resource verb namespace | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_pod_created_in_default_namespace_filter`
 how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -32,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -57,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/kubernetes_privileged_pod/kubernetes_privileged_pod.json
-          sourcetype: _json
           source: kubernetes
+          sourcetype: _json
       test_type: unit
diff --git a/detections/cloud/kubernetes_pod_with_host_network_attachment.yml b/detections/cloud/kubernetes_pod_with_host_network_attachment.yml
index 23329913381..829704b143e 100644
--- a/detections/cloud/kubernetes_pod_with_host_network_attachment.yml
+++ b/detections/cloud/kubernetes_pod_with_host_network_attachment.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the creation or update of a Kubernetes pod with host network attachment. It leverages Kubernetes Audit logs to identify pods configured with host network settings. This activity is significant for a SOC as it could allow an attacker to monitor all network traffic on the node, potentially capturing sensitive information and escalating privileges. If confirmed malicious, this could lead to unauthorized access, data breaches, and service disruptions, severely impacting the security and integrity of the Kubernetes environment.
 data_source:
     - Kubernetes Audit
-search: |-
+search: |
     `kube_audit` objectRef.resource=pods verb=create OR verb=update requestObject.metadata.annotations.kubectl.kubernetes.io/last-applied-configuration=*\"hostNetwork\":true*
       | fillnull
       | stats count values(user.groups{}) as user_groups
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -56,6 +56,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/kubernetes_privileged_pod/kubernetes_privileged_pod.json
-          sourcetype: _json
           source: kubernetes
+          sourcetype: _json
       test_type: unit
diff --git a/detections/cloud/kubernetes_previously_unseen_container_image_name.yml b/detections/cloud/kubernetes_previously_unseen_container_image_name.yml
index 67be84e8636..4ba66992253 100644
--- a/detections/cloud/kubernetes_previously_unseen_container_image_name.yml
+++ b/detections/cloud/kubernetes_previously_unseen_container_image_name.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies the creation of containerized workloads using previously unseen images in a Kubernetes cluster. It leverages process metrics from an OTEL collector and Kubernetes cluster receiver, pulled from Splunk Observability Cloud. The detection compares container image names seen in the last hour with those from the previous 30 days. This activity is significant as unfamiliar container images may introduce vulnerabilities, malware, or misconfigurations, posing threats to the cluster's integrity. If confirmed malicious, compromised images can lead to data breaches, service disruptions, unauthorized access, and potential lateral movement within the cluster.
 data_source: []
-search: |-
+search: |
     | mstats  count(k8s.container.ready) as k8s.container.ready_count where `kubernetes_metrics` AND earliest=-24h by host.name k8s.cluster.name k8s.node.name container.image.name
     | eval current="True"
     | append [mstats  count(k8s.container.ready) as k8s.container.ready_count where `kubernetes_metrics` AND earliest=-30d latest=-1h  by host.name k8s.cluster.name k8s.node.name container.image.name
diff --git a/detections/cloud/kubernetes_previously_unseen_process.yml b/detections/cloud/kubernetes_previously_unseen_process.yml
index 5dbea1926d9..64a0b6f3bae 100644
--- a/detections/cloud/kubernetes_previously_unseen_process.yml
+++ b/detections/cloud/kubernetes_previously_unseen_process.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Anomaly
 description: The following analytic detects previously unseen processes within the Kubernetes environment on master or worker nodes. It leverages process metrics collected via an OTEL collector and hostmetrics receiver, and data is pulled from Splunk Observability Cloud. This detection compares processes observed in the last hour against those seen in the previous 30 days. Identifying new processes is crucial as they may indicate unauthorized activity or attempts to compromise the node. If confirmed malicious, these processes could lead to data exfiltration, privilege escalation, denial-of-service attacks, or the introduction of malware, posing significant risks to the Kubernetes cluster.
 data_source: []
-search: |-
+search: |
     | mstats  count(process.memory.utilization) as process.memory.utilization_count where `kubernetes_metrics` AND earliest=-1h by host.name k8s.cluster.name k8s.node.name process.executable.name
     | eval current="True"
     | append [mstats  count(process.memory.utilization) as process.memory.utilization_count where `kubernetes_metrics` AND earliest=-30d latest=-1h by host.name k8s.cluster.name k8s.node.name process.executable.name ]
diff --git a/detections/cloud/kubernetes_process_running_from_new_path.yml b/detections/cloud/kubernetes_process_running_from_new_path.yml
index 439983adff8..79e1a007286 100644
--- a/detections/cloud/kubernetes_process_running_from_new_path.yml
+++ b/detections/cloud/kubernetes_process_running_from_new_path.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies processes running from newly seen paths within a Kubernetes environment. It leverages process metrics collected via an OTEL collector and hostmetrics receiver, and data is pulled from Splunk Observability Cloud using the Splunk Infrastructure Monitoring Add-on. This detection compares processes observed in the last hour with those seen over the previous 30 days. This activity is significant as it may indicate unauthorized changes, compromised nodes, or the introduction of malicious software. If confirmed malicious, it could lead to unauthorized process execution, control over critical resources, data exfiltration, privilege escalation, or malware introduction within the Kubernetes cluster.
 data_source: []
-search: |-
+search: |
     | mstats count(process.memory.utilization) as process.memory.utilization_count where `kubernetes_metrics` AND earliest=-1h by host.name k8s.cluster.name k8s.node.name process.pid process.executable.path process.executable.name
     | eval current="True"
     | append [ mstats count(process.memory.utilization) as process.memory.utilization_count where `kubernetes_metrics` AND earliest=-30d latest=-1h by host.name k8s.cluster.name k8s.node.name process.pid process.executable.path process.executable.name ]
diff --git a/detections/cloud/kubernetes_process_with_anomalous_resource_utilisation.yml b/detections/cloud/kubernetes_process_with_anomalous_resource_utilisation.yml
index 6f646922040..0c8513ce7b4 100644
--- a/detections/cloud/kubernetes_process_with_anomalous_resource_utilisation.yml
+++ b/detections/cloud/kubernetes_process_with_anomalous_resource_utilisation.yml
@@ -8,7 +8,8 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies high resource utilization anomalies in Kubernetes processes. It leverages process metrics from an OTEL collector and hostmetrics receiver, fetched via the Splunk Infrastructure Monitoring Add-on. The detection uses a lookup table with average and standard deviation values to spot anomalies. This activity is significant as high resource utilization can indicate security threats like cryptojacking, unauthorized data exfiltration, or compromised containers. If confirmed malicious, such anomalies can disrupt services, exhaust resources, increase costs, and allow attackers to evade detection or maintain access.
 data_source: []
-search: "| mstats avg(process.*) as process.* where `kubernetes_metrics` by host.name k8s.cluster.name k8s.node.name process.executable.name span=10s | eval key = 'k8s.cluster.name' + \":\" + 'host.name' + \":\" + 'process.executable.name' | lookup k8s_process_resource_baseline key | fillnull | eval anomalies = \"\" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 4 * 'stdev_<<MATCHSTR>>'), anomalies + \"<<MATCHSTR>> higher than average by \" + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + \" Standard Deviations. <<MATCHSTR>>=\" + tostring('<<MATCHSTR>>') + \" avg_<<MATCHSTR>>=\" + tostring('avg_<<MATCHSTR>>') + \" 'stdev_<<MATCHSTR>>'=\" + tostring('stdev_<<MATCHSTR>>') + \", \" , anomalies) ] | eval anomalies = replace(anomalies, \",\\s$\", \"\") | where anomalies!=\"\" | stats count values(anomalies) as anomalies by host.name k8s.cluster.name k8s.node.name process.executable.name | sort - count | where count > 5 | rename host.name as host | `kubernetes_process_with_anomalous_resource_utilisation_filter`"
+search: |
+    | mstats avg(process.*) as process.* where `kubernetes_metrics` by host.name k8s.cluster.name k8s.node.name process.executable.name span=10s | eval key = 'k8s.cluster.name' + ":" + 'host.name' + ":" + 'process.executable.name' | lookup k8s_process_resource_baseline key | fillnull | eval anomalies = "" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 4 * 'stdev_<<MATCHSTR>>'), anomalies + "<<MATCHSTR>> higher than average by " + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + " Standard Deviations. <<MATCHSTR>>=" + tostring('<<MATCHSTR>>') + " avg_<<MATCHSTR>>=" + tostring('avg_<<MATCHSTR>>') + " 'stdev_<<MATCHSTR>>'=" + tostring('stdev_<<MATCHSTR>>') + ", " , anomalies) ] | eval anomalies = replace(anomalies, ",\s$", "") | where anomalies!="" | stats count values(anomalies) as anomalies by host.name k8s.cluster.name k8s.node.name process.executable.name | sort - count | where count > 5 | rename host.name as host | `kubernetes_process_with_anomalous_resource_utilisation_filter`
 how_to_implement: "To implement this detection, follow these steps:\n* Deploy the OpenTelemetry Collector (OTEL) to your Kubernetes cluster.\n* Enable the hostmetrics/process receiver in the OTEL configuration.\n* Ensure that the process metrics, specifically Process.cpu.utilization and process.memory.utilization, are enabled.\n* Install the Splunk Infrastructure Monitoring (SIM) add-on. (ref: https://splunkbase.splunk.com/app/5247)\n * Configure the SIM add-on with your Observability Cloud Organization ID and Access Token.\n* Set up the SIM modular input to ingest Process Metrics. Name this input \"sim_process_metrics_to_metrics_index\".\n* In the SIM configuration, set the Organization ID to your Observability Cloud Organization ID.\n* Set the Signal Flow Program to the following: data('process.threads').publish(label='A'); data('process.cpu.utilization').publish(label='B'); data('process.cpu.time').publish(label='C'); data('process.disk.io').publish(label='D'); data('process.memory.usage').publish(label='E'); data('process.memory.virtual').publish(label='F'); data('process.memory.utilization').publish(label='G'); data('process.cpu.utilization').publish(label='H'); data('process.disk.operations').publish(label='I'); data('process.handles').publish(label='J'); data('process.threads').publish(label='K')\n* Set the Metric Resolution to 10000.\n * Leave all other settings at their default values.\n* Run the Search Baseline Of Kubernetes Container Network IO Ratio"
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/cloud/kubernetes_process_with_resource_ratio_anomalies.yml b/detections/cloud/kubernetes_process_with_resource_ratio_anomalies.yml
index 56be6e8b61d..27914d08b94 100644
--- a/detections/cloud/kubernetes_process_with_resource_ratio_anomalies.yml
+++ b/detections/cloud/kubernetes_process_with_resource_ratio_anomalies.yml
@@ -8,7 +8,8 @@ status: experimental
 type: Anomaly
 description: The following analytic detects anomalous changes in resource utilization ratios for processes running on a Kubernetes node. It leverages process metrics collected via an OTEL collector and hostmetrics receiver, analyzed through Splunk Observability Cloud. The detection uses a lookup table containing average and standard deviation values for various resource ratios (e.g., CPU:memory, CPU:disk operations). Significant deviations from these baselines may indicate compromised processes, malicious activity, or misconfigurations. If confirmed malicious, this could signify a security breach, allowing attackers to manipulate workloads, potentially leading to data exfiltration or service disruption.
 data_source: []
-search: "| mstats avg(process.*) as process.* where `kubernetes_metrics` by host.name k8s.cluster.name k8s.node.name process.executable.name span=10s | eval cpu:mem = 'process.cpu.utilization'/'process.memory.utilization' | eval cpu:disk = 'process.cpu.utilization'/'process.disk.operations' | eval mem:disk = 'process.memory.utilization'/'process.disk.operations' | eval cpu:threads = 'process.cpu.utilization'/'process.threads' | eval disk:threads = 'process.disk.operations'/'process.threads' | eval key = 'k8s.cluster.name' + \":\" + 'host.name' + \":\" + 'process.executable.name' | lookup k8s_process_resource_ratio_baseline key | fillnull | eval anomalies = \"\" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 4 * 'stdev_<<MATCHSTR>>'), anomalies + \"<<MATCHSTR>> ratio higher than average by \" + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + \" Standard Deviations. <<MATCHSTR>>=\" + tostring('<<MATCHSTR>>') + \" avg_<<MATCHSTR>>=\" + tostring('avg_<<MATCHSTR>>') + \" 'stdev_<<MATCHSTR>>'=\" + tostring('stdev_<<MATCHSTR>>') + \", \" , anomalies) ] | eval anomalies = replace(anomalies, \",\\s$\", \"\") | where anomalies!=\"\" | stats count values(anomalies) as anomalies by host.name k8s.cluster.name k8s.node.name process.executable.name | where count > 5 | rename host.name as host | `kubernetes_process_with_resource_ratio_anomalies_filter`"
+search: |
+    | mstats avg(process.*) as process.* where `kubernetes_metrics` by host.name k8s.cluster.name k8s.node.name process.executable.name span=10s | eval cpu:mem = 'process.cpu.utilization'/'process.memory.utilization' | eval cpu:disk = 'process.cpu.utilization'/'process.disk.operations' | eval mem:disk = 'process.memory.utilization'/'process.disk.operations' | eval cpu:threads = 'process.cpu.utilization'/'process.threads' | eval disk:threads = 'process.disk.operations'/'process.threads' | eval key = 'k8s.cluster.name' + ":" + 'host.name' + ":" + 'process.executable.name' | lookup k8s_process_resource_ratio_baseline key | fillnull | eval anomalies = "" | foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 4 * 'stdev_<<MATCHSTR>>'), anomalies + "<<MATCHSTR>> ratio higher than average by " + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + " Standard Deviations. <<MATCHSTR>>=" + tostring('<<MATCHSTR>>') + " avg_<<MATCHSTR>>=" + tostring('avg_<<MATCHSTR>>') + " 'stdev_<<MATCHSTR>>'=" + tostring('stdev_<<MATCHSTR>>') + ", " , anomalies) ] | eval anomalies = replace(anomalies, ",\s$", "") | where anomalies!="" | stats count values(anomalies) as anomalies by host.name k8s.cluster.name k8s.node.name process.executable.name | where count > 5 | rename host.name as host | `kubernetes_process_with_resource_ratio_anomalies_filter`
 how_to_implement: "To implement this detection, follow these steps:\n* Deploy the OpenTelemetry Collector (OTEL) to your Kubernetes cluster.\n* Enable the hostmetrics/process receiver in the OTEL configuration.\n* Ensure that the process metrics, specifically Process.cpu.utilization and process.memory.utilization, are enabled.\n* Install the Splunk Infrastructure Monitoring (SIM) add-on. (ref: https://splunkbase.splunk.com/app/5247)\n * Configure the SIM add-on with your Observability Cloud Organization ID and Access Token.\n* Set up the SIM modular input to ingest Process Metrics. Name this input \"sim_process_metrics_to_metrics_index\".\n* In the SIM configuration, set the Organization ID to your Observability Cloud Organization ID.\n* Set the Signal Flow Program to the following: data('process.threads').publish(label='A'); data('process.cpu.utilization').publish(label='B'); data('process.cpu.time').publish(label='C'); data('process.disk.io').publish(label='D'); data('process.memory.usage').publish(label='E'); data('process.memory.virtual').publish(label='F'); data('process.memory.utilization').publish(label='G'); data('process.cpu.utilization').publish(label='H'); data('process.disk.operations').publish(label='I'); data('process.handles').publish(label='J'); data('process.threads').publish(label='K')\n* Set the Metric Resolution to 10000.\n * Leave all other settings at their default values.\n* Run the Search Baseline Of Kubernetes Container Network IO Ratio"
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml
index 635fc6029c4..9d4ab9bc576 100644
--- a/detections/cloud/kubernetes_scanner_image_pulling.yml
+++ b/detections/cloud/kubernetes_scanner_image_pulling.yml
@@ -8,7 +8,7 @@ status: production
 type: TTP
 description: The following analytic detects the pulling of known Kubernetes security scanner images such as kube-hunter, kube-bench, and kube-recon. It leverages Kubernetes logs ingested through Splunk Connect for Kubernetes, specifically monitoring for messages indicating the pulling of these images. This activity is significant because the use of security scanners can indicate an attempt to identify vulnerabilities within the Kubernetes environment. If confirmed malicious, this could lead to the discovery and exploitation of security weaknesses, potentially compromising the entire Kubernetes cluster.
 data_source: []
-search: |-
+search: |
     `kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*")
       | rename object.* AS *
       | rename involvedObject.* AS *
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$host$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Kubernetes Scanner image pulled on host $host$
     entity:
@@ -56,6 +56,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json
-          sourcetype: kube:objects:events
           source: kubernetes
+          sourcetype: kube:objects:events
       test_type: unit
diff --git a/detections/cloud/kubernetes_scanning_by_unauthenticated_ip_address.yml b/detections/cloud/kubernetes_scanning_by_unauthenticated_ip_address.yml
index fb6ef65ce96..f9fba4791e1 100644
--- a/detections/cloud/kubernetes_scanning_by_unauthenticated_ip_address.yml
+++ b/detections/cloud/kubernetes_scanning_by_unauthenticated_ip_address.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies potential scanning activities within a Kubernetes environment by unauthenticated IP addresses. It leverages Kubernetes audit logs to detect multiple unauthorized access attempts (HTTP 403 responses) from the same source IP. This activity is significant as it may indicate an attacker probing for vulnerabilities or attempting to exploit known issues. If confirmed malicious, such scanning could lead to unauthorized access, data breaches, or further exploitation of the Kubernetes infrastructure, compromising the security and integrity of the environment.
 data_source:
     - Kubernetes Audit
-search: |-
+search: |
     `kube_audit` "user.groups{}"="system:unauthenticated" "responseStatus.code"=403
       | iplocation sourceIPs{}
       | stats count values(userAgent) as userAgent values(user.username) as user.username values(user.groups{}) as user.groups{} values(verb) as verb values(requestURI) as requestURI values(responseStatus.code) as responseStatus.code values(responseStatus.message) as responseStatus.message values(responseStatus.reason) as responseStatus.reason values(responseStatus.status) as responseStatus.status
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -54,6 +54,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/kubernetes_scanning/kubernetes_scanning.json
-          sourcetype: _json
           source: kubernetes
+          sourcetype: _json
       test_type: unit
diff --git a/detections/cloud/kubernetes_shell_running_on_worker_node.yml b/detections/cloud/kubernetes_shell_running_on_worker_node.yml
index 8dd1b365f42..af3c3770a98 100644
--- a/detections/cloud/kubernetes_shell_running_on_worker_node.yml
+++ b/detections/cloud/kubernetes_shell_running_on_worker_node.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies shell activity within the Kubernetes privilege scope on a worker node. It leverages process metrics from an OTEL collector hostmetrics receiver, specifically process.cpu.utilization and process.memory.utilization, pulled from Splunk Observability Cloud. This activity is significant as unauthorized shell processes can indicate potential security threats, providing attackers an entry point to compromise the node and the entire Kubernetes cluster. If confirmed malicious, this activity could lead to data theft, service disruption, privilege escalation, lateral movement, and further attacks, severely compromising the cluster's security and integrity.
 data_source: []
-search: |-
+search: |
     | mstats avg(process.cpu.utilization) as process.cpu.utilization avg(process.memory.utilization) as process.memory.utilization where `kubernetes_metrics` AND process.executable.name IN ("sh","bash","csh", "tcsh") by host.name k8s.cluster.name k8s.node.name process.pid process.executable.name span=10s
     | search process.cpu.utilization>0 OR process.memory.utilization>0
     | stats avg(process.cpu.utilization) as process.cpu.utilization avg(process.memory.utilization) as process.memory.utilization
diff --git a/detections/cloud/kubernetes_shell_running_on_worker_node_with_cpu_activity.yml b/detections/cloud/kubernetes_shell_running_on_worker_node_with_cpu_activity.yml
index c5ddf497a70..91704b813f1 100644
--- a/detections/cloud/kubernetes_shell_running_on_worker_node_with_cpu_activity.yml
+++ b/detections/cloud/kubernetes_shell_running_on_worker_node_with_cpu_activity.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies shell activity within the Kubernetes privilege scope on a worker node, specifically when shell processes are consuming CPU resources. It leverages process metrics from an OTEL collector hostmetrics receiver, pulled from Splunk Observability Cloud via the Splunk Infrastructure Monitoring Add-on, focusing on process.cpu.utilization and process.memory.utilization. This activity is significant as unauthorized shell processes can indicate a security threat, potentially compromising the node and the entire Kubernetes cluster. If confirmed malicious, attackers could gain full control over the host's resources, leading to data theft, service disruption, privilege escalation, and further attacks within the cluster.
 data_source: []
-search: |-
+search: |
     | mstats avg(process.cpu.utilization) as process.cpu.utilization avg(process.memory.utilization) as process.memory.utilization where `kubernetes_metrics` AND process.executable.name IN ("sh","bash","csh", "tcsh") by host.name k8s.cluster.name k8s.node.name process.pid process.executable.name span=10s
     | search process.cpu.utilization>0
     | stats avg(process.cpu.utilization) as process.cpu.utilization avg(process.memory.utilization) as process.memory.utilization
diff --git a/detections/cloud/kubernetes_suspicious_image_pulling.yml b/detections/cloud/kubernetes_suspicious_image_pulling.yml
index 572c975918b..d06861def2e 100644
--- a/detections/cloud/kubernetes_suspicious_image_pulling.yml
+++ b/detections/cloud/kubernetes_suspicious_image_pulling.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious image pulling in Kubernetes environments. It identifies this activity by monitoring Kubernetes audit logs for image pull requests that do not match a predefined list of allowed images. This behavior is significant for a SOC as it may indicate an attacker attempting to deploy malicious software or infiltrate the system. If confirmed malicious, the impact could be severe, potentially leading to unauthorized access to sensitive systems or data, and enabling further malicious activities within the cluster.
 data_source:
     - Kubernetes Audit
-search: |-
-    `kube_audit` requestObject.message="Pulling image*"
-      | search NOT `kube_allowed_images`
-      | fillnull
-      | stats count
-        BY objectRef.name objectRef.namespace objectRef.resource
-           requestReceivedTimestamp requestURI responseStatus.code
-           sourceIPs{} stage user.groups{}
-           user.uid user.username userAgent
-           verb
-      | rename sourceIPs{} as src_ip, user.username as user
-      | `kubernetes_suspicious_image_pulling_filter`
+search: |
+    `kube_audit` requestObject.message="Pulling image*" NOT (objectRef.name IN ("*splunk*", "*falco*")) | eval 'objectRef.name'='objectRef.name', user=User, src_ip='sourceIPs{}' | stats count min(_time) as firstTime max(_time) as lastTime by message name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_suspicious_image_pulling_filter`
 how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -58,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_audit_pull_image/kubernetes_audit_pull_image.json
-          sourcetype: _json
           source: kubernetes
+          sourcetype: _json
       test_type: unit
diff --git a/detections/cloud/kubernetes_unauthorized_access.yml b/detections/cloud/kubernetes_unauthorized_access.yml
index f82a5fa15e9..4dacfc475d1 100644
--- a/detections/cloud/kubernetes_unauthorized_access.yml
+++ b/detections/cloud/kubernetes_unauthorized_access.yml
@@ -9,17 +9,8 @@ type: Anomaly
 description: The following analytic detects unauthorized access attempts to Kubernetes by analyzing Kubernetes audit logs. It identifies anomalies in access patterns by examining the source of requests and their response statuses. This activity is significant for a SOC as it may indicate an attacker attempting to infiltrate the Kubernetes environment. If confirmed malicious, such access could lead to unauthorized control over Kubernetes resources, potentially compromising sensitive systems or data within the cluster.
 data_source:
     - Kubernetes Audit
-search: |-
-    `kube_audit` verb=create responseStatus.reason=Forbidden
-      | fillnull
-      | stats count
-        BY objectRef.namespace objectRef.resource requestReceivedTimestamp
-           requestURI responseStatus.code responseStatus.message
-           sourceIPs{} stage user.groups{}
-           user.uid user.username userAgent
-           verb
-      | rename sourceIPs{} as src_ip, user.username as user
-      | `kubernetes_unauthorized_access_filter`
+search: |
+    `kube_audit` verb="create" responseStatus.reason="Forbidden" | eval 'objectRef.name'='objectRef.name', user=User, src_ip='sourceIPs{}' | stats count min(_time) as firstTime max(_time) as lastTime by verb reason | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_unauthorized_access_filter`
 how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -32,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -57,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/kubernetes_unauthorized_access/kubernetes_unauthorized_access.json
-          sourcetype: _json
           source: kubernetes
+          sourcetype: _json
       test_type: unit
diff --git a/detections/cloud/microsoft_intune_bulk_wipe.yml b/detections/cloud/microsoft_intune_bulk_wipe.yml
index f843176573e..f1ef3063701 100644
--- a/detections/cloud/microsoft_intune_bulk_wipe.yml
+++ b/detections/cloud/microsoft_intune_bulk_wipe.yml
@@ -6,39 +6,25 @@ modification_date: '2026-05-13'
 author: Jake Enea
 status: production
 type: TTP
-description: |-
-    The following analytic detects a high volume of "wipe ManagedDevice" events from the Intune admin portal (5+ per hour by default).
+description: 'The following analytic detects a high volume of "wipe ManagedDevice" events from the Intune admin portal (5+ per hour by default).
+
     It leverages Intune audit logs to identify when this action is triggered. This activity is significant beacuse the "wipe ManagedDevice" action factory resets devices connected to your Microsoft Intune tenant.
-    If confirmed malicious, an attacker can abuse this action to perform a large-scale data wiping attack against your managed endpoints.
+
+    If confirmed malicious, an attacker can abuse this action to perform a large-scale data wiping attack against your managed endpoints.'
 data_source:
     - Azure Monitor Activity
-search: |-
-    `azure_monitor_activity`
-    operationName="wipe ManagedDevice"
-    | rename identity as user
-             resultType as result
-    | fillnull
-    | table _time action command dest user src
-            vendor_account vendor_product change_type
-            properties.Targets.*
+search: |
+    `azure_monitor_activity` operationName="wipe ManagedDevice" | stats count min(_time) as firstTime max(_time) as lastTime by action dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `microsoft_intune_bulk_wipe_filter`
+how_to_implement: 'The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest Intune audit logs via Azure EventHub.
 
-    | stats min(_time) as firstTime
-            max(_time) as lastTime
-            values(*) as *
-      count by user
-
-    | where count >= 5
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `microsoft_intune_bulk_wipe_filter`
-how_to_implement: |-
-    The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest Intune audit logs via Azure EventHub.
     To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub.
+
     Deploy as an event-based detection rule for quick deployment.
-    Adjust the count threshold according to expected activity in your environment.
-known_false_positives: |-
-    Legitimate adminstrative usage of the "wipe ManagedDevice" action might trigger this detection.
-    This action is typically used for offboarding endpoints or in response to a lost or stolen device.
+
+    Adjust the count threshold according to expected activity in your environment.'
+known_false_positives: 'Legitimate adminstrative usage of the "wipe ManagedDevice" action might trigger this detection.
+
+    This action is typically used for offboarding endpoints or in response to a lost or stolen device.'
 references:
     - https://www.lumos.com/blog/stryker-hack
     - https://www.covertswarm.com/post/swarm-intelligence-strykers-intune-wipe-proves-your-bcdr-plan-has-a-single-point-of-failure
@@ -77,6 +63,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/microsoft_intune_bulk_wipe.log
-          sourcetype: azure:monitor:activity
           source: Azure AD
+          sourcetype: azure:monitor:activity
       test_type: unit
diff --git a/detections/cloud/microsoft_intune_device_health_scripts.yml b/detections/cloud/microsoft_intune_device_health_scripts.yml
index dffe3e05594..61a3c569342 100644
--- a/detections/cloud/microsoft_intune_device_health_scripts.yml
+++ b/detections/cloud/microsoft_intune_device_health_scripts.yml
@@ -6,21 +6,12 @@ modification_date: '2026-05-13'
 author: Dean Luxton
 status: production
 type: Hunting
-description: >-
-    Microsoft Intune device remediation scripts are a tool administrators can use to remotely manage devices, this functionality can also be abused for SYSTEM level code execution and lateral movement to intune managed devices.
-    This detection identifies when a new device health script has been added, updated or deleted.
+description: Microsoft Intune device remediation scripts are a tool administrators can use to remotely manage devices, this functionality can also be abused for SYSTEM level code execution and lateral movement to intune managed devices. This detection identifies when a new device health script has been added, updated or deleted.
 data_source:
     - Azure Monitor Activity
-search: >-
-    `azure_monitor_activity` operationName="*DeviceHealthScript*"
-    | rename identity as user, properties.TargetObjectIds{} as TargetObjectId, properties.TargetDisplayNames{} as TargetDisplayName, properties.Actor.IsDelegatedAdmin as user_isDelegatedAdmin
-    | rex field="operationName" "^(?P<action>\w+?)DeviceHealthScript" | replace "patch" with "updated", "create" with "created", "delete", with "deleted", "assign", with "assigned" IN action
-    | table _time operationName action user user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId status tenantId correlationId
-    | `microsoft_intune_device_health_scripts_filter`
-how_to_implement: >-
-    The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub.
-    To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub.
-    Deploy as a risk based alerting rule for quick deployment or perform baselining & tune accordingly.
+search: |
+    `azure_monitor_activity` operationName="*DeviceHealthScript*" | rename identity as user, properties.TargetObjectIds{} as TargetObjectId, properties.TargetDisplayNames{} as TargetDisplayName, properties.Actor.IsDelegatedAdmin as user_isDelegatedAdmin | rex field="operationName" "^(?P<action>\w+?)DeviceHealthScript" | replace "patch" with "updated", "create" with "created", "delete", with "deleted", "assign", with "assigned" IN action | table _time operationName action user user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId status tenantId correlationId | `microsoft_intune_device_health_scripts_filter`
+how_to_implement: The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. Deploy as a risk based alerting rule for quick deployment or perform baselining & tune accordingly.
 known_false_positives: Legitimate adminstrative usage of this functionality will trigger this detection.
 references:
     - https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d
@@ -44,6 +35,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1072/intune/intune.log
-          sourcetype: azure:monitor:activity
           source: Azure AD
+          sourcetype: azure:monitor:activity
       test_type: unit
diff --git a/detections/cloud/microsoft_intune_devicemanagementconfigurationpolicies.yml b/detections/cloud/microsoft_intune_devicemanagementconfigurationpolicies.yml
index 02fed0b3cd4..1b4df01a0ca 100644
--- a/detections/cloud/microsoft_intune_devicemanagementconfigurationpolicies.yml
+++ b/detections/cloud/microsoft_intune_devicemanagementconfigurationpolicies.yml
@@ -6,34 +6,12 @@ modification_date: '2026-05-13'
 author: Dean Luxton
 status: production
 type: Hunting
-description: >-
-    Microsoft Intune device management configuration policies are a tool
-    administrators can use to remotely manage policies and settings on intune
-    managed devices. This functionality can also be abused to disable defences &
-    evade detection. This detection identifies when a new device management
-    configuration policy has been created.
+description: Microsoft Intune device management configuration policies are a tool administrators can use to remotely manage policies and settings on intune managed devices. This functionality can also be abused to disable defences & evade detection. This detection identifies when a new device management configuration policy has been created.
 data_source:
     - Azure Monitor Activity
-search: >-
-    `azure_monitor_activity` operationName="*
-    DeviceManagementConfigurationPolicy*" | rename identity as user,
-    properties.TargetObjectIds{} as TargetObjectId,
-    properties.TargetDisplayNames{} as TargetDisplayName,
-    properties.Actor.IsDelegatedAdmin as user_isDelegatedAdmin | eval
-    details=mvzip('properties.Targets{}.ModifiedProperties{}.Name','properties.Targets{}.ModifiedProperties{}.New',":
-    ") | rex field="operationName" "^(?P<action>\w+)\s" | replace "Patch" with
-    "updated", "Create" with "created", "Delete", with "deleted", "assign", with
-    "assigned" IN action | eval action=if(match(operationName
-    ,"Assignment$"),"assigned",'action') | table _time operationName action user
-    user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId details
-    status tenantId correlationId |
-    `microsoft_intune_devicemanagementconfigurationpolicies_filter`
-how_to_implement: >-
-    The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest
-    In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune
-    > Tenant administration > Diagnostic settings > Add diagnostic settings & send
-    events to the activity audit event hub. Deploy as a risk based alerting rule
-    for quick deployment or perform baselining & tune accordingly.
+search: |
+    `azure_monitor_activity` operationName="* DeviceManagementConfigurationPolicy*" | rename identity as user, properties.TargetObjectIds{} as TargetObjectId, properties.TargetDisplayNames{} as TargetDisplayName, properties.Actor.IsDelegatedAdmin as user_isDelegatedAdmin | eval details=mvzip('properties.Targets{}.ModifiedProperties{}.Name','properties.Targets{}.ModifiedProperties{}.New',": ") | rex field="operationName" "^(?P<action>\w+)\s" | replace "Patch" with "updated", "Create" with "created", "Delete", with "deleted", "assign", with "assigned" IN action | eval action=if(match(operationName ,"Assignment$"),"assigned",'action') | table _time operationName action user user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId details status tenantId correlationId | `microsoft_intune_devicemanagementconfigurationpolicies_filter`
+how_to_implement: The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. Deploy as a risk based alerting rule for quick deployment or perform baselining & tune accordingly.
 known_false_positives: Legitimate adminstrative usage of this functionality will trigger this detection.
 references:
     - https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d
@@ -58,6 +36,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1072/intune/intune.log
-          sourcetype: azure:monitor:activity
           source: Azure AD
+          sourcetype: azure:monitor:activity
       test_type: unit
diff --git a/detections/cloud/microsoft_intune_manual_device_management.yml b/detections/cloud/microsoft_intune_manual_device_management.yml
index 95f0c47bb4a..33852f8566a 100644
--- a/detections/cloud/microsoft_intune_manual_device_management.yml
+++ b/detections/cloud/microsoft_intune_manual_device_management.yml
@@ -6,23 +6,12 @@ modification_date: '2026-05-13'
 author: Dean Luxton
 status: production
 type: Hunting
-description: >-
-    Microsoft Intune device management configuration policies, scripts & apps are a all tools administrators can use to remotely manage intune managed devices.
-    Instead of waiting for the devices to poll for changes to polciies, the policies can be manually pushed to expidite delivery.
-    This may be useful in a pinch, it may also be a sign of an impatient attacker trying to speed up the delivery of their payload.
-    This detection identifies when a device management configuration policy sync events, on-demand remediation scripts are triggered or when devices are remotely restarted.
+description: Microsoft Intune device management configuration policies, scripts & apps are a all tools administrators can use to remotely manage intune managed devices. Instead of waiting for the devices to poll for changes to polciies, the policies can be manually pushed to expidite delivery. This may be useful in a pinch, it may also be a sign of an impatient attacker trying to speed up the delivery of their payload. This detection identifies when a device management configuration policy sync events, on-demand remediation scripts are triggered or when devices are remotely restarted.
 data_source:
     - Azure Monitor Activity
-search: >-
-    `azure_monitor_activity` operationName="*ManagedDevice*"
-    | rename identity as user, properties.TargetObjectIds{} as TargetObjectId, properties.TargetDisplayNames{} as TargetDisplayName, properties.Actor.IsDelegatedAdmin as user_isDelegatedAdmin
-    | rex field="operationName" "^(?P<action>\w+)\s"
-    | table _time operationName action user user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId status tenantId correlationId
-    | `microsoft_intune_manual_device_management_filter`
-how_to_implement: >-
-    The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub.
-    To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub.
-    Deploy as a risk based alerting rule for quick deployment or perform baselining & tune accordingly.
+search: |
+    `azure_monitor_activity` operationName="*ManagedDevice*" | rename identity as user, properties.TargetObjectIds{} as TargetObjectId, properties.TargetDisplayNames{} as TargetDisplayName, properties.Actor.IsDelegatedAdmin as user_isDelegatedAdmin | rex field="operationName" "^(?P<action>\w+)\s" | table _time operationName action user user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId status tenantId correlationId | `microsoft_intune_manual_device_management_filter`
+how_to_implement: The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. Deploy as a risk based alerting rule for quick deployment or perform baselining & tune accordingly.
 known_false_positives: Legitimate adminstrative usage of this functionality will trigger this detection.
 references:
     - https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d
@@ -45,6 +34,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1072/intune/intune.log
-          sourcetype: azure:monitor:activity
           source: Azure AD
+          sourcetype: azure:monitor:activity
       test_type: unit
diff --git a/detections/cloud/microsoft_intune_mobile_apps.yml b/detections/cloud/microsoft_intune_mobile_apps.yml
index 19462f379d5..beb47361d01 100644
--- a/detections/cloud/microsoft_intune_mobile_apps.yml
+++ b/detections/cloud/microsoft_intune_mobile_apps.yml
@@ -6,9 +6,9 @@ modification_date: '2026-05-13'
 author: Dean Luxton
 status: experimental
 type: Hunting
-description: |
-    Microsoft Intune supports deploying packaged applications to support software deployment, this functionality can also be abused for deploying malicious payloads to intune managed devices.
-    This detection identifies when a new packaged application has been added, updated or deleted.
+description: 'Microsoft Intune supports deploying packaged applications to support software deployment, this functionality can also be abused for deploying malicious payloads to intune managed devices.
+
+    This detection identifies when a new packaged application has been added, updated or deleted.'
 data_source:
     - Azure Monitor Activity
 search: |
@@ -17,10 +17,11 @@ search: |
     | rex field="operationName" "^(?P<action>\w+)\s" | replace "Patch" with "updated", "Create" with "created", "Delete", with "deleted", "assign", with "assigned" IN action
     | table _time operationName action user user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId status tenantId correlationId
     | `microsoft_intune_mobile_apps_filter`
-how_to_implement: |
-    The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub.
+how_to_implement: 'The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub.
+
     To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub.
-    Deploy as a risk based alerting rule for quick deployment or perform baselining & tune accordingly.
+
+    Deploy as a risk based alerting rule for quick deployment or perform baselining & tune accordingly.'
 known_false_positives: Legitimate adminstrative usage of this functionality will trigger this detection.
 references:
     - https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d
diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml
index 9dc8fbcc675..d718055b2b6 100644
--- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml
+++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic detects the addition of an application role assignment grant to a user in Office 365. It leverages data from the `o365_management_activity` dataset, specifically monitoring the "Add app role assignment grant to user" operation. This activity is significant as it can indicate unauthorized privilege escalation or the assignment of sensitive roles to users. If confirmed malicious, this could allow an attacker to gain elevated permissions, potentially leading to unauthorized access to critical resources and data within the Office 365 environment.
 data_source:
     - O365 Add app role assignment grant to user.
-search: |-
-    `o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user."
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           src vendor_account vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_add_app_role_assignment_grant_user_filter`
+search: |
+    `o365_management_activity` Operation=Add app role assignment grant to user. Workload="AzureActiveDirectory" | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_add_app_role_assignment_grant_user_filter`
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 known_false_positives: The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.
 references:
@@ -31,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ added a new app role assignment
     entity:
@@ -60,6 +53,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federation/o365_new_federation.json
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml
index 7f984c82fc6..306d8303595 100644
--- a/detections/cloud/o365_added_service_principal.yml
+++ b/detections/cloud/o365_added_service_principal.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic detects the addition of new service principal accounts in O365 tenants. It leverages data from the `o365_management_activity` dataset, specifically monitoring for operations related to adding or creating service principals. This activity is significant because attackers can exploit service principals to gain unauthorized access and perform malicious actions within an organization's environment. If confirmed malicious, this could allow attackers to interact with APIs, access resources, and execute operations on behalf of the organization, potentially leading to data breaches or further compromise.
 data_source:
     - O365
-search: |-
-    `o365_management_activity` Workload=AzureActiveDirectory Operation="*Add service principal*" OR (Operation = "*principal*" AND action = "created")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           src vendor_account vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_added_service_principal_filter`
+search: |
+    `o365_management_activity` (Workload="AzureActiveDirectory" Operation="*Add service principal*") OR (Operation="*principal*" action="created") | eval user=User, new_value='ModifiedProperties{}.NewValue', signature=signature, Severity=Severity | stats count min(_time) as firstTime max(_time) as lastTime by Workload Operation | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_added_service_principal_filter`
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 known_false_positives: The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.
 references:
@@ -33,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has created new service principal in AzureActiveDirectory
     entity:
@@ -57,6 +50,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_added_service_principal/o365_add_service_principal.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml b/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml
index e38deaea464..1287f2e0f02 100644
--- a/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml
+++ b/detections/cloud/o365_admin_consent_bypassed_by_service_principal.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies instances where a service principal in Office 365 Azure Active Directory assigns app roles without standard admin consent. It leverages `o365_management_activity` logs, specifically focusing on the 'Add app role assignment to service principal' operation. This activity is significant for SOCs as it may indicate a bypass of critical administrative controls, potentially leading to unauthorized access or privilege escalation. If confirmed malicious, this could allow an attacker to misuse automated processes to assign sensitive permissions, compromising the security of the environment.
 data_source:
     - O365 Add app role assignment to service principal.
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add app role assignment to service principal.\" | eval len=mvcount('Actor{}.ID') | eval userType = mvindex('Actor{}.ID',len-1) | eval roleId = mvindex('ModifiedProperties{}.NewValue', 0) | eval roleValue = mvindex('ModifiedProperties{}.NewValue', 1) | eval roleDescription = mvindex('ModifiedProperties{}.NewValue', 2) | eval dest_user = mvindex('Target{}.ID', 0) | search userType = \"ServicePrincipal\" | eval src_user = user | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product dest_user roleId roleValue roleDescription | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_admin_consent_bypassed_by_service_principal_filter`"
+search: |
+    `o365_management_activity` Operation=Add app role assignment to service principal. Workload="AzureActiveDirectory" userType="ServicePrincipal" | eval dest_user=dest_user | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_admin_consent_bypassed_by_service_principal_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Service Principals are sometimes configured to legitimately bypass the consent process for purposes of automation. Filter as needed.
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Service principal $user$ bypassed the admin consent process and granted permissions to $dest_user$
     entity:
diff --git a/detections/cloud/o365_advanced_audit_disabled.yml b/detections/cloud/o365_advanced_audit_disabled.yml
index e4bbf241ecf..e7c5699b1bc 100644
--- a/detections/cloud/o365_advanced_audit_disabled.yml
+++ b/detections/cloud/o365_advanced_audit_disabled.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects instances where the O365 advanced audit is disabled for a specific user within the Office 365 tenant. It uses O365 audit logs, focusing on events related to audit license changes in AzureActiveDirectory workloads. This activity is significant because the O365 advanced audit provides critical logging and insights into user and administrator activities. Disabling it can blind security teams to potential malicious actions. If confirmed malicious, attackers could operate within the user's mailbox or account with reduced risk of detection, leading to unauthorized data access, data exfiltration, or account compromise.
 data_source:
     - O365 Change user license.
-search: "`o365_management_activity` Operation=\"Change user license.\" | eval property_name = mvindex ('ExtendedProperties{}.Name', 1) | search property_name = \"extendedAuditEventCategory\" | eval additionalDetails = mvindex('ExtendedProperties{}.Value',0) | eval split_value=split(additionalDetails,\"NewValue\") | eval possible_plan=mvindex(split_value, 1) | rex field=\"possible_plan\" \"DisabledPlans=\\[(?P<DisabledPlans>[^\\]]+)\\]\" | search DisabledPlans IN (\"*M365_ADVANCED_AUDITING*\") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product DisabledPlans object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_advanced_audit_disabled_filter`"
+search: |
+    `o365_management_activity` Operation="Change user license." | eval property_name = mvindex ('ExtendedProperties{}.Name', 1) | search property_name = "extendedAuditEventCategory" | eval additionalDetails = mvindex('ExtendedProperties{}.Value',0) | eval split_value=split(additionalDetails,"NewValue") | eval possible_plan=mvindex(split_value, 1) | rex field="possible_plan" "DisabledPlans=\[(?P<DisabledPlans>[^\]]+)\]" | search DisabledPlans IN ("*M365_ADVANCED_AUDITING*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product DisabledPlans object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_advanced_audit_disabled_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Administrators might temporarily disable the advanced audit for troubleshooting, performance reasons, or other administrative tasks. Filter as needed.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Advanced auditing for user $object$ was disabled by $user$
     entity:
diff --git a/detections/cloud/o365_application_available_to_other_tenants.yml b/detections/cloud/o365_application_available_to_other_tenants.yml
index 78cb4b7dd0a..0e459fa2465 100644
--- a/detections/cloud/o365_application_available_to_other_tenants.yml
+++ b/detections/cloud/o365_application_available_to_other_tenants.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies the configuration of Azure Active Directory Applications in a manner that allows authentication from external tenants or personal accounts. This configuration can lead to inappropriate or malicious access of any data or capabilities the application is allowed to access. This detection leverages the O365 Universal Audit Log data source.
 data_source:
     - Office 365 Universal Audit Log
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add application.\",\"Update application.\") ModifiedProperties{}.Name=AvailableToOtherTenants | eval result = case(match(mvindex('ModifiedProperties{}.NewValue',mvfind('ModifiedProperties{}.Name',\"AvailableToOtherTenants\")),\"false\"),\"removed\",true(),\"added\"), object_name=mvindex('Target{}.ID', 3), signature=Operation, object_attrs = \"AvailableToOtherTenants\", user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | search result = \"added\" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product object_attrs object_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_application_available_to_other_tenants_filter`"
+search: |
+    `o365_management_activity` Workload=AzureActiveDirectory Operation IN ("Add application.","Update application.") ModifiedProperties{}.Name=AvailableToOtherTenants | eval result = case(match(mvindex('ModifiedProperties{}.NewValue',mvfind('ModifiedProperties{}.Name',"AvailableToOtherTenants")),"false"),"removed",true(),"added"), object_name=mvindex('Target{}.ID', 3), signature=Operation, object_attrs = "AvailableToOtherTenants", user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | search result = "added" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product object_attrs object_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_application_available_to_other_tenants_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Business approved changes by known administrators.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An Azure Application [$object_name$] was configured by [$user$] as accessible to external tenants.
     entity:
@@ -51,6 +52,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/o365_azure_workload_events/o365_azure_workload_events.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_application_registration_owner_added.yml b/detections/cloud/o365_application_registration_owner_added.yml
index 54f4df198d6..f9fb96364ab 100644
--- a/detections/cloud/o365_application_registration_owner_added.yml
+++ b/detections/cloud/o365_application_registration_owner_added.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies instances where a new owner is assigned to an application registration within an Azure AD and Office 365 tenant. It leverages O365 audit logs, specifically events related to changes in owner assignments within the AzureActiveDirectory workload. This activity is significant because assigning a new owner to an application registration can grant significant control over the application's configuration, permissions, and behavior. If confirmed malicious, an attacker could modify the application's settings, permissions, and behavior, leading to unauthorized data access, privilege escalation, or the introduction of malicious behavior within the application's operations.
 data_source:
     - O365 Add owner to application.
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add owner to application.\" | eval app_id=mvindex('ModifiedProperties{}.NewValue', 0) | eval app_displayName=mvindex('ModifiedProperties{}.NewValue', 1) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product app_id app_displayName object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_application_registration_owner_added_filter`"
+search: |
+    `o365_management_activity` Operation=Add owner to application. Workload="AzureActiveDirectory" | eval app_displayName=app_displayName, object=object | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_application_registration_owner_added_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Application owners may be added for legitimate reasons, filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Application registration $app_displayName$ was assigned a new owner $object$
     entity:
diff --git a/detections/cloud/o365_applicationimpersonation_role_assigned.yml b/detections/cloud/o365_applicationimpersonation_role_assigned.yml
index e823edba72d..d5a06bd1535 100644
--- a/detections/cloud/o365_applicationimpersonation_role_assigned.yml
+++ b/detections/cloud/o365_applicationimpersonation_role_assigned.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects the assignment of the ApplicationImpersonation role in Office 365 to a user or application. It uses the Office 365 Management Activity API to monitor Azure Active Directory audit logs for role assignment events. This activity is significant because the ApplicationImpersonation role allows impersonation of any user, enabling access to and modification of their mailbox. If confirmed malicious, an attacker could gain unauthorized access to sensitive information, manipulate mailbox data, and perform actions as a legitimate user, posing a severe security risk to the organization.
 data_source:
     - O365
-search: |-
-    `o365_management_activity` Workload=Exchange Operation="New-ManagementRoleAssignment" Role=ApplicationImpersonation
-      | rename User as target_user
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           src vendor_account vendor_product
-           target_user
-      | `security_content_ctime(lastTime)`
-      | `o365_applicationimpersonation_role_assigned_filter`
+search: |
+    `o365_management_activity` Workload="Exchange" Operation="New-ManagementRoleAssignment" Role="ApplicationImpersonation" | eval user=User, new_value='ModifiedProperties{}.NewValue', signature=signature, Severity=Severity | stats count min(_time) as firstTime max(_time) as lastTime by Workload Operation Role target_user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_applicationimpersonation_role_assigned_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: While infrequent, the ApplicationImpersonation role may be granted for leigimate reasons, filter as needed.
 references:
@@ -33,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$target_user$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$target_user$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $user$ granted the ApplicationImpersonation role to $target_user$
     entity:
diff --git a/detections/cloud/o365_bec_email_hiding_rule_created.yml b/detections/cloud/o365_bec_email_hiding_rule_created.yml
index de038e494d2..a3e1cfc3ba9 100644
--- a/detections/cloud/o365_bec_email_hiding_rule_created.yml
+++ b/detections/cloud/o365_bec_email_hiding_rule_created.yml
@@ -3,12 +3,12 @@ id: 603ebac2-f157-4df7-a6ac-34e8d0350f86
 version: 9
 creation_date: '2025-02-14'
 modification_date: '2026-09-22'
-author: '0xC0FFEEEE, Github Community'
+author: 0xC0FFEEEE, Github Community
 status: production
 type: TTP
 description: This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. This may indicate that an attacker has gained access to the account.
 data_source: []
-search: |-
+search: |
     `o365_management_activity` Workload=Exchange Operation IN ("New-InboxRule", "Set-InboxRule")
     | stats min(_time) as firstTime, max(_time) as lastTime, values(Operation) as Operation, latest(Name) as Name, latest(MarkAsRead) as MarkAsRead, latest(MoveToFolder) as MoveToFolder by object_id user
     | `security_content_ctime(firstTime)`
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for $user$
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user$" | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential BEC mailbox rule - $Name$ was created by user - $user$
     entity:
@@ -58,6 +58,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.008/o365/o365_suspicious_mailbox_rule.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml b/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml
index 50f6b8fc597..f885ec5846b 100644
--- a/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml
+++ b/detections/cloud/o365_block_user_consent_for_risky_apps_disabled.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects when the "risk-based step-up consent" security setting in Microsoft 365 is disabled. It monitors Azure Active Directory logs for the "Update authorization policy" operation, specifically changes to the "AllowUserConsentForRiskyApps" setting. This activity is significant because disabling this feature can expose the organization to OAuth phishing threats, allowing users to grant consent to malicious applications. If confirmed malicious, attackers could gain unauthorized access to user data and sensitive information, leading to data breaches and further compromise within the organization.
 data_source:
     - O365 Update authorization policy.
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update authorization policy.\" | eval index_number = if(mvfind('ModifiedProperties{}.Name',\"AllowUserConsentForRiskyApps\") >= 0, mvfind('ModifiedProperties{}.Name',\"AllowUserConsentForRiskyApps\"), -1) | search index_number >= 0 | eval AllowUserConsentForRiskyApps = mvindex('ModifiedProperties{}.NewValue',index_number) | where AllowUserConsentForRiskyApps like \"%true%\" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product AllowUserConsentForRiskyApps | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_block_user_consent_for_risky_apps_disabled_filter`"
+search: |
+    `o365_management_activity` Operation=Update authorization policy. Workload="AzureActiveDirectory" index_number>=0 | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_block_user_consent_for_risky_apps_disabled_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Legitimate changes to the 'risk-based step-up consent' setting by administrators, perhaps as part of a policy update or security assessment, may trigger this alert, necessitating verification of the change's intent and authorization.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Risk-based step-up consent security setting was disabled by $user$
     entity:
diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
index 50131cabb6f..969e91c318f 100644
--- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
+++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies instances where new IP addresses are added to the trusted IPs list in Office 365, potentially allowing users from these IPs to bypass Multi-Factor Authentication (MFA) during login. It leverages O365 audit logs, specifically focusing on events related to the modification of trusted IP settings. This activity is significant because adding trusted IPs can weaken the security posture by bypassing MFA, which is a critical security control. If confirmed malicious, this could lead to unauthorized access, compromising sensitive information and systems. Immediate investigation is required to validate the legitimacy of the IP addition.
 data_source:
     - O365 Set Company Information.
-search: '`o365_management_activity` Operation="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy | rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by signature dest user src vendor_account vendor_product ip_addresses_new_added | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_bypass_mfa_via_trusted_ip_filter`'
+search: |
+    `o365_management_activity` Operation="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy | rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by signature dest user src vendor_account vendor_product ip_addresses_new_added | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_bypass_mfa_via_trusted_ip_filter`
 how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 known_false_positives: Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA
     entity:
@@ -46,6 +47,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/o365_bypass_mfa_via_trusted_ip/o365_bypass_mfa_via_trusted_ip.json
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_compliance_content_search_exported.yml b/detections/cloud/o365_compliance_content_search_exported.yml
index f374ab9c715..6c3a886ab7c 100644
--- a/detections/cloud/o365_compliance_content_search_exported.yml
+++ b/detections/cloud/o365_compliance_content_search_exported.yml
@@ -8,7 +8,7 @@ status: production
 type: TTP
 description: The following analytic identifies when the results of a content search within the Office 365 Security and Compliance Center are exported. It uses the SearchExported operation from the SecurityComplianceCenter workload in the o365_management_activity data source. This activity is significant because exporting search results can involve sensitive or critical organizational data, potentially leading to data exfiltration. If confirmed malicious, an attacker could gain access to and exfiltrate sensitive information, posing a severe risk to the organization's data security and compliance posture.
 data_source: []
-search: |-
+search: |
     `o365_management_activity` Workload=SecurityComplianceCenter Operation="SearchExported"
       | rename user_id as user
       | fillnull
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new compliance content search export was started by $user$
     entity:
@@ -56,6 +56,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.002/o365_compliance_content_search_exported/o365_compliance_content_search_exported.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_compliance_content_search_started.yml b/detections/cloud/o365_compliance_content_search_started.yml
index 375390e6623..e9b86b9be58 100644
--- a/detections/cloud/o365_compliance_content_search_started.yml
+++ b/detections/cloud/o365_compliance_content_search_started.yml
@@ -8,7 +8,7 @@ status: production
 type: TTP
 description: The following analytic detects when a content search is initiated within the Office 365 Security and Compliance Center. It leverages the SearchCreated operation from the o365_management_activity logs under the SecurityComplianceCenter workload. This activity is significant as it may indicate an attempt to access sensitive organizational data, including emails and documents. If confirmed malicious, this could lead to unauthorized data access, potential data exfiltration, and compliance violations. Monitoring this behavior helps ensure the integrity and security of organizational data.
 data_source: []
-search: |-
+search: |
     `o365_management_activity` Workload=SecurityComplianceCenter Operation=SearchCreated
       | rename user_id as user
       | fillnull
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new compliance content search was started by $user$
     entity:
@@ -56,6 +56,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.002/o365_compliance_content_search_started/o365_compliance_content_search_started.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_concurrent_sessions_from_different_ips.yml b/detections/cloud/o365_concurrent_sessions_from_different_ips.yml
index 72e02852e4f..1f630b56d9c 100644
--- a/detections/cloud/o365_concurrent_sessions_from_different_ips.yml
+++ b/detections/cloud/o365_concurrent_sessions_from_different_ips.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic identifies user sessions in Office 365 accessed from multiple IP addresses, indicating potential adversary-in-the-middle (AiTM) phishing attacks. It detects this activity by analyzing Azure Active Directory logs for 'UserLoggedIn' operations and flags sessions with more than one associated IP address. This behavior is significant as it suggests unauthorized concurrent access, which is uncommon in normal usage. If confirmed malicious, the impact could include data theft, account takeover, and the launching of internal phishing campaigns, posing severe risks to organizational security.
 data_source:
     - O365 UserLoggedIn
-search: |-
-    `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoggedIn
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime values(src) as src
-        BY signature dest user
-           vendor_account vendor_product SessionId
-      | where mvcount(src) > 1
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_concurrent_sessions_from_different_ips_filter`
+search: |
+    `o365_management_activity` Operation=UserLoggedIn Workload="AzureActiveDirectory" | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_concurrent_sessions_from_different_ips_filter`
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -33,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has logged in with the same session id from more than one unique IP address
     entity:
@@ -56,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/o365_concurrent_sessions_from_different_ips/o365_concurrent_sessions_from_different_ips.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_cross_tenant_access_change.yml b/detections/cloud/o365_cross_tenant_access_change.yml
index 2c49f2f0706..5a452fdbf97 100644
--- a/detections/cloud/o365_cross_tenant_access_change.yml
+++ b/detections/cloud/o365_cross_tenant_access_change.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies when cross-tenant access/synchronization policies are changed in an Azure tenant. Adversaries have been observed altering victim cross-tenant policies as a method of lateral movement or maintaining persistent access to compromised environments. These policies should be considered sensitive and monitored for changes and/or loose configuration.
 data_source:
     - Office 365 Universal Audit Log
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add a partner to cross-tenant access setting.\",\"Delete partner specific cross-tenant access setting.\") | eval user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature signature_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_cross_tenant_access_change_filter`"
+search: |
+    `o365_management_activity` Workload="AzureActiveDirectory" Operation IN ("Add a partner to cross-tenant access setting.", "Delete partner specific cross-tenant access setting.") | eval user=User, src_user=P2Sender, object=object, signature=DetectionMethod, object_name=object_name, file_path=SiteUrl, src=src, file_name=SourceFileName | stats count min(_time) as firstTime max(_time) as lastTime by Workload Operation | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_cross_tenant_access_change_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Business approved changes by known administrators.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The user [$user$] changed the Azure cross-tenant access settings
     entity:
@@ -47,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/o365_azure_workload_events/o365_azure_workload_events.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml
index 6a259cbd519..4321a78f2a2 100644
--- a/detections/cloud/o365_disable_mfa.yml
+++ b/detections/cloud/o365_disable_mfa.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies instances where Multi-Factor Authentication (MFA) is disabled for a user within the Office 365 environment. It leverages O365 audit logs, specifically focusing on events related to MFA settings. Disabling MFA removes a critical security layer, making accounts more vulnerable to unauthorized access. If confirmed malicious, this activity could indicate an attacker attempting to maintain persistence or an insider threat, significantly increasing the risk of unauthorized access. Immediate investigation is required to validate the reason for disabling MFA, potentially re-enable it, and assess any other suspicious activities related to the affected account.
 data_source:
     - O365 Disable Strong Authentication.
-search: |-
+search: |
     `o365_management_activity` Operation="Disable Strong Authentication."
       | rename UserId as user object as src_user
       | fillnull
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $src_user$ has executed an operation $signature$ for user $user$
     entity:
@@ -54,6 +54,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_disable_mfa/o365_disable_mfa.json
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_dlp_rule_triggered.yml b/detections/cloud/o365_dlp_rule_triggered.yml
index f20c22ee34b..df2878b48fc 100644
--- a/detections/cloud/o365_dlp_rule_triggered.yml
+++ b/detections/cloud/o365_dlp_rule_triggered.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules can be configured for any number of security, regulatory, or business compliance reasons, as such this analytic will only be as accurate as the upstream DLP configuration. Detections from this analytic should be evaluated thoroughly to de termine what, if any, security relevance the underlying DLP events contain.
 data_source:
     - Office 365 Universal Audit Log
-search: '`o365_management_activity` Operation=DLPRuleMatch | eval recipient = ''ExchangeMetaData.To{}'', signature_id = ''ExchangeMetaData.UniqueID'', signature = ''PolicyDetails{}.Rules{}.RuleName'' , src_user = UserId, reason =''PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName'', result=''PolicyDetails{}.Rules{}.Actions{}'', file_name=case(NOT match(''PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location'',"Message Body"),''PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location'') | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by action dest user src vendor_account vendor_product src_user recipient signature_id reason | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_dlp_rule_triggered_filter` '
+search: |
+    `o365_management_activity` Operation="DLPRuleMatch" | eval user=User, src_user=P2Sender, object=object, signature=DetectionMethod, object_name=object_name, file_path=SiteUrl, src=src, file_name=SourceFileName | stats count min(_time) as firstTime max(_time) as lastTime by Operation | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_dlp_rule_triggered_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must deploy DLP rules through O365 security and compliance functions.
 known_false_positives: WIll depending on accuracy of DLP rules, these can be noisy so tune appropriately.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -45,6 +46,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_elevated_mailbox_permission_assigned.yml b/detections/cloud/o365_elevated_mailbox_permission_assigned.yml
index c467b3f6a46..c25786b3608 100644
--- a/detections/cloud/o365_elevated_mailbox_permission_assigned.yml
+++ b/detections/cloud/o365_elevated_mailbox_permission_assigned.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic identifies the assignment of elevated mailbox permissions in an Office 365 environment via the Add-MailboxPermission operation. It leverages logs from the Exchange workload in the o365_management_activity data source, focusing on permissions such as FullAccess, ChangePermission, or ChangeOwner. This activity is significant as it indicates potential unauthorized access or control over mailboxes, which could lead to data exfiltration or privilege escalation. If confirmed malicious, attackers could gain extensive access to sensitive email data and potentially manipulate mailbox settings, posing a severe security risk.
 data_source:
     - O365 Add-MailboxPermission
-search: |-
-    `o365_management_activity` Workload=Exchange Operation=Add-MailboxPermission (AccessRights=FullAccess OR AccessRights=ChangePermission OR AccessRights=ChangeOwner)
-      | rename Identity AS dest_user
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           src vendor_account vendor_product
-           dest_user
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_elevated_mailbox_permission_assigned_filter`
+search: |
+    `o365_management_activity` Operation=Add-MailboxPermission Workload="Exchange" AccessRights IN ("FullAccess", "ChangePermission", "ChangeOwner") | eval dest_user=Identity | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_elevated_mailbox_permission_assigned_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: FullAccess mailbox delegation may be assigned for legitimate purposes, filter as needed.
 references:
@@ -34,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Elevated mailbox permissions were assigned on $dest_user$
     entity:
diff --git a/detections/cloud/o365_email_access_by_security_administrator.yml b/detections/cloud/o365_email_access_by_security_administrator.yml
index a78e4ac9abf..2d32ce5e2ea 100644
--- a/detections/cloud/o365_email_access_by_security_administrator.yml
+++ b/detections/cloud/o365_email_access_by_security_administrator.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic identifies when a user with sufficient access to O365 Security & Compliance portal uses premium investigation features (Threat Explorer) to directly view email. Adversaries may exploit privileged access with this premium feature to enumerate or exfiltrate sensitive data.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
-    `o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminMailAccess
-      | rename InternetMessageId as signature_id, UserId as src_user
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY signature dest user
-           src vendor_account vendor_product
-           src_user signature_id
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_email_access_by_security_administrator_filter`
+search: |
+    `o365_management_activity` Workload="SecurityComplianceCenter" Operation="AdminMailAccess" | eval user=User, src_user=P2Sender, object=object, signature=DetectionMethod, object_name=object_name, file_path=SiteUrl, src=src, file_name=SourceFileName | stats count min(_time) as firstTime max(_time) as lastTime by Workload Operation | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_access_by_security_administrator_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Threat Explorer is a premium feature with o365, logging may not be available with proper license.
 known_false_positives: Legitamate access by security administators for incident response measures.
 references:
@@ -32,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A security administrator $src_user$ accessed email messages for $user$
     entity:
@@ -63,6 +54,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_email_hard_delete_excessive_volume.yml b/detections/cloud/o365_email_hard_delete_excessive_volume.yml
index 30f35c5fa2a..adafdb20559 100644
--- a/detections/cloud/o365_email_hard_delete_excessive_volume.yml
+++ b/detections/cloud/o365_email_hard_delete_excessive_volume.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies when an O365 email account hard deletes an excessive number of emails within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to permanently purge a large amount of items from the mailbox. Threat actors may attempt to remove evidence of their activity by purging items from the compromised mailbox. --- Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
+search: |
     `o365_management_activity` Workload=Exchange (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions"))
     | eval user = lower(UserId), sender = lower(CASE(isnotnull(SendAsUserSmtp),SendAsUserSmtp,isnotnull(SendOnBehalfOfUserSmtp),SendOnBehalfOfUserSmtp,true(),MailboxOwnerUPN)), subject = trim(CASE(Operation IN ("Send","SendAs","SendOnBehalf"),'Item.Subject',Operation IN ("SoftDelete","HardDelete"),'AffectedItems{}.Subject')), -time = _time,file_name = CASE(Operation IN ("Send","SendAs","SendOnBehalf"),split('Item.Attachments',"; "),Operation IN ("SoftDelete","HardDelete"),split('AffectedItems{}.Attachments',"; ")), file_size = CASE(Operation IN ("Send","SendAs","SendOnBehalf"),round(tonumber('Item.SizeInBytes')/1024/1024,2),true(),round(tonumber(replace(file_name, "(.+)\s\((\d+)(b\)$)", "\2"))/1024/1024,2))
     | bin _time span=1hr
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate Email for $user$
       search: '`o365_management_activity` Workload=Exchange (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions")) AND UserId = "$user$"'
       earliest_offset: $info_min_time$
diff --git a/detections/cloud/o365_email_new_inbox_rule_created.yml b/detections/cloud/o365_email_new_inbox_rule_created.yml
index 593d4d94e71..aae28d617a5 100644
--- a/detections/cloud/o365_email_new_inbox_rule_created.yml
+++ b/detections/cloud/o365_email_new_inbox_rule_created.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies the creation of new email inbox rules in an Office 365 environment. It detects events logged under New-InboxRule and Set-InboxRule operations within the o365_management_activity data source, focusing on parameters that may indicate mail forwarding, removal, or obfuscation. Inbox rule creation is a typical end-user activity however attackers also leverage this technique for multiple reasons.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
+search: |
     `o365_management_activity` Workload=Exchange AND (Operation=New-InboxRule OR Operation=Set-InboxRule) Parameters{}.Name IN (SoftDeleteMessage,DeleteMessage,ForwardTo,ForwardAsAttachmentTo,RedirectTo,MoveToFolder,CopyToFolder)
     | eval file_path = mvappend(MoveToFolder,CopyToFolder), recipient=mvappend(ForwardTo, ForwardAsAttachmentTo, RedirectTo), user = lower(UserId), signature = Operation, src = if(match(ClientIP, "^\["), ltrim(mvindex(split(ClientIP, "]:"), 0), "["), mvindex(split(ClientIP,":"),0)), desc = Name, action = 'Parameters{}.Name'
 
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate Inbox Rules for $user$
       search: '`o365_management_activity` Workload=Exchange AND (Operation=New-InboxRule OR Operation=Set-InboxRule) AND UserId = "$user$"'
       earliest_offset: $info_min_time$
diff --git a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml
index 9b4d1e6d12c..861e4f5b382 100644
--- a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml
+++ b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml
@@ -6,13 +6,13 @@ modification_date: '2026-09-23'
 author: Steven Dick
 status: production
 type: TTP
-description: |-
-    The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period.
-    This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
+description: 'The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period.
+
+    This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.'
 data_source:
     - Office 365 Universal Audit Log
     - Office 365 Reporting Message Trace
-search: |-
+search: |
     `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*")
     | eval mailtime = _time
     | bin _time span=4hr
@@ -34,10 +34,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `o365_email_password_and_payroll_compromise_behavior_filter`
-how_to_implement: |-
-    You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
-known_false_positives: |-
-    No false positives have been identified at this time.
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://attack.mitre.org/techniques/T1114/
     - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
@@ -50,7 +48,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate Email for $user$
       search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*password*","*passcode*") recipient = "$user$"'
       earliest_offset: $info_min_time$
diff --git a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml
index 51c0ec9f307..c27719e8745 100644
--- a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml
+++ b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml
@@ -6,13 +6,13 @@ modification_date: '2026-09-23'
 author: Steven Dick
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period.
-    This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
+description: 'The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period.
+
+    This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.'
 data_source:
     - Office 365 Universal Audit Log
     - Office 365 Reporting Message Trace
-search: |-
+search: |
     `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*")
     | eval mailtime = _time
     | bin _time span=4hr
@@ -33,10 +33,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `o365_email_receive_and_hard_delete_takeover_behavior_filter`
-how_to_implement: |-
-    You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
-known_false_positives: |-
-    Possible new user/account onboarding processes.
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
+known_false_positives: Possible new user/account onboarding processes.
 references:
     - https://attack.mitre.org/techniques/T1114/
     - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
@@ -49,7 +47,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate Email for $user$
       search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") AND recipient = "$user$"'
       earliest_offset: $info_min_time$
diff --git a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml
index 9616815ae3f..5251f5f0c75 100644
--- a/detections/cloud/o365_email_reported_by_admin_found_malicious.yml
+++ b/detections/cloud/o365_email_reported_by_admin_found_malicious.yml
@@ -9,19 +9,8 @@ type: TTP
 description: The following analytic detects when an email manually submitted to Microsoft through the Security & Compliance portal is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by administrative users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
-    `o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminSubmission
-      | search RescanVerdict IN (Phish,Malware)
-      | rename Id as signature_id, SenderIP as src, Recipients{} as dest_user, P1Sender as src_user
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest user src
-           vendor_account vendor_product signature
-           signature_id dest_user src_user
-           Subject SubmissionContent
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_email_reported_by_admin_found_malicious_filter`
+search: |
+    `o365_management_activity` Workload="SecurityComplianceCenter" Operation="AdminSubmission" RescanVerdict IN ("Phish", "Malware") | eval user=User, src_user=P2Sender, object=object, signature=DetectionMethod, object_name=object_name, file_path=SiteUrl, src=src, file_name=SourceFileName | stats count min(_time) as firstTime max(_time) as lastTime by Workload Operation RescanVerdict Subject | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_reported_by_admin_found_malicious_filter`
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 known_false_positives: Administrators that submit known phishing training exercises.
 references:
@@ -34,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: O365 security admin $user$ manually reported a suspicious email from $src_user$
     entity:
@@ -61,6 +50,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_email_reported_by_user_found_malicious.yml b/detections/cloud/o365_email_reported_by_user_found_malicious.yml
index 97c3350c4c6..2a7a08513f9 100644
--- a/detections/cloud/o365_email_reported_by_user_found_malicious.yml
+++ b/detections/cloud/o365_email_reported_by_user_found_malicious.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects when an email submitted to Microsoft using the built-in report button in Outlook is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
+search: |
     `o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name="Email reported by user as*"
       | fromjson Data
       | rename _raw AS temp etps AS _raw
@@ -40,7 +40,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The user $user$ reported an email classified from $src_user$
     entity:
@@ -67,6 +67,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_email_security_feature_changed.yml b/detections/cloud/o365_email_security_feature_changed.yml
index 5ab2b07bdb1..196526b44cc 100644
--- a/detections/cloud/o365_email_security_feature_changed.yml
+++ b/detections/cloud/o365_email_security_feature_changed.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic identifies when specific O365 advanced security settings are altered within the Office 365 tenant. If an attacker successfully disables O365 security settings, they can operate within the tenant with reduced risk of detection. This can lead to unauthorized data access, data exfiltration, account compromise, or other malicious activities without leaving a detailed audit trail.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
-    `o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") Operation IN ("*AntiPhish*","*SafeLink*","*SafeAttachment*","*Malware*")
-      | rename Id as object_id, UserId as user, Operation as signature, ObjectId as object
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest user src
-           vendor_account vendor_product signature
-           object_id object
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_email_security_feature_changed_filter`
+search: |
+    `o365_management_activity` Workload="Exchange" Operation IN ("Set-*", "Disable-*", "New-*", "Remove-*") Operation IN ("*AntiPhish*", "*SafeLink*", "*SafeAttachment*", "*Malware*") | eval user=User, src_user=P2Sender, object=object, signature=DetectionMethod, object_name=object_name, file_path=SiteUrl, src=src, file_name=SourceFileName | stats count min(_time) as firstTime max(_time) as lastTime by Workload Operation | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_security_feature_changed_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Administrators might alter features for troubleshooting, performance reasons, or other administrative tasks. Filter as needed.
 references:
@@ -33,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An O365 security object [$object$] was altered by user $user$ using $signature$
     entity:
@@ -56,6 +47,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml
index 174bf25eb1c..652fd07f77c 100644
--- a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml
+++ b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml
@@ -6,14 +6,15 @@ modification_date: '2026-09-23'
 author: Steven Dick
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour).
+description: 'The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour).
+
     This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity.
-    This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner.
+
+    This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner.'
 data_source:
     - Office 365 Universal Audit Log
     - Office 365 Reporting Message Trace
-search: |-
+search: |
     `o365_messagetrace` status_code=Delivered
     | eval mailtime = _time
     | bin _time span=1hr
@@ -35,10 +36,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `o365_email_send_and_hard_delete_exfiltration_behavior_filter`
-how_to_implement: |-
-    You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
-known_false_positives: |-
-    Users that habitually/proactively cleaning the recoverable items folder may trigger this alert.
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
+known_false_positives: Users that habitually/proactively cleaning the recoverable items folder may trigger this alert.
 references:
     - https://attack.mitre.org/techniques/T1114/
     - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
@@ -51,7 +50,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate Email for $user$
       search: '`o365_management_activity` Workload=Exchange (Operation IN ("Send")) OR (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions")) AND UserId = "$user$"'
       earliest_offset: $info_min_time$
diff --git a/detections/cloud/o365_email_send_and_hard_delete_suspicious_behavior.yml b/detections/cloud/o365_email_send_and_hard_delete_suspicious_behavior.yml
index 3299e9e4d7b..32a9c1ebddf 100644
--- a/detections/cloud/o365_email_send_and_hard_delete_suspicious_behavior.yml
+++ b/detections/cloud/o365_email_send_and_hard_delete_suspicious_behavior.yml
@@ -9,17 +9,8 @@ type: Anomaly
 description: The following analytic identifies when an O365 email account sends and then hard deletes email with within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of activity. Threat actors often use this technique to prevent defenders and victims from knowing the account has been compromised. --- Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
-    `o365_management_activity` Workload=Exchange (Operation IN ("Send*")) OR (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions"))
-    | eval user = lower(UserId), sender = lower(CASE(isnotnull(SendAsUserSmtp),SendAsUserSmtp,isnotnull(SendOnBehalfOfUserSmtp),SendOnBehalfOfUserSmtp,true(),MailboxOwnerUPN)), subject = trim(CASE(Operation IN ("Send","SendAs","SendOnBehalf"),'Item.Subject',Operation IN ("SoftDelete","HardDelete"),'AffectedItems{}.Subject')), -time = _time,file_name = CASE(Operation IN ("Send","SendAs","SendOnBehalf"),split('Item.Attachments',"; "),Operation IN ("SoftDelete","HardDelete"),split('AffectedItems{}.Attachments',"; ")), file_size = CASE(Operation IN ("Send","SendAs","SendOnBehalf"),round(tonumber('Item.SizeInBytes')/1024/1024,2),true(),round(tonumber(replace(file_name, "(.+)\s\((\d+)(b\)$)", "\2"))/1024/1024,2))
-    | eval sendtime = CASE(Operation IN ("Send","SendAs","SendOnBehalf"),_time)
-    | eval deltime = CASE(Operation IN ("SoftDelete","HardDelete"),_time)
-    | stats values(sender) as sender, values(ClientIPAddress) as src, values(ClientInfoString) as http_user_agent, values(Operation) as signature, values(file_name) as file_name, sum(file_size) as file_size, values(Folder.Path) as file_path, min(sendtime) as firstTime, max(deltime) as lastTime, dc(Operation) as opcount, count by subject,user
-    | eval timediff = tonumber(lastTime) - tonumber(firstTime)
-    | where opcount > 1 AND firstTime < lastTime  AND timediff < 3600
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `o365_email_send_and_hard_delete_suspicious_behavior_filter`
+search: |
+    `o365_management_activity` (Workload="Exchange" Operation="Send*") OR (Operation="HardDelete" Folder.Path IN ("\\Sent Items", "\\Recoverable Items\\Deletions")) | eval user=User, src_user=P2Sender, object=object, signature=DetectionMethod, object_name=object_name, file_path=SiteUrl, src=src, file_name=SourceFileName | stats count min(_time) as firstTime max(_time) as lastTime by Workload Operation Path subject | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_send_and_hard_delete_suspicious_behavior_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Users that habitually/proactively cleaning the recoverable items folder may trigger this alert.
 references:
@@ -34,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate Email for $user$
       search: '`o365_management_activity` Workload=Exchange (Operation IN ("Send*")) OR (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions")) AND UserId = "$user$" AND "$subject$"'
       earliest_offset: $info_min_time$
diff --git a/detections/cloud/o365_email_send_attachments_excessive_volume.yml b/detections/cloud/o365_email_send_attachments_excessive_volume.yml
index 1616e1a2701..7225a1b54cb 100644
--- a/detections/cloud/o365_email_send_attachments_excessive_volume.yml
+++ b/detections/cloud/o365_email_send_attachments_excessive_volume.yml
@@ -6,14 +6,16 @@ modification_date: '2026-09-23'
 author: Steven Dick
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour).
+description: 'The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour).
+
     This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox.
+
     Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox.
-    Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
+
+    Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.'
 data_source:
     - Office 365 Universal Audit Log
-search: |-
+search: |
     `o365_messagetrace` status_code=Delivered
     | eval mailtime = _time
     | bin _time span=1hr
@@ -37,10 +39,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `o365_email_send_attachments_excessive_volume_filter`
-how_to_implement: |-
-    You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
-known_false_positives: |-
-    Users or processes that are send a large number of attachments may trigger this alert, adjust thresholds accordingly.
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
+known_false_positives: Users or processes that are send a large number of attachments may trigger this alert, adjust thresholds accordingly.
 references:
     - https://attack.mitre.org/techniques/T1114/
     - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
@@ -53,7 +53,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate Email for $user$
       search: '`o365_management_activity` Workload=Exchange (Operation IN ("Send*")) AND Item.Attachments=* AND UserId = "$user$"'
       earliest_offset: $info_min_time$
diff --git a/detections/cloud/o365_email_suspicious_behavior_alert.yml b/detections/cloud/o365_email_suspicious_behavior_alert.yml
index ca803a499b1..dadd034d17b 100644
--- a/detections/cloud/o365_email_suspicious_behavior_alert.yml
+++ b/detections/cloud/o365_email_suspicious_behavior_alert.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies when one of O365 the built-in security detections for suspicious email behaviors are triggered.  These alerts often indicate that an attacker may have compromised a mailbox within the environment. Any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities further enhance these detection and response functions.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
+search: |
     `o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name IN ("Suspicious email sending patterns detected","User restricted from sending email","Suspicious Email Forwarding Activity","Email sending limit exceeded")
       | fromjson Data
       | rename Name as signature, AlertId as signature_id, ObjectId as user
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The user $user$ triggered the O365 security alert [$signature$]
     entity:
@@ -57,6 +57,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_email_suspicious_search_behavior.yml b/detections/cloud/o365_email_suspicious_search_behavior.yml
index 4ee64bf9230..233d8f1b63d 100644
--- a/detections/cloud/o365_email_suspicious_search_behavior.yml
+++ b/detections/cloud/o365_email_suspicious_search_behavior.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies when Office 365 users search for suspicious keywords or have an excessive number of queries to a mailbox within a limited timeframe. This behavior may indicate that a malicious actor has gained control of a mailbox and is conducting discovery or enumeration activities.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
+search: |
     `o365_management_activity` Operation=SearchQueryInitiatedExchange
     | eval command = case(Operation=="SearchQueryPerformed",SearchQueryText,true(),QueryText), UserId = lower(UserId), signature_id = CorrelationId, signature=Operation, src = ClientIP, user = lower(UserId), object_name=case(Operation=="SearchQueryPerformed",'EventData',true(),QuerySource), -time = _time, suspect_terms = case(match(command, `o365_suspect_search_terms_regex`),command,true(),null())
     | where command != "*" AND command != "(*)"
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate search behavior by $user$
       search: '`o365_management_activity` AND Operation=SearchQueryInitiatedExchange AND UserId = "$user$"'
       earliest_offset: $info_min_time$
diff --git a/detections/cloud/o365_email_transport_rule_changed.yml b/detections/cloud/o365_email_transport_rule_changed.yml
index a24abed973f..2cccbe26d3a 100644
--- a/detections/cloud/o365_email_transport_rule_changed.yml
+++ b/detections/cloud/o365_email_transport_rule_changed.yml
@@ -9,14 +9,8 @@ type: Anomaly
 description: The following analytic identifies when a user with sufficient access to Exchange Online alters the mail flow/transport rule configuration of the organization. Transport rules are a set of rules that can be used by attackers to modify or delete emails based on specific conditions, this activity could indicate an attacker hiding or exfiltrated data.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
-    `o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") AND Operation="*TransportRule"
-    | eval object_name = case('Parameters{}.Name'=="Name",mvindex('Parameters{}.Value',mvfind('Parameters{}.Name',"^Name$")),true(),ObjectId), object_id = case('Parameters{}.Name'=="Identity",mvindex('Parameters{}.Value',mvfind('Parameters{}.Name',"^Identity$")),true(),Id)
-    | stats values(object_name) as object_name, min(_time) as firstTime, max(_time) as lastTime, count by object_id, UserId, Operation, signature
-    | rename UserId as user
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `o365_email_transport_rule_changed_filter`
+search: |
+    `o365_management_activity` Workload="Exchange" Operation IN ("Set-*", "Disable-*", "New-*", "Remove-*") Operation="*TransportRule" | eval user=User, src_user=P2Sender, object=object, signature=DetectionMethod, object_name=object_name, file_path=SiteUrl, src=src, file_name=SourceFileName | stats count min(_time) as firstTime max(_time) as lastTime by Workload Operation object_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_transport_rule_changed_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Legitimate administrative changes for business needs.
 references:
@@ -31,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate changes by $user$
       search: '`o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") AND Operation="*Transport*" UserId=$user$'
       earliest_offset: $info_min_time$
diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml
index ce73d6f26f1..bef471927fb 100644
--- a/detections/cloud/o365_excessive_authentication_failures_alert.yml
+++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic identifies an excessive number of authentication failures, including failed attempts against MFA prompt codes. It uses data from the `o365_management_activity` dataset, focusing on events where the authentication status is marked as failure. This behavior is significant as it may indicate a brute force attack or an attempt to compromise user accounts. If confirmed malicious, this activity could lead to unauthorized access, data breaches, or further exploitation within the environment.
 data_source: []
-search: |-
+search: |
     `o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure
       | stats count earliest(_time) AS firstTime latest(_time) AS lastTime values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS user_agent values(status) AS status values(src_ip) AS src values(signature) as signature
         BY user vendor_account vendor_product
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -54,6 +54,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/o365_brute_force_login/o365_brute_force_login.json
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml
index b234a53448e..10e2e53c59b 100644
--- a/detections/cloud/o365_excessive_sso_logon_errors.yml
+++ b/detections/cloud/o365_excessive_sso_logon_errors.yml
@@ -9,15 +9,8 @@ type: Anomaly
 description: The following analytic detects accounts experiencing a high number of Single Sign-On (SSO) logon errors. It leverages data from the `o365_management_activity` dataset, focusing on failed user login attempts with SSO errors. This activity is significant as it may indicate brute-force attempts or the hijacking/reuse of SSO tokens. If confirmed malicious, attackers could potentially gain unauthorized access to user accounts, leading to data breaches, privilege escalation, or further lateral movement within the organization.
 data_source:
     - O365 UserLoginFailed
-search: |-
-    `o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed
-      | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user
-        BY src vendor_account vendor_product
-           dest signature user_agent
-      | where count >= 5
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_excessive_sso_logon_errors_filter`
+search: |
+    `o365_management_activity` Operation=UserLoginFailed Workload="AzureActiveDirectory" LogonError="*Sso*" | eval user_agent=user_agent | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter`
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 known_false_positives: Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack.
 references:
@@ -30,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -56,6 +49,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors2.json
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_exfiltration_via_file_access.yml b/detections/cloud/o365_exfiltration_via_file_access.yml
index ca61b28e5ad..7030b785b7b 100644
--- a/detections/cloud/o365_exfiltration_via_file_access.yml
+++ b/detections/cloud/o365_exfiltration_via_file_access.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects when an excessive number of files are access from o365 by the same user over a short period of time. A malicious actor may abuse the "open in app" functionality of SharePoint through scripted or Graph API based access to evade triggering the FileDownloaded Event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be take with any Azure Guest (#EXT#) accounts.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
+search: |
     `o365_management_activity` Operation IN ("fileaccessed") UserId!=app@sharepoint NOT SourceFileExtension IN (bmp,png,jpeg,jpg)
     | eval user = replace(mvindex(split(lower(UserId),"#ext#"),0),"_","@"), user_flat = replace(UserId, "[^A-Za-z0-9]","_")
     | where NOT match(SiteUrl,user_flat)
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate file access by $user$
       search: '`o365_management_activity` Operation IN ("fileaccessed") UserId="$UserId$"'
       earliest_offset: $info_min_time$
diff --git a/detections/cloud/o365_exfiltration_via_file_download.yml b/detections/cloud/o365_exfiltration_via_file_download.yml
index 544f4cdf7de..d84df551498 100644
--- a/detections/cloud/o365_exfiltration_via_file_download.yml
+++ b/detections/cloud/o365_exfiltration_via_file_download.yml
@@ -9,15 +9,8 @@ type: Anomaly
 description: The following analytic detects when an excessive number of files are downloaded from o365 by the same user over a short period of time. O365 may bundle these files together as a ZIP file, however each file will have it's own download event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
-    `o365_management_activity` Operation IN ("filedownloaded")
-    | eval user = replace(mvindex(split(lower(UserId),"#ext#"),0),"_","@"), user_flat = replace(UserId, "[^A-Za-z0-9]","_")
-    | stats values(user) as user, latest(ClientIP) as src values(ZipFileName) as file_name, values(Operation) as signature, values(UserAgent) as http_user_agent, dc(SourceFileName) as count, min(_time) as firstTime, max(_time) as lastTime by Workload,UserId,SiteUrl
-    | rename SiteUrl as file_path,Workload as app
-    | where count > 50
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `o365_exfiltration_via_file_download_filter`
+search: |
+    `o365_management_activity` Operation="filedownloaded" | eval user=User, src_user=P2Sender, object=object, signature=DetectionMethod, object_name=object_name, file_path=SiteUrl, src=src, file_name=SourceFileName | stats count min(_time) as firstTime max(_time) as lastTime by Operation | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_exfiltration_via_file_download_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: It is possible that certain file download scenarios may trigger this alert, specifically OneDrive syncing. Adjust threshold and filtering as needed.
 references:
@@ -32,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate file downloads by $user$
       search: '`o365_management_activity` Operation IN ("filedownloaded") UserId="$UserId$"'
       earliest_offset: $info_min_time$
diff --git a/detections/cloud/o365_exfiltration_via_file_sync_download.yml b/detections/cloud/o365_exfiltration_via_file_sync_download.yml
index ff8f766b87a..80ff3d9fad8 100644
--- a/detections/cloud/o365_exfiltration_via_file_sync_download.yml
+++ b/detections/cloud/o365_exfiltration_via_file_sync_download.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects when an excessive number of files are sync from o365 by the same user over a short period of time. A malicious actor abuse the user-agent string through GUI or API access to evade triggering the FileDownloaded event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
-    `o365_management_activity` Operation IN ("filesyncdownload*") UserAgent="*SkyDriveSync*"
-    | eval user = replace(mvindex(split(lower(UserId),"#ext#"),0),"_","@"), user_flat = replace(UserId, "[^A-Za-z0-9]","_")
-    | where NOT match(SiteUrl,user_flat)
-    | stats values(user) as user, latest(ClientIP) as src values(ZipFileName) as file_name, values(Operation) as signature, values(UserAgent) as http_user_agent, dc(SourceFileName) as count, min(_time) as firstTime, max(_time) as lastTime by Workload,UserId,SiteUrl
-    | rename SiteUrl as file_path,Workload as app
-    | where count > 50
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `o365_exfiltration_via_file_sync_download_filter`
+search: |
+    `o365_management_activity` Operation="filesyncdownload*" UserAgent="*SkyDriveSync*" | eval user=User, src_user=P2Sender, object=object, signature=DetectionMethod, object_name=object_name, file_path=SiteUrl, src=src, file_name=SourceFileName | stats count min(_time) as firstTime max(_time) as lastTime by Operation UserAgent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_exfiltration_via_file_sync_download_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: It is possible that certain file sync scenarios may trigger this alert, specifically OneNote. Adjust threshold and filtering as needed.
 references:
@@ -33,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate file sync downloads by $user$
       search: '`o365_management_activity` Operation IN ("filesyncdownload*") UserId="$UserId$"'
       earliest_offset: $info_min_time$
diff --git a/detections/cloud/o365_external_guest_user_invited.yml b/detections/cloud/o365_external_guest_user_invited.yml
index 3e6a51c7928..42354564d14 100644
--- a/detections/cloud/o365_external_guest_user_invited.yml
+++ b/detections/cloud/o365_external_guest_user_invited.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies the invitation of an external guest user within Azure AD. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External Identities`. This detection leverages the Universal Audit Log (UAL)/o365:management:activity sourcetype as a detection data source.
 data_source:
     - Office 365 Universal Audit Log
-search: "`o365_management_activity` Workload=AzureActiveDirectory AND Operation=\"Add user*\" AND ModifiedProperties{}.NewValue=\"[*Guest*]\" AND ModifiedProperties{}.NewValue=\"[*Invitation*]\" | eval user = (mvindex('ModifiedProperties{}.NewValue',5)), src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | rex field=user \"(?<user> [ \\w\\.-]+@ [ \\w-]+\\. [ \\w-]{2,4})\" | rename Operation as signature, Id as signature_id | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature signature_id src_user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_external_guest_user_invited_filter`"
+search: |
+    `o365_management_activity` Workload=AzureActiveDirectory AND Operation="Add user*" AND ModifiedProperties{}.NewValue="[*Guest*]" AND ModifiedProperties{}.NewValue="[*Invitation*]" | eval user = (mvindex('ModifiedProperties{}.NewValue',5)), src_user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | rex field=user "(?<user> [ \w\.-]+@ [ \w-]+\. [ \w-]{2,4})" | rename Operation as signature, Id as signature_id | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product signature signature_id src_user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_external_guest_user_invited_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Administrator may legitimately invite external guest users. Filter as needed.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Azure Guest User $user$ invited by $src_user$
     entity:
@@ -53,6 +54,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/o365_azure_workload_events/o365_azure_workload_events.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_external_identity_policy_changed.yml b/detections/cloud/o365_external_identity_policy_changed.yml
index 98a3fb14094..262fdba98fa 100644
--- a/detections/cloud/o365_external_identity_policy_changed.yml
+++ b/detections/cloud/o365_external_identity_policy_changed.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies when changes are made to the external guest policies within Azure AD. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. This detection also attempts to highlight what may have changed. External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External Identities`.
 data_source:
     - Office 365 Universal Audit Log
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update policy.\" Target{}.ID=\"B2BManagementPolicy\" | eval object_attrs = mvindex('ModifiedProperties{}.NewValue',0), object_attrs_old = mvindex('ModifiedProperties{}.OldValue',0), object_name = mvindex('Target{}.ID',3), signature=Operation, user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"), mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | spath input=object_attrs_old output=B2BOld path={} | spath input=B2BOld | rename B2BManagementPolicy.* as B2BManagementPolicyOld.* | spath input=object_attrs output=B2BNew path={} | spath input=B2BNew | eval object_attrs = 'B2BManagementPolicy.InvitationsAllowedAndBlockedDomainsPolicy.AllowedDomains{}' , object_attrs_old = 'B2BManagementPolicyOld.InvitationsAllowedAndBlockedDomainsPolicy.AllowedDomains{}' | eval diff_add=mvmap(object_attrs,if(isnull(mvfind(object_attrs_old,object_attrs)),object_attrs,null)) | eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs,object_attrs_old)),object_attrs_old,null)) | eval result = case(isnotnull(diff_add),\"Added \".mvjoin(diff_add,\",\"),isnotnull(diff_remove),\"Removed \".mvjoin(diff_remove,\",\")), action = case(isnotnull(diff_add),\"created\",isnotnull(diff_remove),\"deleted\") | stats values(object_attrs) as object_attrs, values(action) as action, values(result) as result, values(B2BManagementPolicy*) as B2BManagementPolicy*, count, min(_time) as firstTime, max(_time) as lastTime by user signature object_name dest vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_external_identity_policy_changed_filter`"
+search: |
+    `o365_management_activity` Workload=AzureActiveDirectory Operation="Update policy." Target{}.ID="B2BManagementPolicy" | eval object_attrs = mvindex('ModifiedProperties{}.NewValue',0), object_attrs_old = mvindex('ModifiedProperties{}.OldValue',0), object_name = mvindex('Target{}.ID',3), signature=Operation, user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"), mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | spath input=object_attrs_old output=B2BOld path={} | spath input=B2BOld | rename B2BManagementPolicy.* as B2BManagementPolicyOld.* | spath input=object_attrs output=B2BNew path={} | spath input=B2BNew | eval object_attrs = 'B2BManagementPolicy.InvitationsAllowedAndBlockedDomainsPolicy.AllowedDomains{}' , object_attrs_old = 'B2BManagementPolicyOld.InvitationsAllowedAndBlockedDomainsPolicy.AllowedDomains{}' | eval diff_add=mvmap(object_attrs,if(isnull(mvfind(object_attrs_old,object_attrs)),object_attrs,null)) | eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs,object_attrs_old)),object_attrs_old,null)) | eval result = case(isnotnull(diff_add),"Added ".mvjoin(diff_add,","),isnotnull(diff_remove),"Removed ".mvjoin(diff_remove,",")), action = case(isnotnull(diff_add),"created",isnotnull(diff_remove),"deleted") | stats values(object_attrs) as object_attrs, values(action) as action, values(result) as result, values(B2BManagementPolicy*) as B2BManagementPolicy*, count, min(_time) as firstTime, max(_time) as lastTime by user signature object_name dest vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_external_identity_policy_changed_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Business approved changes by known administrators.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ changed the external identity [$object_name$] policy
     entity:
@@ -45,6 +46,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/o365_azure_workload_events/o365_azure_workload_events.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml b/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml
index ba713018407..0efc732a504 100644
--- a/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml
+++ b/detections/cloud/o365_file_permissioned_application_consent_granted_by_user.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies instances where a user in the Office 365 environment grants consent to an application requesting file permissions for OneDrive or SharePoint. It leverages O365 audit logs, focusing on OAuth application consent events. This activity is significant because granting such permissions can allow applications to access, modify, or delete files, posing a risk if the application is malicious or overly permissive. If confirmed malicious, this could lead to data breaches, data loss, or unauthorized data manipulation, necessitating immediate investigation to validate the application's legitimacy and assess potential risks.
 data_source:
     - O365 Consent to application.
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Consent to application.\" ResultStatus=Success | eval admin_consent =mvindex('ModifiedProperties{}.NewValue',0) | search admin_consent=False | eval permissions =mvindex('ModifiedProperties{}.NewValue',4) | rex field=permissions \"Scope:(?<Scope>[^,]+)\" | makemv delim=\" \" Scope | search Scope IN (\"Files.Read\", \"Files.Read.All\", \"Files.ReadWrite\", \"Files.ReadWrite.All\", \"Files.ReadWrite.AppFolder\") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by signature dest user src vendor_account vendor_product object ObjectId | `security_content_ctime(lastTime)` | `o365_file_permissioned_application_consent_granted_by_user_filter`"
+search: |
+    `o365_management_activity` Workload=AzureActiveDirectory Operation="Consent to application." ResultStatus=Success | eval admin_consent =mvindex('ModifiedProperties{}.NewValue',0) | search admin_consent=False | eval permissions =mvindex('ModifiedProperties{}.NewValue',4) | rex field=permissions "Scope:(?<Scope>[^,]+)" | makemv delim=" " Scope | search Scope IN ("Files.Read", "Files.Read.All", "Files.ReadWrite", "Files.ReadWrite.All", "Files.ReadWrite.AppFolder") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by signature dest user src vendor_account vendor_product object ObjectId | `security_content_ctime(lastTime)` | `o365_file_permissioned_application_consent_granted_by_user_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: OAuth applications that require file permissions may be legitimate, investigate and filter as needed.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ consented an OAuth application that requests file-related permissions.
     entity:
diff --git a/detections/cloud/o365_fullaccessasapp_permission_assigned.yml b/detections/cloud/o365_fullaccessasapp_permission_assigned.yml
index 915f860c3ea..27937860220 100644
--- a/detections/cloud/o365_fullaccessasapp_permission_assigned.yml
+++ b/detections/cloud/o365_fullaccessasapp_permission_assigned.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the assignment of the 'full_access_as_app' permission to an application registration in Office 365 Exchange Online. This detection leverages Office 365 management activity logs and filters Azure Active Directory workload events to identify when the specific permission, identified by GUID 'dc890d15-9560-4a4c-9b7f-a736ec74ec40', is granted. This activity is significant because it provides extensive control over Office 365 operations, including access to all mailboxes and the ability to send mail as any user. If confirmed malicious, this could lead to unauthorized data access, exfiltration, or account compromise. Immediate investigation is required.
 data_source:
     - O365 Update application.
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update application.\" | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) | spath input=newvalue | search \"{}.ResourceAppId\"=\"00000002-0000-0ff1-ce00-000000000000\"\"{}.RequiredAppPermissions{}.EntitlementId\"=\"dc890d15-9560-4a4c-9b7f-a736ec74ec40\" | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by signature dest user src vendor_account vendor_product object user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_fullaccessasapp_permission_assigned_filter`"
+search: |
+    `o365_management_activity` Workload=AzureActiveDirectory Operation="Update application." | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) | spath input=newvalue | search "{}.ResourceAppId"="00000002-0000-0ff1-ce00-000000000000""{}.RequiredAppPermissions{}.EntitlementId"="dc890d15-9560-4a4c-9b7f-a736ec74ec40" | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by signature dest user src vendor_account vendor_product object user_agent | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_fullaccessasapp_permission_assigned_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: The full_access_as_app API permission may be assigned to legitimate applications. Filter as needed.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ assigned the full_access_as_app permission to the app registration $object$
     entity:
diff --git a/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml b/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml
index 82d088729c4..75503daac37 100644
--- a/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml
+++ b/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies an O365 account experiencing more than 20 failed authentication attempts within 5 minutes. It uses O365 Unified Audit Logs, specifically "UserLoginFailed" events, to monitor and flag accounts exceeding this threshold. This activity is significant as it may indicate a brute force attack or password guessing attempt. If confirmed malicious, an attacker could gain unauthorized access to the O365 environment, potentially compromising sensitive emails, documents, and other data. Prompt investigation and action are crucial to prevent unauthorized access and data breaches.
 data_source:
     - O365 UserLoginFailed
-search: |-
+search: |
     `o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon Workload=AzureActiveDirectory
       | bucket span=5m _time
       | fillnull
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ failed to authenticate more than 10 times in the span of 5 minutes.
     entity:
diff --git a/detections/cloud/o365_high_privilege_role_granted.yml b/detections/cloud/o365_high_privilege_role_granted.yml
index 259ee9b053c..80c4cb8c9a7 100644
--- a/detections/cloud/o365_high_privilege_role_granted.yml
+++ b/detections/cloud/o365_high_privilege_role_granted.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects when high-privilege roles such as "Exchange Administrator," "SharePoint Administrator," or "Global Administrator" are granted within Office 365. It leverages O365 audit logs to identify events where these roles are assigned to any user or service account. This activity is significant for SOCs as these roles provide extensive permissions, allowing broad access and control over critical resources and data. If confirmed malicious, this could enable attackers to gain significant control over O365 resources, access, modify, or delete critical data, and compromise the overall security and functionality of the O365 environment.
 data_source:
     - O365 Add member to role.
-search: "`o365_management_activity` Operation=\"Add member to role.\" Workload=AzureActiveDirectory | eval role_id = mvindex('ModifiedProperties{}.NewValue',2) | eval role_name = mvindex('ModifiedProperties{}.NewValue',1) | where role_id IN (\"29232cdf-9323-42fd-ade2-1d097af3e4de\", \"f28a1f50-f6e7-4571-818b-6a12f2af6b6c\", \"62e90394-69f5-4237-9190-012177145e10\") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user src vendor_account vendor_product ObjectId role_name role_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_high_privilege_role_granted_filter`"
+search: |
+    `o365_management_activity` Operation=Add member to role. Workload="AzureActiveDirectory" | eval ObjectId=ObjectId | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_high_privilege_role_granted_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Privilege roles may be assigned for legitimate purposes, filter as needed.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $user$ granted high privilege roles to $ObjectId$
     entity:
diff --git a/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml b/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml
index a382e567042..cfc7c5ef704 100644
--- a/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml
+++ b/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies instances where a user grants consent to an application requesting mail-related permissions within the Office 365 environment. It leverages O365 audit logs, specifically focusing on events related to application permissions and user consent actions. This activity is significant as it can indicate potential security risks, such as data exfiltration or spear phishing, if malicious applications gain access. If confirmed malicious, this could lead to unauthorized data access, email forwarding, or sending malicious emails from the compromised account. Validating the legitimacy of the application and consent context is crucial to prevent data breaches.
 data_source:
     - O365 Consent to application.
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Consent to application.\" ResultStatus=Success | eval admin_consent =mvindex('ModifiedProperties{}.NewValue',0) | search admin_consent=False | eval permissions =mvindex('ModifiedProperties{}.NewValue',4) | rex field=permissions \"Scope:(?<Scope>[^,]+)\" | makemv delim=\" \" Scope | search Scope IN (\"Mail.Read\", \"Mail.ReadBasic\", \"Mail.ReadWrite\", \"Mail.Read.Shared\", \"Mail.ReadWrite.Shared\", \"Mail.Send\", \"Mail.Send.Shared\") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by signature dest user src vendor_account vendor_product object ObjectId | `security_content_ctime(lastTime)` | `o365_mail_permissioned_application_consent_granted_by_user_filter`"
+search: |
+    `o365_management_activity` Workload=AzureActiveDirectory Operation="Consent to application." ResultStatus=Success | eval admin_consent =mvindex('ModifiedProperties{}.NewValue',0) | search admin_consent=False | eval permissions =mvindex('ModifiedProperties{}.NewValue',4) | rex field=permissions "Scope:(?<Scope>[^,]+)" | makemv delim=" " Scope | search Scope IN ("Mail.Read", "Mail.ReadBasic", "Mail.ReadWrite", "Mail.Read.Shared", "Mail.ReadWrite.Shared", "Mail.Send", "Mail.Send.Shared") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by signature dest user src vendor_account vendor_product object ObjectId | `security_content_ctime(lastTime)` | `o365_mail_permissioned_application_consent_granted_by_user_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: OAuth applications that require mail permissions may be legitimate, investigate and filter as needed.
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ consented an OAuth application that requests mail-related permissions.
     entity:
diff --git a/detections/cloud/o365_mailbox_email_forwarding_enabled.yml b/detections/cloud/o365_mailbox_email_forwarding_enabled.yml
index 9ac83f29f6b..d5166b5d337 100644
--- a/detections/cloud/o365_mailbox_email_forwarding_enabled.yml
+++ b/detections/cloud/o365_mailbox_email_forwarding_enabled.yml
@@ -8,7 +8,8 @@ status: production
 type: TTP
 description: The following analytic identifies instances where email forwarding has been enabled on mailboxes within an Office 365 environment. It detects this activity by monitoring the Set-Mailbox operation within the o365_management_activity logs, specifically looking for changes to the ForwardingAddress or ForwardingSmtpAddress parameters. This activity is significant as unauthorized email forwarding can lead to data exfiltration and unauthorized access to sensitive information. If confirmed malicious, attackers could intercept and redirect emails, potentially compromising confidential communications and leading to data breaches.
 data_source: []
-search: "`o365_management_activity` Operation=Set-Mailbox | eval match1=mvfind('Parameters{}.Name',\"ForwardingAddress\") | eval match2=mvfind('Parameters{}.Name', \"ForwardingSmtpAddress\") | where match1>= 0 OR match2>= 0 | eval ForwardTo=coalesce(ForwardingAddress,ForwardingSmtpAddress) | search ForwardTo!=\"\" | rename user_id as user | stats count earliest(_time) as firstTime latest(_time) as lastTime values(ForwardTo) as ForwardTo by signature dest user src vendor_account vendor_product object ObjectId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_email_forwarding_enabled_filter`"
+search: |
+    `o365_management_activity` Operation=Set-Mailbox | eval match1=mvfind('Parameters{}.Name',"ForwardingAddress") | eval match2=mvfind('Parameters{}.Name', "ForwardingSmtpAddress") | where match1>= 0 OR match2>= 0 | eval ForwardTo=coalesce(ForwardingAddress,ForwardingSmtpAddress) | search ForwardTo!="" | rename user_id as user | stats count earliest(_time) as firstTime latest(_time) as lastTime values(ForwardTo) as ForwardTo by signature dest user src vendor_account vendor_product object ObjectId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_email_forwarding_enabled_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Email forwarding may be configured for legitimate purposes, filter as needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Email forwarding configured by $user$ on mailbox $ObjectId$
     entity:
@@ -44,6 +45,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.003/o365_mailbox_forwarding_enabled/o365_mailbox_forwarding_enabled.json
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml b/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml
index d9f7ba618a4..67fc02d696c 100644
--- a/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml
+++ b/detections/cloud/o365_mailbox_folder_read_permission_assigned.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies instances where read permissions are assigned to mailbox folders within an Office 365 environment. It leverages the `o365_management_activity` data source, specifically monitoring the `ModifyFolderPermissions` and `AddFolderPermissions` operations, while excluding Calendar, Contacts, and PersonMetadata objects. This activity is significant as unauthorized read permissions can lead to data exposure and potential information leakage. If confirmed malicious, an attacker could gain unauthorized access to sensitive emails, leading to data breaches and compromising the confidentiality of organizational communications.
 data_source:
     - O365 ModifyFolderPermissions
-search: "`o365_management_activity` Workload=Exchange (Operation=ModifyFolderPermissions OR Operation=AddFolderPermissions) Workload=Exchange object!=Calendar object!=Contacts object!=PersonMetadata | eval isReadRole=if(match('Item.ParentFolder.MemberRights',\"(ReadAny)\"), \"true\", \"false\") | rename UserId as user | stats count earliest(_time) as firstTime latest(_time) as lastTime by signature user object dest Item.ParentFolder.MemberUpn Item.ParentFolder.MemberRights src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_folder_read_permission_assigned_filter`"
+search: |
+    `o365_management_activity` Operation=ModifyFolderPermissions Workload="Exchange" Operation="AddFolderPermissions" Workload="Exchange" NOT object="Calendar" NOT object="Contacts" NOT object="PersonMetadata" | eval MailboxOwnerUPN=MailboxOwnerUPN | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_folder_read_permission_assigned_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Mailbox folder permissions may be configured for legitimate purposes, filter as needed.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A folder was granted read permission by $user$
     entity:
diff --git a/detections/cloud/o365_mailbox_folder_read_permission_granted.yml b/detections/cloud/o365_mailbox_folder_read_permission_granted.yml
index 38c40a7816e..ad2199911a7 100644
--- a/detections/cloud/o365_mailbox_folder_read_permission_granted.yml
+++ b/detections/cloud/o365_mailbox_folder_read_permission_granted.yml
@@ -9,20 +9,8 @@ type: TTP
 description: The following analytic identifies instances where read permissions are granted to mailbox folders within an Office 365 environment. It detects this activity by monitoring the `o365_management_activity` data source for the `Set-MailboxFolderPermission` and `Add-MailboxFolderPermission` operations. This behavior is significant as it may indicate unauthorized access or changes to mailbox folder permissions, potentially exposing sensitive email content. If confirmed malicious, an attacker could gain unauthorized access to read email communications, leading to data breaches or information leakage.
 data_source:
     - O365 ModifyFolderPermissions
-search: |-
-    `o365_management_activity`
-    Workload=Exchange
-    Operation IN ("Set-MailboxFolderPermission", "Add-MailboxFolderPermission")
-    | eval isReadRole=if(match(AccessRights,"^(ReadItems|Author|NonEditingAuthor|Owner|PublishingAuthor|Reviewer)$"), "true", "false")
-    | search isReadRole="true"
-    | rename UserId as user
-    | fillnull
-    | stats count min(_time) as firstTime max(_time) as lastTime
-      by signature dest user src vendor_account
-         vendor_product Identity AccessRights
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `o365_mailbox_folder_read_permission_granted_filter`
+search: |
+    `o365_management_activity` Operation=ModifyFolderPermissions Workload="Exchange" Operation IN ("Set-MailboxFolderPermission", "Add-MailboxFolderPermission") isReadRole="true" | eval MailboxOwnerUPN=MailboxOwnerUPN | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_folder_read_permission_granted_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Mailbox folder permissions may be configured for legitimate purposes, filter as needed.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A folder was granted read permission by $user$
     entity:
diff --git a/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml b/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml
index d9d49e15f10..c7a1fcde871 100644
--- a/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml
+++ b/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects instances where the inbox folder of an Office 365 mailbox is shared with all users within the tenant. It leverages Office 365 management activity events to identify when the 'Inbox' folder permissions are modified to include 'Everyone' with read rights. This activity is significant as it represents a potential security risk, allowing unauthorized access to sensitive emails. If confirmed malicious, this could lead to data breaches, exfiltration of confidential information, and further compromise through spear-phishing or other malicious activities based on the accessed email content.
 data_source:
     - O365 ModifyFolderPermissions
-search: "`o365_management_activity` Operation=ModifyFolderPermissions Workload=Exchange object=Inbox Item.ParentFolder.MemberUpn=Everyone | eval isReadRole=if(match('Item.ParentFolder.MemberRights',\"(ReadAny)\"), \"true\", \"false\") | search isReadRole = \"true\" | rename UserId as user | fillnull | stats count earliest(_time) as firstTime latest(_time) as lastTime by signature, user, dest, vendor_account, vendor_product, object, MailboxOwnerUPN, Item.ParentFolder.MemberUpn, Item.ParentFolder.MemberRights, src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_inbox_folder_shared_with_all_users_filter`"
+search: |
+    `o365_management_activity` Operation=ModifyFolderPermissions Workload="Exchange" object="Inbox" Item.ParentFolder.MemberUpn="Everyone" isReadRole="true" | eval MailboxOwnerUPN=MailboxOwnerUPN | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_inbox_folder_shared_with_all_users_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Administrators might temporarily share a mailbox with all users for legitimate reasons, such as troubleshooting, migrations, or other administrative tasks. Some organizations use shared mailboxes for teams or departments where multiple users need access to the same mailbox. Filter as needed.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$MailboxOwnerUPN$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$MailboxOwnerUPN$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Inbox folder for the $MailboxOwnerUPN$ mailbox was shared with all users.
     entity:
diff --git a/detections/cloud/o365_mailbox_read_access_granted_to_application.yml b/detections/cloud/o365_mailbox_read_access_granted_to_application.yml
index 2d7d7262bb5..bc5a6c38555 100644
--- a/detections/cloud/o365_mailbox_read_access_granted_to_application.yml
+++ b/detections/cloud/o365_mailbox_read_access_granted_to_application.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies instances where the Mail.Read Graph API permissions are granted to an application registration within an Office 365 tenant. It leverages O365 audit logs, specifically events related to changes in application permissions within the AzureActiveDirectory workload. This activity is significant because the Mail.Read permission allows applications to access and read all emails within a user's mailbox, which often contain sensitive or confidential information. If confirmed malicious, this could lead to data exfiltration, spear-phishing attacks, or further compromise based on the information gathered from the emails.
 data_source:
     - O365 Update application.
-search: "`o365_management_activity` Operation=\"Update application.\" | eval json_data=mvindex('ModifiedProperties{}.NewValue',0) | eval json_data=replace(json_data,\"^\\[\\s*\",\"\") | eval json_data=replace(json_data,\"\\s*\\]$\",\"\") | spath input=json_data path=RequiredAppPermissions{}.EntitlementId output=EntitlementIds | eval match_found=mvfind(EntitlementIds, \"810c84a8-4a9e-49e6-bf7d-12d183f40d01\") | where isnotnull(match_found) | fillnull | stats count earliest(_time) as firstTime max(_time) as lastTime values(EntitlementIds) as EntitlementIds by signature, user, dest, vendor_account, vendor_product, object, src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_read_access_granted_to_application_filter`"
+search: |
+    `o365_management_activity` Operation="Update application." | eval json_data=mvindex('ModifiedProperties{}.NewValue',0) | eval json_data=replace(json_data,"^\[\s*","") | eval json_data=replace(json_data,"\s*\]$","") | spath input=json_data path=RequiredAppPermissions{}.EntitlementId output=EntitlementIds | eval match_found=mvfind(EntitlementIds, "810c84a8-4a9e-49e6-bf7d-12d183f40d01") | where isnotnull(match_found) | fillnull | stats count earliest(_time) as firstTime max(_time) as lastTime values(EntitlementIds) as EntitlementIds by signature, user, dest, vendor_account, vendor_product, object, src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_read_access_granted_to_application_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: There are legitimate scenarios in wich an Application registrations requires Mailbox read access. Filter as needed.
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Application registration $object$ was grandes mailbox read access by $user$
     entity:
diff --git a/detections/cloud/o365_multi_source_failed_authentications_spike.yml b/detections/cloud/o365_multi_source_failed_authentications_spike.yml
index 1f71a5b140e..605c4dae904 100644
--- a/detections/cloud/o365_multi_source_failed_authentications_spike.yml
+++ b/detections/cloud/o365_multi_source_failed_authentications_spike.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic identifies a spike in failed authentication attempts within an Office 365 environment, indicative of a potential distributed password spraying attack. It leverages UserLoginFailed events from O365 Management Activity logs, focusing on ErrorNumber 50126. This detection is significant as it highlights attempts to bypass security controls using multiple IP addresses and user agents. If confirmed malicious, this activity could lead to unauthorized access, data breaches, privilege escalation, and lateral movement within the organization. Early detection is crucial to prevent account takeovers and mitigate subsequent threats.
 data_source:
     - O365 UserLoginFailed
-search: |-
+search: |
     `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed ErrorNumber=50126
       | bucket span=5m _time
       | eval uniqueIPUserCombo = src_ip . "-" . user
diff --git a/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml b/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml
index 75b7db803ee..de4012eecef 100644
--- a/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml
+++ b/detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml
@@ -10,7 +10,7 @@ description: The following analytic identifies unusual authentication activity i
 data_source:
     - O365 UserLoggedIn
     - O365 UserLoginFailed
-search: |-
+search: |
     `o365_management_activity` Workload=AzureActiveDirectory (Operation=UserLoggedIn OR Operation=UserLoginFailed)
       | bucket span=5m _time
       | stats dc(_raw) as failed_attempts dc(ApplicationId) as unique_app_ids dc(UserAgent) as unique_user_agents values(ApplicationId) values(OS) values(signature) as signature
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml
index b4a10201564..2c65f3848ba 100644
--- a/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml
+++ b/detections/cloud/o365_multiple_failed_mfa_requests_for_user.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies potential "MFA fatigue" attacks targeting Office 365 users by detecting more than nine Multi-Factor Authentication (MFA) prompts within a 10-minute timeframe. It leverages O365 management activity logs, focusing on Azure Active Directory events with the UserLoginFailed operation, a Success ResultStatus, and an ErrorNumber of 500121. This activity is significant as attackers may exploit MFA fatigue to gain unauthorized access by overwhelming users with repeated MFA requests. If confirmed malicious, this could lead to data breaches, unauthorized data access, or further compromise within the O365 environment. Immediate investigation is crucial.
 data_source:
     - O365 UserLoginFailed
-search: |-
+search: |
     `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed ResultStatus=Success ErrorNumber=500121
       | bucket span=10m _time
       | stats dc(_raw) as mfa_prompts values(LogonError) as LogonError values(signature) as signature values(action) as action values(src) as src
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Multiple failed MFA requestes for $user$
     entity:
diff --git a/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml b/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml
index a5bcb911a2b..30e2070c83e 100644
--- a/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml
+++ b/detections/cloud/o365_multiple_mailboxes_accessed_via_api.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects when a high number of Office 365 Exchange mailboxes are accessed via API (Microsoft Graph API or Exchange Web Services) within a short timeframe. It leverages 'MailItemsAccessed' operations in Exchange, using AppId and regex to identify API interactions. This activity is significant as it may indicate unauthorized mass email access, potentially signaling data exfiltration or account compromise. If confirmed malicious, attackers could gain access to sensitive information, leading to data breaches and further exploitation of compromised accounts. The threshold is set to flag over five unique mailboxes accessed within 10 minutes, but should be tailored to your environment.
 data_source:
     - O365 MailItemsAccessed
-search: |-
+search: |
     `o365_management_activity` Workload=Exchange Operation=MailItemsAccessed AppId=* ClientAppId=*
       | bucket span=10m _time
       | eval matchRegex=if(match(ClientInfoString,"^Client=WebServices;ExchangeWebServices"), 1, 0)
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An Oauth application identified with id $ClientAppId$ accessed multiple mailboxes in a short period of time via an API.
     entity:
diff --git a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml
index aabf6429740..c11d689355a 100644
--- a/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml
+++ b/detections/cloud/o365_multiple_os_vendors_authenticating_from_user.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies when multiple operating systems are used to authenticate to Azure/EntraID/Office 365 by the same user account over a short period of time. This activity could be indicative of attackers enumerating various logon capabilities of Azure/EntraID/Office 365 and attempting to discover weaknesses in the organizational MFA or conditional access configurations. Usage of the tools like "MFASweep" will trigger this detection.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
+search: |
     `o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn)
     | eval -time = _time
     | bin _time span=15m
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate logons from $user$
       search: '`o365_management_activity` Operation IN (UserLoginFailed,UserLoggedIn) "$user$"'
       earliest_offset: $info_min_time$
diff --git a/detections/cloud/o365_multiple_service_principals_created_by_sp.yml b/detections/cloud/o365_multiple_service_principals_created_by_sp.yml
index 772fcc038c8..bc50d43333e 100644
--- a/detections/cloud/o365_multiple_service_principals_created_by_sp.yml
+++ b/detections/cloud/o365_multiple_service_principals_created_by_sp.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic identifies instances where a single service principal creates more than three unique OAuth applications within a 10-minute timeframe. It leverages O365 logs from the Unified Audit Log, focusing on the 'Add service principal' operation in the Office 365 Azure Active Directory environment. This activity is significant as it may indicate a compromised or malicious service principal attempting to expand control or access within the network. If confirmed malicious, this could lead to unauthorized access and potential lateral movement within the environment, posing a significant security risk.
 data_source:
     - O365 Add service principal.
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add service principal.\" | bucket span=10m _time | eval len=mvcount('Actor{}.ID') | eval userType = mvindex('Actor{}.ID',len-1) | search userType = \"ServicePrincipal\" | eval displayName = object | fillnull | stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps values(user) as user values(src) as src by src_user vendor_account vendor_product dest signature | where unique_apps > 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_multiple_service_principals_created_by_sp_filter`"
+search: |
+    `o365_management_activity` Workload=AzureActiveDirectory Operation="Add service principal." | bucket span=10m _time | eval len=mvcount('Actor{}.ID') | eval userType = mvindex('Actor{}.ID',len-1) | search userType = "ServicePrincipal" | eval displayName = object | fillnull | stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps values(user) as user values(src) as src by src_user vendor_account vendor_product dest signature | where unique_apps > 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_multiple_service_principals_created_by_sp_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Certain users or applications may create multiple service principals in a short period of time for legitimate purposes. Filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src_user
diff --git a/detections/cloud/o365_multiple_service_principals_created_by_user.yml b/detections/cloud/o365_multiple_service_principals_created_by_user.yml
index 6de7224b9b0..00b6c9da44a 100644
--- a/detections/cloud/o365_multiple_service_principals_created_by_user.yml
+++ b/detections/cloud/o365_multiple_service_principals_created_by_user.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic identifies instances where a single user creates more than three unique OAuth applications within a 10-minute window in the Office 365 environment. It leverages O365 logs from the Unified Audit Log, focusing on the 'Add service principal' operation in Azure Active Directory. This activity is significant as it may indicate a compromised user account or unauthorized actions, potentially leading to broader network infiltration or privilege escalation. If confirmed malicious, this behavior could allow attackers to gain persistent access, escalate privileges, or exfiltrate sensitive information.
 data_source:
     - O365 Add service principal.
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add service principal.\" | bucket span=10m _time | eval len=mvcount('Actor{}.ID') | eval userType = mvindex('Actor{}.ID',len-1) | search userType = \"User\" | eval displayName = object | stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps values(user) as user values(src) as src by src_user vendor_account vendor_product dest signature | where unique_apps > 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_multiple_service_principals_created_by_user_filter`"
+search: |
+    `o365_management_activity` Workload=AzureActiveDirectory Operation="Add service principal." | bucket span=10m _time | eval len=mvcount('Actor{}.ID') | eval userType = mvindex('Actor{}.ID',len-1) | search userType = "User" | eval displayName = object | stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps values(user) as user values(src) as src by src_user vendor_account vendor_product dest signature | where unique_apps > 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_multiple_service_principals_created_by_user_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Certain users or applications may create multiple service principals in a short period of time for legitimate purposes. Filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src_user
diff --git a/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml
index d3d38fe74bb..85dbeab7d24 100644
--- a/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml
+++ b/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies instances where more than 10 unique user accounts fail to authenticate from a single IP address within a 5-minute window. This detection leverages O365 audit logs, specifically Azure Active Directory login failures (AzureActiveDirectoryStsLogon). Such activity is significant as it may indicate brute-force attacks or password spraying attempts. If confirmed malicious, this behavior suggests an external entity is attempting to breach security by targeting multiple accounts, potentially leading to unauthorized access. Immediate action is required to block or monitor the suspicious IP and notify affected users to enhance their security measures.
 data_source:
     - O365 UserLoginFailed
-search: |-
+search: |
     `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed ErrorNumber=50126
       | bucket span=5m _time
       | fillnull
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Source Ip $src$ failed to authenticate with 20 users within 5 minutes.
     entity:
diff --git a/detections/cloud/o365_new_email_forwarding_rule_created.yml b/detections/cloud/o365_new_email_forwarding_rule_created.yml
index f8c7e20f139..babf2bed603 100644
--- a/detections/cloud/o365_new_email_forwarding_rule_created.yml
+++ b/detections/cloud/o365_new_email_forwarding_rule_created.yml
@@ -8,7 +8,8 @@ status: production
 type: TTP
 description: The following analytic identifies the creation of new email forwarding rules in an Office 365 environment. It detects events logged under New-InboxRule and Set-InboxRule operations within the o365_management_activity data source, focusing on parameters like ForwardTo, ForwardAsAttachmentTo, and RedirectTo. This activity is significant as unauthorized email forwarding can lead to data exfiltration and unauthorized access to sensitive information. If confirmed malicious, attackers could intercept and redirect emails, potentially compromising confidential communications and leading to data breaches.
 data_source: []
-search: "`o365_management_activity` (Operation=New-InboxRule OR Operation=set-InboxRule) | eval match1=mvfind('Parameters{}.Name', \"ForwardTo\") | eval match2=mvfind('Parameters{}.Name', \"ForwardAsAttachmentTo\") | eval match3=mvfind('Parameters{}.Name', \"RedirectTo\") | where match1>= 0 OR match2>= 0 OR match3>= 0 | eval ForwardTo=coalesce(ForwardTo, ForwardAsAttachmentTo, RedirectTo) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(Name) as Name by signature dest user src vendor_account vendor_product ForwardTo | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_email_forwarding_rule_created_filter`"
+search: |
+    `o365_management_activity` (Operation=New-InboxRule OR Operation=set-InboxRule) | eval match1=mvfind('Parameters{}.Name', "ForwardTo") | eval match2=mvfind('Parameters{}.Name', "ForwardAsAttachmentTo") | eval match3=mvfind('Parameters{}.Name', "RedirectTo") | where match1>= 0 OR match2>= 0 OR match3>= 0 | eval ForwardTo=coalesce(ForwardTo, ForwardAsAttachmentTo, RedirectTo) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(Name) as Name by signature dest user src vendor_account vendor_product ForwardTo | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_email_forwarding_rule_created_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Users may create email forwarding rules for legitimate purposes. Filter as needed.
 references:
@@ -21,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A forwarding email inbox rule was created for $user$
     entity:
@@ -43,6 +44,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.003/o365_email_forwarding_rule_created/o365_email_forwarding_rule_created.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_new_email_forwarding_rule_enabled.yml b/detections/cloud/o365_new_email_forwarding_rule_enabled.yml
index bc4a793a238..3003d8ebba8 100644
--- a/detections/cloud/o365_new_email_forwarding_rule_enabled.yml
+++ b/detections/cloud/o365_new_email_forwarding_rule_enabled.yml
@@ -8,7 +8,8 @@ status: production
 type: TTP
 description: The following analytic identifies the creation of new email forwarding rules in an Office 365 environment via the UpdateInboxRules operation. It leverages Office 365 management activity events to detect rules that forward emails to external recipients by examining the OperationProperties for specific forwarding actions. This activity is significant as it may indicate unauthorized email redirection, potentially leading to data exfiltration. If confirmed malicious, attackers could intercept sensitive communications, leading to data breaches and information leakage.
 data_source: []
-search: "`o365_management_activity` Workload=Exchange Operation=UpdateInboxRules | eval match1=mvfind('OperationProperties{}.Value', \"ForwardToRecipientsAction\") | eval match2=mvfind('OperationProperties{}.Value', \"ForwardAsAttachmentToRecipientsAction\") | eval match3=mvfind('OperationProperties{}.Value', \"RedirectToRecipientsAction\") | eval index = mvfind('OperationProperties{}.Name', \"ServerRule\") | where match1>=0 OR match2>= 0 OR match3>= 0 | eval ServerRule = mvindex('OperationProperties{}.Value',index-1) | spath input=ServerRule path=Actions{}.Recipients{}.Values{}.Value output=valueExtracted | mvexpand valueExtracted | search valueExtracted=\"*@*.*\" | eval ForwardTo=if(match(valueExtracted,\"^[^@]+@[^@]+\\\\.[^@]+$\"), valueExtracted, null) | dedup ForwardTo | where isnotnull(ForwardTo) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(Name) as Name by signature dest user src vendor_account vendor_product ForwardTo | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_email_forwarding_rule_enabled_filter`"
+search: |
+    `o365_management_activity` Workload=Exchange Operation=UpdateInboxRules | eval match1=mvfind('OperationProperties{}.Value', "ForwardToRecipientsAction") | eval match2=mvfind('OperationProperties{}.Value', "ForwardAsAttachmentToRecipientsAction") | eval match3=mvfind('OperationProperties{}.Value', "RedirectToRecipientsAction") | eval index = mvfind('OperationProperties{}.Name', "ServerRule") | where match1>=0 OR match2>= 0 OR match3>= 0 | eval ServerRule = mvindex('OperationProperties{}.Value',index-1) | spath input=ServerRule path=Actions{}.Recipients{}.Values{}.Value output=valueExtracted | mvexpand valueExtracted | search valueExtracted="*@*.*" | eval ForwardTo=if(match(valueExtracted,"^[^@]+@[^@]+\\.[^@]+$"), valueExtracted, null) | dedup ForwardTo | where isnotnull(ForwardTo) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(Name) as Name by signature dest user src vendor_account vendor_product ForwardTo | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_email_forwarding_rule_enabled_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Users may create email forwarding rules for legitimate purposes. Filter as needed.
 references:
@@ -21,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A forwarding email inbox rule was created for $user$
     entity:
@@ -43,6 +44,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.003/o365_email_forwarding_rule_created/o365_email_forwarding_rule_created.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml
index 59ddcf2484e..08e61254ade 100644
--- a/detections/cloud/o365_new_federated_domain_added.yml
+++ b/detections/cloud/o365_new_federated_domain_added.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic identifies the addition of a new federated domain in an Office 365 environment. This behavior is detected by analyzing Office 365 management activity logs, specifically filtering for Workload=Exchange and Operation="Add-FederatedDomain". The addition of a new federated domain is significant as it may indicate unauthorized changes or potential compromises. If confirmed malicious, attackers could establish a backdoor, bypass security measures, or exfiltrate data, leading to data breaches and unauthorized access to sensitive information. Immediate investigation is required to review the details of the added domain and any concurrent suspicious activities.
 data_source:
     - O365
-search: |-
-    `o365_management_activity` Operation IN ("*add*", "*new*") AND Operation="*domain*"
-      | eval src="NA"
-      | fillnull
-      | stats count values(ModifiedProperties{}.NewValue) as new_value
-        BY user user_agent authentication_service
-           signature Workload src
-           vendor_account vendor_product dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_new_federated_domain_added_filter`
+search: |
+    `o365_management_activity` Operation IN ("*add*", "*new*") Operation="*domain*" | eval user=User, new_value='ModifiedProperties{}.NewValue', signature=signature, Severity=Severity | stats count min(_time) as firstTime max(_time) as lastTime by Operation | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_federated_domain_added_filter`
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity.
 known_false_positives: The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.
 references:
@@ -36,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has added a new federated domain $new_value$
     entity:
@@ -59,6 +50,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain_added/o365_add_federated_domain.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml b/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml
index b11a73cf9fb..5099ac282a6 100644
--- a/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml
+++ b/detections/cloud/o365_new_forwarding_mailflow_rule_created.yml
@@ -8,7 +8,8 @@ status: production
 type: TTP
 description: The following analytic detects the creation of new mail flow rules in Office 365 that may redirect or copy emails to unauthorized or external addresses. It leverages Office 365 Management Activity logs, specifically querying for the "New-TransportRule" operation and parameters like "BlindCopyTo", "CopyTo", and "RedirectMessageTo". This activity is significant as it can indicate potential data exfiltration or unauthorized access to sensitive information. If confirmed malicious, attackers could intercept or redirect email communications, leading to data breaches or information leakage.
 data_source: []
-search: "`o365_management_activity` Workload=Exchange Operation=\"New-TransportRule\" | eval match1=mvfind('Parameters{}.Name',\"BlindCopyTo\") | eval match2=mvfind('Parameters{}.Name',\"CopyTo\") | eval match3=mvfind('Parameters{}.Name', \"RedirectMessageTo\") | where match1>= 0 OR match2>= 0 OR match3>=0 | eval ForwardTo=coalesce(BlindCopyTo, CopyTo, RedirectMessageTo) | search ForwardTo!=\"\" | rename UserId as user | fillnull | stats count earliest(_time) as firstTime latest(_time) as lastTime by user, Name, ForwardTo, vendor_account, vendor_product, dest, signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_forwarding_mailflow_rule_created_filter`"
+search: |
+    `o365_management_activity` Workload=Exchange Operation="New-TransportRule" | eval match1=mvfind('Parameters{}.Name',"BlindCopyTo") | eval match2=mvfind('Parameters{}.Name',"CopyTo") | eval match3=mvfind('Parameters{}.Name', "RedirectMessageTo") | where match1>= 0 OR match2>= 0 OR match3>=0 | eval ForwardTo=coalesce(BlindCopyTo, CopyTo, RedirectMessageTo) | search ForwardTo!="" | rename UserId as user | fillnull | stats count earliest(_time) as firstTime latest(_time) as lastTime by user, Name, ForwardTo, vendor_account, vendor_product, dest, signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_forwarding_mailflow_rule_created_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Forwarding mail flow rules may be created for legitimate reasons, filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new forwarding mailflow rule was created by $user$
     entity:
@@ -45,6 +46,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_new_forwarding_mailflow_rule_created/o365_new_forwarding_mailflow_rule_created.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_new_mfa_method_registered.yml b/detections/cloud/o365_new_mfa_method_registered.yml
index b205609d03c..d0d8a67db2b 100644
--- a/detections/cloud/o365_new_mfa_method_registered.yml
+++ b/detections/cloud/o365_new_mfa_method_registered.yml
@@ -45,7 +45,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new MFA method was added for $user$
     entity:
@@ -67,6 +67,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.005/o365_register_new_mfa_method/o365_register_new_mfa_method.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml b/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml
index 503804172fc..ba80586ea74 100644
--- a/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml
+++ b/detections/cloud/o365_oauth_app_mailbox_access_via_ews.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects when emails are accessed in Office 365 Exchange via Exchange Web Services (EWS) using OAuth-authenticated applications. It leverages the ClientInfoString field to identify EWS interactions and aggregates metrics such as access counts, timing, and client IP addresses, categorized by user, ClientAppId, OperationCount, and AppId. Monitoring OAuth applications accessing emails through EWS is crucial for identifying potential abuse or unauthorized data access. If confirmed malicious, this activity could lead to unauthorized email access, data exfiltration, or further compromise of sensitive information.
 data_source:
     - O365 MailItemsAccessed
-search: |-
+search: |
     `o365_management_activity` Workload=Exchange Operation=MailItemsAccessed AppId=* ClientAppId=*
       | regex ClientInfoString="^Client=WebServices;ExchangeWebServices"
       | fillnull
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An OAuth application identified with id $ClientAppId$ accesed mailboxes through the Graph API.
     entity:
@@ -57,6 +57,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.002/o365_oauth_app_ews_mailbox_access/o365_oauth_app_ews_mailbox_access.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml b/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml
index 28b13f09fef..6e920f39027 100644
--- a/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml
+++ b/detections/cloud/o365_oauth_app_mailbox_access_via_graph_api.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects when emails are accessed in Office 365 Exchange via the Microsoft Graph API using the client ID '00000003-0000-0000-c000-000000000000'. It leverages the 'MailItemsAccessed' operation within the Exchange workload, focusing on OAuth-authenticated applications. This activity is significant as unauthorized access to emails can lead to data breaches and information theft. If confirmed malicious, attackers could exfiltrate sensitive information, compromise user accounts, and further infiltrate the organization's network.
 data_source:
     - O365 MailItemsAccessed
-search: |-
-    `o365_management_activity` Workload=Exchange Operation=MailItemsAccessed AppId=* AppId=00000003-0000-0000-c000-000000000000
-      | fillnull
-      | stats count earliest(_time) as firstTime latest(_time) as lastTime values(ClientIPAddress) as src
-        BY user ClientAppId OperationCount
-           AppId vendor_account vendor_product
-           dest signature
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_oauth_app_mailbox_access_via_graph_api_filter`
+search: |
+    `o365_management_activity` Operation=MailItemsAccessed Workload="Exchange" AppId="*" AppId="00000003-0000-0000-c000-000000000000" | eval ClientAppId=ClientAppId | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_oauth_app_mailbox_access_via_graph_api_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: OAuth applications may access mailboxes for legitimate purposes, you can use the ClientAppId to add trusted applications to an allow list.
 references:
@@ -33,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An OAuth application identified with id $ClientAppId$ accesed mailboxes through the Graph API.
     entity:
@@ -56,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.002/o365_oauth_app_graph_mailbox_access/o365_oauth_app_graph_mailbox_access.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_privileged_graph_api_permission_assigned.yml b/detections/cloud/o365_privileged_graph_api_permission_assigned.yml
index 94f9d354792..e04464598e9 100644
--- a/detections/cloud/o365_privileged_graph_api_permission_assigned.yml
+++ b/detections/cloud/o365_privileged_graph_api_permission_assigned.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the assignment of critical Graph API permissions in Azure AD using the O365 Unified Audit Log. It focuses on permissions such as Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, and RoleManagement.ReadWrite.Directory. The detection method leverages Azure Active Directory workload events, specifically 'Update application' operations. This activity is significant as these permissions provide extensive control over Azure AD settings, posing a high risk if misused. If confirmed malicious, this could allow unauthorized modifications, leading to potential data breaches or privilege escalation. Immediate investigation is crucial.
 data_source:
     - O365 Update application.
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update application.\" | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) | spath input=newvalue | search \"{}.RequiredAppPermissions{}.EntitlementId\"=\"1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9\" OR \"{}.RequiredAppPermissions{}.EntitlementId\"=\"06b708a9-e830-4db3-a914-8e69da51d44f\" OR \"{}.RequiredAppPermissions{}.EntitlementId\"=\"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\" | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' | fillnull | stats count earliest(_time) as firstTime latest(_time) as lastTime values(Permissions) by user src object user_agent signature vendor_account vendor_product dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_graph_api_permission_assigned_filter`"
+search: |
+    `o365_management_activity` Workload=AzureActiveDirectory Operation="Update application." | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) | spath input=newvalue | search "{}.RequiredAppPermissions{}.EntitlementId"="1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9" OR "{}.RequiredAppPermissions{}.EntitlementId"="06b708a9-e830-4db3-a914-8e69da51d44f" OR "{}.RequiredAppPermissions{}.EntitlementId"="9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8" | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' | fillnull | stats count earliest(_time) as firstTime latest(_time) as lastTime values(Permissions) by user src object user_agent signature vendor_account vendor_product dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_graph_api_permission_assigned_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Privileged Graph API permissions may be assigned for legitimate purposes. Filter as needed.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ assigned privileged Graph API permissions to $object$
     entity:
@@ -49,6 +50,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/o365_privileged_graph_perm_assigned/o365_privileged_graph_perm_assigned.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_privileged_role_assigned.yml b/detections/cloud/o365_privileged_role_assigned.yml
index f4680f055fe..c5839db2204 100644
--- a/detections/cloud/o365_privileged_role_assigned.yml
+++ b/detections/cloud/o365_privileged_role_assigned.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies the assignment of sensitive and privileged Azure Active Directory roles to an Azure AD user. Adversaries and red teams alike may assign these roles to a compromised account to establish Persistence in an Azure AD environment. This detection leverages the O365 Universal Audit Log data source.
 data_source:
     - Office 365 Universal Audit Log
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature, vendor_account, vendor_product, dest | lookup local=t privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_filter`"
+search: |
+    `o365_management_activity` Workload=AzureActiveDirectory Operation IN ("Add member to role.","Add eligible member to role.") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',"Role\.DisplayName")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',"Role\.TemplateId")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature, vendor_account, vendor_product, dest | lookup local=t privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole="TRUE" category="User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Administrators will legitimately assign the privileged roles users as part of administrative tasks. Microsoft Privileged Identity Management (PIM) may cause false positives / less accurate alerting.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A privileged Azure AD role [$object_name$] was assigned to user $user$ by $src_user$
     entity:
@@ -53,6 +54,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/o365_azure_workload_events/o365_azure_workload_events.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml
index ffeaa95712c..7eb51992bb2 100644
--- a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml
+++ b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects potential privilege escalation threats in Azure Active Directory (AD). This detection is important because it identifies instances where privileged roles that hold elevated permissions are assigned to service principals. This prevents unauthorized access or malicious activities, which occur when these non-human entities access Azure resources to exploit them. False positives might occur since administrators can legitimately assign privileged roles to service principals. This detection leverages the O365 Universal Audit Log data source.
 data_source:
     - Office 365 Universal Audit Log
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature,vendor_account, vendor_product, dest | lookup local=t privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category!=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_to_service_principal_filter`"
+search: |
+    `o365_management_activity` Workload=AzureActiveDirectory Operation IN ("Add member to role.","Add eligible member to role.") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',"Role\.DisplayName")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',"Role\.TemplateId")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature,vendor_account, vendor_product, dest | lookup local=t privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole="TRUE" category!="User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_to_service_principal_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Administrators may legitimately assign the privileged roles to Service Principals as part of administrative tasks. Filter as needed.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A privileged Azure AD role [$object_name$] was assigned to the Service Principal $user$ initiated by $src_user$
     entity:
@@ -54,6 +55,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/o365_azure_workload_events/o365_azure_workload_events.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml
index 763d3dc2d16..3a12ecca89e 100644
--- a/detections/cloud/o365_pst_export_alert.yml
+++ b/detections/cloud/o365_pst_export_alert.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic detects instances where a user has initiated an eDiscovery search or exported a PST file in an Office 365 environment. It leverages Office 365 management activity logs, specifically filtering for events under ThreatManagement with the name "eDiscovery search started or exported." This activity is significant as it may indicate data exfiltration attempts or unauthorized access to sensitive information. If confirmed malicious, it suggests an attacker or insider threat is attempting to gather or exfiltrate data, potentially leading to data breaches, loss of intellectual property, or unauthorized access to confidential communications. Immediate investigation is required.
 data_source:
     - O365
-search: |-
-    `o365_management_activity` Category=ThreatManagement Name="eDiscovery search started or exported"
-      | fillnull
-      | stats count earliest(_time) as firstTime latest(_time) as lastTime
-        BY Source Severity AlertEntityId
-           Name user src
-           vendor_account vendor_product dest
-           signature
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_pst_export_alert_filter`
+search: |
+    `o365_management_activity` Category="ThreatManagement" Name="eDiscovery search started or exported" | eval user=User, new_value='ModifiedProperties{}.NewValue', signature=signature, Severity=Severity | stats count min(_time) as firstTime max(_time) as lastTime by Category Name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_pst_export_alert_filter`
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 known_false_positives: PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored.
 references:
@@ -32,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ has exported a PST file from the search using this operation- $signature$ with a severity of $Severity$
     entity:
@@ -55,6 +46,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_export_pst_file/o365_export_pst_file.json
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_safe_links_detection.yml b/detections/cloud/o365_safe_links_detection.yml
index 7191d8ddc9a..aede9956191 100644
--- a/detections/cloud/o365_safe_links_detection.yml
+++ b/detections/cloud/o365_safe_links_detection.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects when any Microsoft Safe Links alerting is triggered. This behavior may indicate when user has interacted with a phishing or otherwise malicious link within the Microsoft Office ecosystem.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
+search: |
     `o365_management_activity` Name="*a potentially malicious URL*" Operation=AlertEntityGenerated
       | fromjson Data
       | fillnull
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $user$ triggered a Microsoft Safe Links detection.
     entity:
@@ -58,6 +58,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_security_and_compliance_alert_triggered.yml b/detections/cloud/o365_security_and_compliance_alert_triggered.yml
index 4b26123e2f7..16a190bd9ae 100644
--- a/detections/cloud/o365_security_and_compliance_alert_triggered.yml
+++ b/detections/cloud/o365_security_and_compliance_alert_triggered.yml
@@ -8,7 +8,7 @@ status: production
 type: TTP
 description: The following analytic identifies alerts triggered by the Office 365 Security and Compliance Center, indicating potential threats or policy violations. It leverages data from the `o365_management_activity` dataset, focusing on events where the workload is SecurityComplianceCenter and the operation is AlertTriggered. This activity is significant as it highlights security and compliance issues within the O365 environment, which are crucial for maintaining organizational security. If confirmed malicious, these alerts could indicate attempts to breach security policies, leading to unauthorized access, data exfiltration, or other malicious activities.
 data_source: []
-search: |-
+search: |
     `o365_management_activity` Workload=SecurityComplianceCenter Category=ThreatManagement Operation=AlertTriggered
       | spath input=Data path=f3u output=user
       | spath input=Data path=op output=operation
@@ -41,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Security and Compliance triggered an alert for $user$
     entity:
@@ -63,6 +63,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/o365_security_and_compliance_alert_triggered/o365_security_and_compliance_alert_triggered.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_service_principal_new_client_credentials.yml b/detections/cloud/o365_service_principal_new_client_credentials.yml
index 830e144f9a9..864a436997f 100644
--- a/detections/cloud/o365_service_principal_new_client_credentials.yml
+++ b/detections/cloud/o365_service_principal_new_client_credentials.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects the addition of new credentials for Service Principals within an Office 365 tenant. It uses O365 audit logs, focusing on events related to credential modifications or additions in the AzureActiveDirectory workload. This activity is significant because Service Principals represent application identities, and their credentials allow applications to authenticate and access resources. If an attacker successfully adds or modifies these credentials, they can impersonate the application, leading to unauthorized data access, data exfiltration, or malicious operations under the application's identity.
 data_source:
     - O365
-search: |-
-    `o365_management_activity` Workload=AzureActiveDirectory Operation="Update application*Certificates and secrets management "
-      | fillnull
-      | stats earliest(_time) as firstTime latest(_time) as lastTime
-        BY user ModifiedProperties{}.NewValue object
-           ObjectId dest signature
-           src vendor_account vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_service_principal_new_client_credentials_filter`
+search: |
+    `o365_management_activity` Workload="AzureActiveDirectory" Operation="Update application*Certificates and secrets management " | eval user=User, new_value='ModifiedProperties{}.NewValue', signature=signature, Severity=Severity | stats count min(_time) as firstTime max(_time) as lastTime by Workload Operation object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_service_principal_new_client_credentials_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Service Principal client credential modifications may be part of legitimate administrative operations. Filter as needed.
 references:
@@ -34,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: New credentials added for Service Principal $object$
     entity:
@@ -63,6 +55,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.001/o365_service_principal_credentials/o365_service_principal_credentials.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_service_principal_privilege_escalation.yml b/detections/cloud/o365_service_principal_privilege_escalation.yml
index ff3b2bea93a..21716d983d1 100644
--- a/detections/cloud/o365_service_principal_privilege_escalation.yml
+++ b/detections/cloud/o365_service_principal_privilege_escalation.yml
@@ -9,19 +9,8 @@ type: TTP
 description: This detection identifies when an Azure Service Principal elevates privileges by adding themself to a new app role assignment.
 data_source:
     - O365 Add app role assignment grant to user.
-search: >-
-    `o365_management_activity` Operation="Add app role assignment to service principal." "Actor{}.ID"=ServicePrincipal ResultStatus=Success
-    | spath path=ModifiedProperties{} output=targetResources
-    | eval src="NA"
-    | stats min(_time) as _time values(eval(mvfilter(match(targetResources, "AppRole.Value")))) as appRole, values(eval(mvfilter(match(targetResources, "ServicePrincipal.DisplayName")))) as targetServicePrincipal values(object) as targetAppContext values(user_agent) as user_agent values(user) as servicePrincipal values(UserId) as servicePrincipalId by Operation InterSystemsId tenant_id user dest src vendor_account vendor_product signature
-    | spath input=appRole path=NewValue output=appRole
-    | spath input=targetServicePrincipal path=NewValue output=targetServicePrincipal
-    | where servicePrincipal=targetServicePrincipal
-    | fillnull
-    | stats earliest(_time) as firstTime latest(_time) as lastTime by servicePrincipal servicePrincipalId appRole targetAppContext user_agent tenant_id InterSystemsId user dest src vendor_account vendor_product signature
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `o365_service_principal_privilege_escalation_filter`
+search: |
+    `o365_management_activity` Operation="Add app role assignment to service principal." "Actor{}.ID"=ServicePrincipal ResultStatus=Success | spath path=ModifiedProperties{} output=targetResources | eval src="NA" | stats min(_time) as _time values(eval(mvfilter(match(targetResources, "AppRole.Value")))) as appRole, values(eval(mvfilter(match(targetResources, "ServicePrincipal.DisplayName")))) as targetServicePrincipal values(object) as targetAppContext values(user_agent) as user_agent values(user) as servicePrincipal values(UserId) as servicePrincipalId by Operation InterSystemsId tenant_id user dest src vendor_account vendor_product signature | spath input=appRole path=NewValue output=appRole | spath input=targetServicePrincipal path=NewValue output=targetServicePrincipal | where servicePrincipal=targetServicePrincipal | fillnull | stats earliest(_time) as firstTime latest(_time) as lastTime by servicePrincipal servicePrincipalId appRole targetAppContext user_agent tenant_id InterSystemsId user dest src vendor_account vendor_product signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_service_principal_privilege_escalation_filter`
 how_to_implement: The Splunk Add-on for Microsoft Office 365 add-on is required to ingest EntraID audit logs via the 365 API. See references for links for further details on how to onboard this log source.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -37,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$servicePrincipal$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$servicePrincipal$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Service Principal $servicePrincipal$ has elevated privileges by adding themself to app role $appRole$
     entity:
@@ -63,6 +52,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/o365_spn_privesc/o365_spn_privesc.log
-          sourcetype: o365:management:activity
           source: Office 365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml
index 10a8e73bd77..789324e9b64 100644
--- a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml
+++ b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies when the allowed domain settings for O365 SharePoint have been changed. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations may also need access to OneDrive/SharePoint resources. These changed should be monitored by security teams as they could potentially lead to unauthorized access.
 data_source:
     - Office 365 Universal Audit Log
-search: '`o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged "ModifiedProperties{}.Name"=AllowDomainList | eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name=''ModifiedProperties{}.Name'', object_attrs_new = split(replace(''ModifiedProperties{}.NewValue'',"\.\.\.",""),","), object_attrs_old = split(replace(''ModifiedProperties{}.OldValue'',"\.\.\.",""),",") | fillnull | stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) as lastTime by user,signature,signature_id,object_name,dest,action,vendor_account,vendor_product | eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null)) | eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs_new,object_attrs_old)),object_attrs_old,null)) | eval result = case(isnotnull(diff_add),"Added ".mvjoin(diff_add,","),isnotnull(diff_remove),"Removed ".mvjoin(diff_remove,",")), action = case(isnotnull(diff_add),"created",isnotnull(diff_remove),"deleted") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_sharepoint_allowed_domains_policy_changed_filter`'
+search: |
+    `o365_management_activity` Workload=SharePoint Operation=SharingPolicyChanged "ModifiedProperties{}.Name"=AllowDomainList | eval signature_id = CorrelationId, signature=Operation, src = ClientIP, user = UserId, object_name='ModifiedProperties{}.Name', object_attrs_new = split(replace('ModifiedProperties{}.NewValue',"\.\.\.",""),","), object_attrs_old = split(replace('ModifiedProperties{}.OldValue',"\.\.\.",""),",") | fillnull | stats values(object_attrs_new) as object_attrs_new, values(object_attrs_old) as object_attrs_old, values(src) as src, count, min(_time) as firstTime, max(_time) as lastTime by user,signature,signature_id,object_name,dest,action,vendor_account,vendor_product | eval diff_add=mvmap(object_attrs_new,if(isnull(mvfind(object_attrs_old,object_attrs_new)),object_attrs_new,null)) | eval diff_remove=mvmap(object_attrs_old,if(isnull(mvfind(object_attrs_new,object_attrs_old)),object_attrs_old,null)) | eval result = case(isnotnull(diff_add),"Added ".mvjoin(diff_add,","),isnotnull(diff_remove),"Removed ".mvjoin(diff_remove,",")), action = case(isnotnull(diff_add),"created",isnotnull(diff_remove),"deleted") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_sharepoint_allowed_domains_policy_changed_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Business approved changes by known administrators.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The SharePoint Online domain allowlist was changed by $user$, $result$
     entity:
@@ -44,6 +45,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_sharepoint_malware_detection.yml b/detections/cloud/o365_sharepoint_malware_detection.yml
index 033202ed54e..3ac60365de8 100644
--- a/detections/cloud/o365_sharepoint_malware_detection.yml
+++ b/detections/cloud/o365_sharepoint_malware_detection.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic identifies when a malicious file is detected within the SharePoint Online ecosystem. Attackers may stage and execute malicious files from within the Microsoft Office 365 ecosystem. Any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities further enhance these detection and response functions.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
-    `o365_management_activity` Operation=FileMalwareDetected
-      | rename UserId as user, Id as signature_id
-      | stats values(Workload) as category, values(SourceFileName) as file_name values(ObjectId) as file_path, values(VirusInfo) as signature, count, min(_time) as firstTime, max(_time) as lastTime
-        BY signature_id, user, dest,
-           src, vendor_account, vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_sharepoint_malware_detection_filter`
+search: |
+    `o365_management_activity` Operation="FileMalwareDetected" | eval user=User, src_user=P2Sender, object=object, signature=DetectionMethod, object_name=object_name, file_path=SiteUrl, src=src, file_name=SourceFileName | stats count min(_time) as firstTime max(_time) as lastTime by Operation | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_sharepoint_malware_detection_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -30,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: SharePoint detected a potentially malicious file $file_name$
     entity:
@@ -57,6 +50,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml
index 5ab31dfe2bf..2a7e35de858 100644
--- a/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml
+++ b/detections/cloud/o365_sharepoint_suspicious_search_behavior.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies when Office 365 users search for suspicious keywords or have an excessive number of queries to a SharePoint site within a limited timeframe. This behavior may indicate that a malicious actor has gained control of a user account and is conducting discovery or enumeration activities.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
+search: |
     `o365_management_activity` (Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search*) OR Operation=SearchQueryInitiatedSharepoint
     | eval command = case(Operation=="SearchQueryPerformed",SearchQueryText,true(),QueryText), UserId = lower(UserId), signature_id = CorrelationId, signature=Operation, src = ClientIP, user = lower(UserId), object_name=case(Operation=="SearchQueryPerformed",'EventData',true(),QuerySource), -time = _time, suspect_terms = case(match(command, `o365_suspect_search_terms_regex`),command,true(),null())
     | where command != "*" AND command != "(*)"
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate search behavior by $user$
       search: '`o365_management_activity` (Workload=SharePoint Operation="SearchQueryPerformed" SearchQueryText=* EventData=*search* AND UserId = "$user$") OR (OR Operation=SearchQueryInitiatedSharepoint AND UserId = "$user$")'
       earliest_offset: $info_min_time$
diff --git a/detections/cloud/o365_tenant_wide_admin_consent_granted.yml b/detections/cloud/o365_tenant_wide_admin_consent_granted.yml
index 5b4078235d1..7368a1fd81d 100644
--- a/detections/cloud/o365_tenant_wide_admin_consent_granted.yml
+++ b/detections/cloud/o365_tenant_wide_admin_consent_granted.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies instances where admin consent is granted to an application within an Azure AD and Office 365 tenant. It leverages O365 audit logs, specifically events related to the admin consent action within the AzureActiveDirectory workload. This activity is significant because admin consent allows applications to access data across the entire tenant, potentially exposing vast amounts of organizational data. If confirmed malicious, an attacker could gain extensive and persistent access to organizational data, leading to data exfiltration, espionage, further malicious activities, and potential compliance violations.
 data_source:
     - O365 Consent to application.
-search: "`o365_management_activity` Operation=\"Consent to application.\" | eval new_field=mvindex('ModifiedProperties{}.NewValue', 4) | rex field=new_field \"ConsentType: (?<ConsentType>[^\\,]+)\" | rex field=new_field \"Scope: (?<Scope>[^\\,]+)\" | search ConsentType = \"AllPrincipals\" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by user, object, ObjectId, ConsentType, Scope, dest, vendor_account, vendor_product, signature, src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_tenant_wide_admin_consent_granted_filter`"
+search: |
+    `o365_management_activity` Operation="Consent to application." | eval new_field=mvindex('ModifiedProperties{}.NewValue', 4) | rex field=new_field "ConsentType: (?<ConsentType>[^\,]+)" | rex field=new_field "Scope: (?<Scope>[^\,]+)" | search ConsentType = "AllPrincipals" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by user, object, ObjectId, ConsentType, Scope, dest, vendor_account, vendor_product, signature, src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_tenant_wide_admin_consent_granted_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Legitimate applications may be granted tenant wide consent, filter as needed.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The $object$ application registration was granted tenant wide admin consent.
     entity:
diff --git a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml
index 78bbe36f4f1..e883cea08ef 100644
--- a/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml
+++ b/detections/cloud/o365_threat_intelligence_suspicious_email_delivered.yml
@@ -9,14 +9,8 @@ type: Anomaly
 description: The following analytic identifies when a suspicious email is detected within the Microsoft Office 365 ecosystem through the Advanced Threat Protection engine and delivered to an end user. Attackers may execute several attacks through email, any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities such as Safe Attachment and Safe Links further enhance these detection and response functions.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
-    `o365_management_activity` Workload=ThreatIntelligence Operation=TIMailData DeliveryAction!=Blocked Directionality=InBound
-      | rename P2Sender as src_user, P1Sender as sender, Recipients{} as user, DeliveryAction as action
-      | stats values(SenderIp) as src, values(Subject) as subject, values(user) as user, values(action) as action, values(SystemOverrides{}.Details) as reason, values(LatestDeliveryLocation) as result, values(ThreatsAndDetectionTech{}) as category, values(AttachmentData{}.FileName) as file_name, values(AttachmentData{}.FileType) as file_type, values(AttachmentData{}.SHA256) as file_hash values(DetectionMethod) as signature, min(_time) as firstTime max(_time) as lastTime, count
-        BY src_user,sender,dest,vendor_account,vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_threat_intelligence_suspicious_email_delivered_filter`
+search: |
+    `o365_management_activity` Workload="ThreatIntelligence" Operation="TIMailData" NOT DeliveryAction="Blocked" Directionality="InBound" | eval user=User, src_user=P2Sender, object=object, signature=DetectionMethod, object_name=object_name, file_path=SiteUrl, src=src, file_name=SourceFileName | stats count min(_time) as firstTime max(_time) as lastTime by Workload Operation DeliveryAction Directionality subject | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_threat_intelligence_suspicious_email_delivered_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The threat intelligence workload is typically only visible to E3/E5 level customers.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -30,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -61,6 +55,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml
index 9e57409f349..7259c365c3d 100644
--- a/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml
+++ b/detections/cloud/o365_threat_intelligence_suspicious_file_detected.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic identifies when a malicious file is detected within the Microsoft Office 365 ecosystem through the Advanced Threat Protection engine. Attackers may stage and execute malicious files from within the Microsoft Office 365 ecosystem. Any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities such as Safe Attachment and Safe Links further enhance these detection and response functions.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
-    `o365_management_activity` Workload=ThreatIntelligence Operation=AtpDetection
-      | eval dest="NA"
-      | eval src="NA"
-      | stats values(DetectionMethod) as category values(FileData.FileName) as file_name values(FileData.FilePath) as file_path values(FileData.FileSize) as file_size values(FileData.MalwareFamily) as signature count, min(_time) as firstTime, max(_time) as lastTime
-        BY Id, UserId, dest,
-           src, vendor_account, vendor_product
-      | rename Id as signature_id, UserId as user
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_threat_intelligence_suspicious_file_detected_filter`
+search: |
+    `o365_management_activity` Workload="ThreatIntelligence" Operation="AtpDetection" | eval user=User, src_user=P2Sender, object=object, signature=DetectionMethod, object_name=object_name, file_path=SiteUrl, src=src, file_name=SourceFileName | stats count min(_time) as firstTime max(_time) as lastTime by Workload Operation | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_threat_intelligence_suspicious_file_detected_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The threat intelligence workload is typically only visible to E3/E5 level customers.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -33,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Threat Intelligence workload detected a malicious file [$file_name$] from user $user$
     entity:
@@ -60,6 +51,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/o365_user_consent_blocked_for_risky_application.yml b/detections/cloud/o365_user_consent_blocked_for_risky_application.yml
index e20954f7c74..10fa2c9cb37 100644
--- a/detections/cloud/o365_user_consent_blocked_for_risky_application.yml
+++ b/detections/cloud/o365_user_consent_blocked_for_risky_application.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies instances where Office 365 has blocked a user's attempt to grant consent to an application deemed risky or potentially malicious. This detection leverages O365 audit logs, specifically focusing on failed user consent actions due to system-driven blocks. Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization. If confirmed malicious, this activity suggests that O365's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation.
 data_source:
     - O365 Consent to application.
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Consent to application.\" ResultStatus=Failure | eval permissions =mvindex('ModifiedProperties{}.NewValue', 4) | eval reason =mvindex('ModifiedProperties{}.NewValue', 5) | search reason = \"Risky application detected\" | rex field=permissions \"Scope: (?<Scope>[^,]+)\" | fillnull | stats max(_time) as lastTime by user, reason, object, Scope, dest, src, vendor_account, vendor_product, signature | `security_content_ctime(lastTime)` | `o365_user_consent_blocked_for_risky_application_filter`"
+search: |
+    `o365_management_activity` Workload=AzureActiveDirectory Operation="Consent to application." ResultStatus=Failure | eval permissions =mvindex('ModifiedProperties{}.NewValue', 4) | eval reason =mvindex('ModifiedProperties{}.NewValue', 5) | search reason = "Risky application detected" | rex field=permissions "Scope: (?<Scope>[^,]+)" | fillnull | stats max(_time) as lastTime by user, reason, object, Scope, dest, src, vendor_account, vendor_product, signature | `security_content_ctime(lastTime)` | `o365_user_consent_blocked_for_risky_application_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Microsofts algorithm to identify risky applications is unknown and may flag legitimate applications.
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: O365 has blocked $user$ attempt to grant to consent to an application deemed risky.
     entity:
diff --git a/detections/cloud/o365_user_consent_denied_for_oauth_application.yml b/detections/cloud/o365_user_consent_denied_for_oauth_application.yml
index ed0f225da4e..1b25640e835 100644
--- a/detections/cloud/o365_user_consent_denied_for_oauth_application.yml
+++ b/detections/cloud/o365_user_consent_denied_for_oauth_application.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic identifies instances where a user has denied consent to an OAuth application seeking permissions within the Office 365 environment. This detection leverages O365 audit logs, focusing on events related to user consent actions. By filtering for denied consent actions associated with OAuth applications, it captures instances where users have actively rejected permission requests. This activity is significant as it may indicate users spotting potentially suspicious or unfamiliar applications. If confirmed malicious, it suggests an attempt by a potentially harmful application to gain unauthorized access, which was proactively blocked by the user.
 data_source:
     - O365
-search: |-
-    `o365_graph` status.errorCode=65004
-      | rename userPrincipalName as user
-      | rename ipAddress as src_ip
-      | stats min(_time) as firstTime max(_time) as lastTime
-        BY user src_ip appDisplayName
-           status.failureReason
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `o365_user_consent_denied_for_oauth_application_filter`
+search: |
+    `o365_management_activity` status.errorCode="65004" | eval user=User, new_value='ModifiedProperties{}.NewValue', signature=signature, Severity=Severity | stats count min(_time) as firstTime max(_time) as lastTime by errorCode src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_user_consent_denied_for_oauth_application_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 events.
 known_false_positives: OAuth applications that require mail permissions may be legitimate, investigate and filter as needed.
 references:
@@ -36,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ denifed consent for an OAuth application.
     entity:
diff --git a/detections/cloud/o365_zap_activity_detection.yml b/detections/cloud/o365_zap_activity_detection.yml
index cde3ca97497..630a3e2995b 100644
--- a/detections/cloud/o365_zap_activity_detection.yml
+++ b/detections/cloud/o365_zap_activity_detection.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects when the Microsoft Zero-hour Automatic Purge (ZAP) capability takes action against a user's mailbox. This capability is an enhanced protection feature that retro-actively removes email with known malicious content for user inboxes. Since this is a retroactive capability, there is still a window in which the user may fall victim to the malicious content.
 data_source:
     - Office 365 Universal Audit Log
-search: |-
+search: |
     `o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name="*messages containing malicious*"
       | fromjson Data
       | fillnull
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -63,6 +63,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts.log
-          sourcetype: o365:management:activity
           source: o365
+          sourcetype: o365:management:activity
       test_type: unit
diff --git a/detections/cloud/okta_non_standard_vpn_usage.yml b/detections/cloud/okta_non_standard_vpn_usage.yml
index b054bf33735..f6bbdddf7e8 100644
--- a/detections/cloud/okta_non_standard_vpn_usage.yml
+++ b/detections/cloud/okta_non_standard_vpn_usage.yml
@@ -9,9 +9,11 @@ type: TTP
 description: Remote Employment Fraud (REF) actors will often use virtual private networks (VPNs) to conceal their true physical location. Threat actors mask their originating IP address and instead appear to be situated in any location where the VPN service has a node.
 data_source:
     - Okta
-search: '`okta` debugContext.debugData.tunnels IN (*Astrill*,*Azire*,*CyberGhost*,*Express*VPN,*HideMe*, *IPVanish*,*Mullvad*,*Nord*VPN*,*OVPN*,*PIA*VPN*,*Proton*VPN*,*Pure*VPN*,*Slick*VPN*,*Surf*Easy*, *SurfShark*,*Star*VPN*,*TorGuard*,*TorProxy*,*Tiger*VPN*,*TunnelBear*,*Unblock*VPN*,*Warp*VPN*,*WarpSpeed*, *VPNReactor*,*VPN*Shield*,*VPN*Super*VPN*,*ZenMate*) ```listing of commonly used known VPN providers. Add or remove whatever is appropriate for your environment``` | eval user=coalesce(''actor.alternateId'',user), user=mvindex(split(user, "@"), 0) | rename targetUserAlternateId as user client.* as * request.* as * ipChain{}.* as * geographicalContext.* as * debugContext.* as * debugData.* as * | eval status=case(match(_raw, "FAILURE"), "failure", !match(_raw, "FAILURE"), "success") | stats count values(status) as status max(published) as UTC min(_time) as firsttime max(_time) as lasttime values(target_data) as target_data values(displayMessage) as displayMessage values(eventType) as eventType values(city) as city values(country) as country values(action) as action values(src_ip) as src_ip values(outcome.*) as * values(user) as user by tunnels,_time,host sourcetype index | fillnull value="N/A" | convert ctime(*ttime) | `okta_non_standard_vpn_usage_filter`'
+search: |
+    `okta` debugContext.debugData.tunnels IN (*Astrill*,*Azire*,*CyberGhost*,*Express*VPN,*HideMe*, *IPVanish*,*Mullvad*,*Nord*VPN*,*OVPN*,*PIA*VPN*,*Proton*VPN*,*Pure*VPN*,*Slick*VPN*,*Surf*Easy*, *SurfShark*,*Star*VPN*,*TorGuard*,*TorProxy*,*Tiger*VPN*,*TunnelBear*,*Unblock*VPN*,*Warp*VPN*,*WarpSpeed*, *VPNReactor*,*VPN*Shield*,*VPN*Super*VPN*,*ZenMate*) ```listing of commonly used known VPN providers. Add or remove whatever is appropriate for your environment``` | eval user=coalesce('actor.alternateId',user), user=mvindex(split(user, "@"), 0) | rename targetUserAlternateId as user client.* as * request.* as * ipChain{}.* as * geographicalContext.* as * debugContext.* as * debugData.* as * | eval status=case(match(_raw, "FAILURE"), "failure", !match(_raw, "FAILURE"), "success") | stats count values(status) as status max(published) as UTC min(_time) as firsttime max(_time) as lasttime values(target_data) as target_data values(displayMessage) as displayMessage values(eventType) as eventType values(city) as city values(country) as country values(action) as action values(src_ip) as src_ip values(outcome.*) as * values(user) as user by tunnels,_time,host sourcetype index | fillnull value="N/A" | convert ctime(*ttime) | `okta_non_standard_vpn_usage_filter`
 how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
 known_false_positives: Limited to no expected false positives once a baseline of common VPN software has been completed.
+references: []
 drilldown_searches:
     - name: View the detection results for - "$user$"
       search: '%original_detection_search% | search  actor.alternateId = "$user$"'
@@ -20,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Uncommon VPN software used by $user$ to connect to Okta.
     entity:
diff --git a/detections/cloud/risk_rule_for_dev_sec_ops_by_repository.yml b/detections/cloud/risk_rule_for_dev_sec_ops_by_repository.yml
index 99c07a6d548..0d8b9e5ee79 100644
--- a/detections/cloud/risk_rule_for_dev_sec_ops_by_repository.yml
+++ b/detections/cloud/risk_rule_for_dev_sec_ops_by_repository.yml
@@ -8,7 +8,7 @@ status: production
 type: Correlation
 description: The following analytic identifies high-risk activities within repositories by correlating repository data with risk scores. It leverages findings and intermediate findings created by detections from the Dev Sec Ops analytic stories, summing risk scores and capturing source and user information. The detection focuses on high-risk scores above 100 and sources with more than three occurrences. This activity is significant as it highlights repositories frequently targeted by threats, providing insights into potential vulnerabilities. If confirmed malicious, attackers could exploit these repositories, leading to data breaches or infrastructure compromise.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as sum_risk_score, values(All_Risk.annotations.mitre_attack.mitre_tactic) as annotations.mitre_attack.mitre_tactic, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
       WHERE All_Risk.analyticstories="Dev Sec Ops" All_Risk.risk_object_type = "other"
       BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
@@ -28,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$risk_object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Risk Threshold Exceeded for $risk_object$
     entity:
diff --git a/detections/deprecated/child_processes_of_spoolsv_exe.yml b/detections/deprecated/child_processes_of_spoolsv_exe.yml
index 8caf4cabe3f..0219a170391 100644
--- a/detections/deprecated/child_processes_of_spoolsv_exe.yml
+++ b/detections/deprecated/child_processes_of_spoolsv_exe.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=spoolsv.exe
-        AND
-        Processes.process_name!=regsvr32.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `child_processes_of_spoolsv_exe_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*spoolsv.exe" NOT Processes.process_name="*regsvr32.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `child_processes_of_spoolsv_exe_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate printer-related processes may show up as children of spoolsv.exe. You should confirm that any activity as legitimate and may be added as exclusions in the search.
 references: []
@@ -58,8 +44,8 @@ product:
 category: endpoint
 security_domain: endpoint
 deprecation_info:
-    reason: |-
-        Deprecated because the broad parent-child logic generated substantial legitimate printer, driver, and print-management activity and did not directly detect the exploitation behavior associated with its CVE reference.
-        More specific Print Spooler behaviors are covered by existing production detections.
+    reason: 'Deprecated because the broad parent-child logic generated substantial legitimate printer, driver, and print-management activity and did not directly detect the exploitation behavior associated with its CVE reference.
+
+        More specific Print Spooler behaviors are covered by existing production detections.'
     removed_in_version: 6.10.0
     replacement_content: []
diff --git a/detections/deprecated/circle_ci_disable_security_job.yml b/detections/deprecated/circle_ci_disable_security_job.yml
index b93cd1860a7..400d2f09734 100644
--- a/detections/deprecated/circle_ci_disable_security_job.yml
+++ b/detections/deprecated/circle_ci_disable_security_job.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the disabling of security jobs in CircleCI pipelines. It leverages CircleCI log data, renaming and extracting fields such as job names, workflow IDs, user information, commit messages, URLs, and branches. The detection identifies mandatory jobs for each workflow and checks if they were executed. This activity is significant because disabling security jobs can allow malicious code to bypass security checks, leading to potential data breaches, system downtime, and reputational damage. If confirmed malicious, this could result in unauthorized code execution and compromised pipeline integrity.
 data_source:
     - CircleCI
-search: |-
+search: |
     `circleci`
       | rename vcs.committer_name as user vcs.subject as commit_message vcs.url as url workflows.* as *
       | stats values(job_name) as job_names
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -53,14 +53,14 @@ product:
     - Splunk Cloud
 category: cloud
 security_domain: network
+deprecation_info:
+    reason: Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists.
+    removed_in_version: 6.12.0
+    replacement_content: []
 tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1554/circle_ci_disable_security_job/circle_ci_disable_security_job.json
-          sourcetype: circleci
           source: circleci
+          sourcetype: circleci
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists.
-    removed_in_version: 6.12.0
-    replacement_content: []
diff --git a/detections/deprecated/circle_ci_disable_security_step.yml b/detections/deprecated/circle_ci_disable_security_step.yml
index 5b234e57c1c..182adc49bac 100644
--- a/detections/deprecated/circle_ci_disable_security_step.yml
+++ b/detections/deprecated/circle_ci_disable_security_step.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the disablement of security steps in a CircleCI pipeline. It leverages CircleCI logs, using field renaming, joining, and statistical analysis to identify instances where mandatory security steps are not executed. This activity is significant because disabling security steps can introduce vulnerabilities, unauthorized changes, or malicious code into the pipeline. If confirmed malicious, this could lead to potential attacks, data breaches, or compromised infrastructure. Investigate by reviewing job names, commit details, and user information associated with the disablement, and examine any relevant artifacts and concurrent processes.
 data_source:
     - CircleCI
-search: |-
+search: |
     `circleci`
       | rename workflows.job_id AS job_id
       | join job_id [
@@ -50,15 +50,15 @@ product:
     - Splunk Cloud
 category: cloud
 security_domain: network
+deprecation_info:
+    reason: Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists.
+    removed_in_version: 6.12.0
+    replacement_content: []
 tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1554/circle_ci_disable_security_step/circle_ci_disable_security_step.json
-          sourcetype: circleci
           source: circleci
-      test_type: experimental
+          sourcetype: circleci
       description: This test is a legacy experimental test and may not be accurate.
-deprecation_info:
-    reason: Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists.
-    removed_in_version: 6.12.0
-    replacement_content: []
+      test_type: experimental
diff --git a/detections/deprecated/detect_html_help_renamed.yml b/detections/deprecated/detect_html_help_renamed.yml
index 6a71fb80287..52f94d4c04b 100644
--- a/detections/deprecated/detect_html_help_renamed.yml
+++ b/detections/deprecated/detect_html_help_renamed.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name!=hh.exe
-        AND
-        Processes.original_file_name=HH.EXE
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_html_help_renamed_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.process_name="*hh.exe" Processes.original_file_name="HH.EXE" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely a renamed instance of hh.exe will be used legitimately, filter as needed.
 references:
@@ -46,6 +32,11 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
+    removed_in_version: 6.10.0
+    replacement_content:
+        - Windows Renamed LOLBAS Binary was Executed
 tests:
     - name: True Positive Test
       attack_data:
@@ -53,8 +44,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
-    removed_in_version: 6.10.0
-    replacement_content:
-        - Windows Renamed LOLBAS Binary was Executed
diff --git a/detections/deprecated/detect_large_icmp_traffic.yml b/detections/deprecated/detect_large_icmp_traffic.yml
index f491f9d89e6..a223f13dd0b 100644
--- a/detections/deprecated/detect_large_icmp_traffic.yml
+++ b/detections/deprecated/detect_large_icmp_traffic.yml
@@ -6,14 +6,15 @@ modification_date: '2026-10-02'
 author: Rico Valdez, Dean Luxton, Bhavin Patel, Splunk
 status: deprecated
 type: TTP
-description: |
-    The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes.
-    It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert communication, or command-and-control (C2) activities.
-    If validated as malicious, this could signal ICMP tunneling, unauthorized data transfer, or compromised endpoints requiring immediate investigation.
+description: 'The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes.
+
+    It leverages the Network_Traffic data model to detect large ICMP packet that aren''t blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert communication, or command-and-control (C2) activities.
+
+    If validated as malicious, this could signal ICMP tunneling, unauthorized data transfer, or compromised endpoints requiring immediate investigation.'
 data_source:
     - Palo Alto Network Traffic
     - Cisco Secure Access Firewall
-search: |-
+search: |
     | tstats `security_content_summariesonly`
               count earliest(_time) as firstTime
                     latest(_time) as lastTime
@@ -42,10 +43,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `detect_large_icmp_traffic_filter`
-how_to_implement: |
-    The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    ICMP packets are used in a variety of ways to help troubleshoot networking issues and ensure the proper flow of traffic. As such, it is possible that a large ICMP packet could be perfectly legitimate. If large ICMP packets are associated with Command And Control traffic, there will typically be a large number of these packets observed over time. If the search is providing a large number of false positives, you can modify the macro `detect_large_icmp_traffic_filter` to adjust the byte threshold or add specific IP addresses to an allow list.
+how_to_implement: The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: ICMP packets are used in a variety of ways to help troubleshoot networking issues and ensure the proper flow of traffic. As such, it is possible that a large ICMP packet could be perfectly legitimate. If large ICMP packets are associated with Command And Control traffic, there will typically be a large number of these packets observed over time. If the search is providing a large number of false positives, you can modify the macro `detect_large_icmp_traffic_filter` to adjust the byte threshold or add specific IP addresses to an allow list.
 references: []
 drilldown_searches:
     - name: View the detection results for - "$src_ip$" and "$dest_ip$"
@@ -55,7 +54,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_ip$" and "$dest_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$", "$dest_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Large ICMP traffic greater than a 1000 bytes detected from $src_ip$ to $dest_ip$
     entity:
@@ -82,12 +81,16 @@ product:
     - Splunk Cloud
 category: network
 security_domain: network
+deprecation_info:
+    reason: Detection deprecated as it is determined to be very noisy in a production environment.
+    removed_in_version: 6.12.0
+    replacement_content: []
 tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1095/palologs/large_icmp.log
-          sourcetype: pan:traffic
           source: not_applicable
+          sourcetype: pan:traffic
       test_type: unit
     - name: Cisco Secure Access Firewall True Positive Test
       attack_data:
@@ -95,7 +98,3 @@ tests:
           source: cisco_cloud_security_addon
           sourcetype: cisco:cloud_security:firewall
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated as it is determined to be very noisy in a production environment.
-    removed_in_version: 6.12.0
-    replacement_content: []
diff --git a/detections/deprecated/detect_mshta_renamed.yml b/detections/deprecated/detect_mshta_renamed.yml
index a18668a17fe..2c98fb06cff 100644
--- a/detections/deprecated/detect_mshta_renamed.yml
+++ b/detections/deprecated/detect_mshta_renamed.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name!=mshta.exe
-        AND
-        Processes.original_file_name=MSHTA.EXE
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_mshta_renamed_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.process_name="*mshta.exe" Processes.original_file_name="MSHTA.EXE" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mshta_renamed_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may use a moved copy of mshta.exe, but never renamed, triggering a false positive.
 references:
@@ -45,6 +31,11 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
+    removed_in_version: 6.10.0
+    replacement_content:
+        - Windows Renamed LOLBAS Binary was Executed
 tests:
     - name: True Positive Test
       attack_data:
@@ -52,8 +43,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
-    removed_in_version: 6.10.0
-    replacement_content:
-        - Windows Renamed LOLBAS Binary was Executed
diff --git a/detections/deprecated/detect_renamed_7_zip.yml b/detections/deprecated/detect_renamed_7_zip.yml
index fea1e5e5ce5..92083979777 100644
--- a/detections/deprecated/detect_renamed_7_zip.yml
+++ b/detections/deprecated/detect_renamed_7_zip.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.original_file_name=7z*.exe
-            AND
-            Processes.process_name!=7z*.exe
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_renamed_7_zip_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.original_file_name="7z*.exe" NOT Processes.process_name="7z*.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_7_zip_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives, however this analytic will need to be modified for each environment if Sysmon is not used.
 references:
@@ -45,6 +29,11 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
+    removed_in_version: 6.10.0
+    replacement_content:
+        - Windows Renamed Popular 3rd Party Software was Executed
 tests:
     - name: True Positive Test
       attack_data:
@@ -52,8 +41,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
-    removed_in_version: 6.10.0
-    replacement_content:
-        - Windows Renamed Popular 3rd Party Software was Executed
diff --git a/detections/deprecated/detect_renamed_psexec.yml b/detections/deprecated/detect_renamed_psexec.yml
index 52e1bdf8899..e3b3f0fb785 100644
--- a/detections/deprecated/detect_renamed_psexec.yml
+++ b/detections/deprecated/detect_renamed_psexec.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name!=psexec.exe
-            AND
-            Processes.process_name!=psexec64.exe
-        )
-        AND Processes.original_file_name=psexec.c
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_renamed_psexec_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.process_name="*psexec.exe" NOT Processes.process_name="*psexec64.exe" Processes.original_file_name="psexec.c" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_psexec_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives should be present. It is possible some third party applications may use older versions of PsExec, filter as needed.
 references:
@@ -60,6 +43,11 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
+    removed_in_version: 6.10.0
+    replacement_content:
+        - Windows Renamed Command Interpreter was Executed
 tests:
     - name: True Positive Test
       attack_data:
@@ -67,8 +55,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
-    removed_in_version: 6.10.0
-    replacement_content:
-        - Windows Renamed Command Interpreter was Executed
diff --git a/detections/deprecated/detect_renamed_rclone.yml b/detections/deprecated/detect_renamed_rclone.yml
index 7e9bccd3330..519fb629c9e 100644
--- a/detections/deprecated/detect_renamed_rclone.yml
+++ b/detections/deprecated/detect_renamed_rclone.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.original_file_name=rclone.exe
-            AND
-            Processes.process_name!=rclone.exe
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_renamed_rclone_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.original_file_name="rclone.exe" NOT Processes.process_name="*rclone.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_rclone_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case.
 references:
@@ -49,6 +33,11 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
+    removed_in_version: 6.10.0
+    replacement_content:
+        - Windows Renamed Popular 3rd Party Software was Executed
 tests:
     - name: True Positive Test
       attack_data:
@@ -56,8 +45,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
-    removed_in_version: 6.10.0
-    replacement_content:
-        - Windows Renamed Popular 3rd Party Software was Executed
diff --git a/detections/deprecated/detect_renamed_winrar.yml b/detections/deprecated/detect_renamed_winrar.yml
index 215d1d0a53e..c429ddd3853 100644
--- a/detections/deprecated/detect_renamed_winrar.yml
+++ b/detections/deprecated/detect_renamed_winrar.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.original_file_name=WinRAR.exe (Processes.process_name!=rar.exe
-        AND
-        Processes.process_name!=winrar.exe)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_renamed_winrar_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.original_file_name="WinRAR.exe" NOT Processes.process_name="*rar.exe" NOT Processes.process_name="*winrar.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_winrar_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time. instances of WinRAR.
 references:
@@ -45,6 +31,11 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
+    removed_in_version: 6.10.0
+    replacement_content:
+        - Windows Renamed Popular 3rd Party Software was Executed
 tests:
     - name: True Positive Test
       attack_data:
@@ -52,8 +43,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
-    removed_in_version: 6.10.0
-    replacement_content:
-        - Windows Renamed Popular 3rd Party Software was Executed
diff --git a/detections/deprecated/detect_wmi_event_subscription_persistence.yml b/detections/deprecated/detect_wmi_event_subscription_persistence.yml
index 2d746625cbf..0c63564a9bd 100644
--- a/detections/deprecated/detect_wmi_event_subscription_persistence.yml
+++ b/detections/deprecated/detect_wmi_event_subscription_persistence.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic identifies the creation of WMI Event Subscriptions, which can be used to establish persistence or perform privilege escalation. It detects EventID 19 (EventFilter creation), EventID 20 (EventConsumer creation), and EventID 21 (FilterToConsumerBinding creation) from Sysmon logs. This activity is significant because WMI Event Subscriptions can execute code with elevated SYSTEM privileges, making it a powerful persistence mechanism. If confirmed malicious, an attacker could maintain long-term access, escalate privileges, and execute arbitrary code, posing a severe threat to the environment.
 data_source:
     - Sysmon EventID 20
-search: |-
-    `sysmon` EventID=20
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest dvc object
-           object_category object_path signature
-           signature_id src status
-           user user_id vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `detect_wmi_event_subscription_persistence_filter`
+search: |
+    `sysmon` EventID="20" | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc object object_category object_path signature signature_id src status user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_wmi_event_subscription_persistence_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with that provide WMI Event Subscription from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA and have enabled EventID 19, 20 and 21. Tune and filter known good to limit the volume.
 known_false_positives: It is possible some applications will create a consumer and may be required to be filtered. For tuning, add any additional LOLBin's for further depth of coverage.
 references:
@@ -34,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible malicious WMI Subscription created on $dest$
     entity:
@@ -53,6 +45,11 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: This rule uses only Sysmon EventID 20, which records creation of a WMI event consumer but does not confirm that a filter is bound to it. The Sysmon permanent subscription detection covers the binding with EventID 21.
+    removed_in_version: 6.10.0
+    replacement_content:
+        - WMI Permanent Event Subscription - Sysmon
 tests:
     - name: True Positive Test
       attack_data:
@@ -60,8 +57,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: This rule uses only Sysmon EventID 20, which records creation of a WMI event consumer but does not confirm that a filter is bound to it. The Sysmon permanent subscription detection covers the binding with EventID 21.
-    removed_in_version: 6.10.0
-    replacement_content:
-        - WMI Permanent Event Subscription - Sysmon
diff --git a/detections/deprecated/detection_of_tools_built_by_nirsoft.yml b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml
index 2fe7690cc05..a52f598994d 100644
--- a/detections/deprecated/detection_of_tools_built_by_nirsoft.yml
+++ b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process="* /stext *"
-            OR
-            Processes.process="* /scomma *"
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detection_of_tools_built_by_nirsoft_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("* /stext *", "* /scomma *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detection_of_tools_built_by_nirsoft_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: While legitimate, these NirSoft tools are prone to abuse. You should verify that the tool was used for a legitimate purpose.
 references: []
diff --git a/detections/deprecated/macos___re_opened_applications.yml b/detections/deprecated/macos___re_opened_applications.yml
index 708d18b6276..4942981cfea 100644
--- a/detections/deprecated/macos___re_opened_applications.yml
+++ b/detections/deprecated/macos___re_opened_applications.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic identifies processes referencing plist files that determine which applications are re-opened when a user reboots their MacOS machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes related to "com.apple.loginwindow." This activity is significant because it can indicate attempts to persist across reboots, a common tactic used by attackers to maintain access. If confirmed malicious, this could allow an attacker to execute code or maintain persistence on the affected system, potentially leading to further compromise.
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*com.apple.loginwindow*"
-      BY Processes.user Processes.process_name Processes.parent_process_name
-         Processes.dest
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `macos___re_opened_applications_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*com.apple.loginwindow*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos___re_opened_applications_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: At this stage, there are no known false positives. During testing, no process events referring the com.apple.loginwindow.plist files were observed during normal operation of re-opening applications on reboot. Therefore, it can be assumed that any occurrences of this in the process events would be worth investigating. In the event that the legitimate modification by the system of these files is in fact logged to the process log, then the process_name of that process can be added to an allow list.
 references: []
diff --git a/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml b/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml
index 9c14555e326..21cab474c3e 100644
--- a/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml
+++ b/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml
@@ -9,20 +9,21 @@ type: Anomaly
 description: Detects critical service crashes, fatal errors, and abnormal process terminations in Ollama that may indicate exploitation attempts, resource exhaustion attacks, malicious input triggering unhandled exceptions, or deliberate denial of service attacks designed to disrupt AI model availability and degrade system stability.
 data_source:
     - Ollama Server
-search: '`ollama_server` (level=ERROR OR level=FATAL OR "service stopped" OR "terminated" OR "exit" OR "shutdown" OR "crash" OR "killed") | rex field=_raw "msg=\"(?<msg>[^\"]+)\"" | rex field=_raw "exit_code=(?<exit_code>\d+)" | bin _time span=5m | stats count as termination_count, earliest(_time) as first_seen, latest(_time) as last_seen, values(msg) as error_messages, values(exit_code) as exit_codes, dc(msg) as unique_errors by host | eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S") | eval last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S") | eval severity=case( termination_count > 5, "critical", termination_count > 2, "high", 1=1, "medium" ) | eval attack_type=case( termination_count > 5, "Resource Exhaustion", termination_count > 2, "Repeated Service Failures", 1=1, "Service Instability" ) | where termination_count > 1 | table first_seen, last_seen, host, termination_count, unique_errors, error_messages, severity, attack_type | `ollama_abnormal_service_crash_availability_attack_filter`'
+search: |
+    `ollama_server` (level=ERROR OR level=FATAL OR "service stopped" OR "terminated" OR "exit" OR "shutdown" OR "crash" OR "killed") | rex field=_raw "msg=\"(?<msg>[^\"]+)\"" | rex field=_raw "exit_code=(?<exit_code>\d+)" | bin _time span=5m | stats count as termination_count, earliest(_time) as first_seen, latest(_time) as last_seen, values(msg) as error_messages, values(exit_code) as exit_codes, dc(msg) as unique_errors by host | eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S") | eval last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S") | eval severity=case( termination_count > 5, "critical", termination_count > 2, "high", 1=1, "medium" ) | eval attack_type=case( termination_count > 5, "Resource Exhaustion", termination_count > 2, "Repeated Service Failures", 1=1, "Service Instability" ) | where termination_count > 1 | table first_seen, last_seen, host, termination_count, unique_errors, error_messages, severity, attack_type | `ollama_abnormal_service_crash_availability_attack_filter`
 how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
 known_false_positives: Normal service restarts during system updates or maintenance windows, graceful shutdowns with non-zero exit codes, intentional service stops by administrators, software upgrades requiring process termination, out-of-memory conditions on resource-constrained systems, or known bugs in specific Ollama versions that cause benign crashes may trigger this detection during routine operations.
 references:
     - https://github.com/rosplk/ta-ollama
 drilldown_searches:
-    - name: 'View the detection results for - "$host$"'
+    - name: View the detection results for - "$host$"
       search: '%original_detection_search% | search host="$host$"'
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
-    - name: 'View risk events for the last 7 days for - "$host$"'
+    - name: View risk events for the last 7 days for - "$host$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
@@ -40,15 +41,15 @@ product:
     - Splunk Cloud
 category: application
 security_domain: endpoint
+deprecation_info:
+    reason: This experimental rule is being deprecated while we enhance Ollama availability detection. Application errors alone do not confirm a service outage, so we are improving the evidence needed to identify service interruptions reliably.
+    removed_in_version: 6.12.0
+    replacement_content:
+        - Ollama Repeated Application Errors
 tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log
-          sourcetype: ollama:server
           source: app.log
+          sourcetype: ollama:server
       test_type: unit
-deprecation_info:
-    reason: This experimental rule is being deprecated while we enhance Ollama availability detection. Application errors alone do not confirm a service outage, so we are improving the evidence needed to identify service interruptions reliably.
-    removed_in_version: 6.12.0
-    replacement_content:
-        - Ollama Repeated Application Errors
diff --git a/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml b/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml
index f04b73cb26f..81b01e23617 100644
--- a/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml
+++ b/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: Detects data leakage and exfiltration attempts targeting Ollama model metadata and configuration endpoints. Adversaries repeatedly query /api/show, /api/tags, and /api/v1/models to systematically extract sensitive model information including architecture details, fine-tuning parameters, system paths, Modelfile configurations, and proprietary customizations. Multiple inspection attempts within a 15-minute window indicate automated exfiltration of valuable intellectual property such as custom model configurations, system prompts, and internal model specifications. This activity represents unauthorized data disclosure that could enable competitive intelligence gathering, model replication, or preparation for advanced attacks against the AI infrastructure.
 data_source:
     - Ollama Server
-search: '`ollama_server` | rex field=_raw "\|\s+(?<status_code>\d+)\s+\|\s+(?<response_time>[\d\.]+)s\s+\|\s+(?<src_ip>[\:\da-f\.]+)\s+\|\s+(?<http_method>\w+)\s+\"(?<uri_path>[^\"]+)\"" | eval src=src_ip | eval dest=uri_path | where response_time > 55 | bin _time span=15m | stats count, avg(response_time) as avg_response_time, max(response_time) as max_response_time by _time, src, dest, uri_path | eval avg_response_time=round(avg_response_time, 2) | eval max_response_time=round(max_response_time, 2) | eval severity=case( avg_response_time > 50, "high", avg_response_time > 40, "medium", 1=1, "low" ) | eval attack_type="Potential Data Exfiltration" | sort -_time | stats count by _time, src, uri_path, avg_response_time, max_response_time, severity, attack_type | `ollama_possible_model_exfiltration_data_leakage_filter`'
+search: |
+    `ollama_server` | rex field=_raw "\|\s+(?<status_code>\d+)\s+\|\s+(?<response_time>[\d\.]+)s\s+\|\s+(?<src_ip>[\:\da-f\.]+)\s+\|\s+(?<http_method>\w+)\s+\"(?<uri_path>[^\"]+)\"" | eval src=src_ip | eval dest=uri_path | where response_time > 55 | bin _time span=15m | stats count, avg(response_time) as avg_response_time, max(response_time) as max_response_time by _time, src, dest, uri_path | eval avg_response_time=round(avg_response_time, 2) | eval max_response_time=round(max_response_time, 2) | eval severity=case( avg_response_time > 50, "high", avg_response_time > 40, "medium", 1=1, "low" ) | eval attack_type="Potential Data Exfiltration" | sort -_time | stats count by _time, src, uri_path, avg_response_time, max_response_time, severity, attack_type | `ollama_possible_model_exfiltration_data_leakage_filter`
 how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
 known_false_positives: Legitimate administrative activities such as model inventory management, monitoring dashboards polling model status, automated health checks verifying model availability, CI/CD pipelines validating deployments, development tools inspecting model configurations, or users browsing available models through management interfaces may trigger this detection during normal operations. Adjust the threshold based on your environment's baseline activity.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -40,15 +41,15 @@ product:
     - Splunk Cloud
 category: application
 security_domain: endpoint
+deprecation_info:
+    reason: This experimental rule is being deprecated while we enhance Ollama exfiltration detection. Access requests and response timing alone do not show what data was returned or transferred, so stronger evidence and correlation are needed.
+    removed_in_version: 6.12.0
+    replacement_content: []
 tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log
-          sourcetype: ollama:server
           source: server.log
-      test_type: experimental
+          sourcetype: ollama:server
       description: This test is a legacy experimental test and may not be accurate.
-deprecation_info:
-    reason: This experimental rule is being deprecated while we enhance Ollama exfiltration detection. Access requests and response timing alone do not show what data was returned or transferred, so stronger evidence and correlation are needed.
-    removed_in_version: 6.12.0
-    replacement_content: []
+      test_type: experimental
diff --git a/detections/deprecated/ollama_possible_rce_via_model_loading.yml b/detections/deprecated/ollama_possible_rce_via_model_loading.yml
index 8fdeddd5eea..f7afe6ca5d0 100644
--- a/detections/deprecated/ollama_possible_rce_via_model_loading.yml
+++ b/detections/deprecated/ollama_possible_rce_via_model_loading.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: Detects Ollama server errors and failures during model loading operations that may indicate malicious model injection, path traversal attempts, or exploitation of model loading mechanisms to achieve remote code execution. Adversaries may attempt to load specially crafted malicious models or exploit vulnerabilities in the model loading process to execute arbitrary code on the server. This detection monitors error messages and failure patterns that could signal attempts to abuse model loading functionality for malicious purposes.
 data_source:
     - Ollama Server
-search: '`ollama_server` level=ERROR ("*llama runner*" OR "*model*" OR "*server.go*" OR "*exited*") | rex field=_raw "source=(?<code_source>[^\s]+)" | rex field=_raw "msg=\"(?<msg>[^\"]+)\"" | rex field=_raw "err=\"(?<err>[^\"]+)\"" | rex field=_raw "level=(?<log_level>\w+)" | eval error_type=case( match(_raw, "exited"), "service_crash", match(_raw, "model"), "model_error", match(_raw, "llama runner"), "runner_error", 1=1, "unknown_error" ) | bin _time span=1h | stats count as error_count, earliest(_time) as first_error, latest(_time) as last_error, values(msg) as error_messages, values(err) as error_details, values(code_source) as code_sources, values(error_type) as error_types, dc(error_type) as unique_error_types by host | where error_count > 0 | eval first_error=strftime(first_error, "%Y-%m-%d %H:%M:%S") | eval last_error=strftime(last_error, "%Y-%m-%d %H:%M:%S") | eval severity=case( match(error_details, "exit status") OR error_count > 5, "critical", error_count > 2, "high", 1=1, "medium" ) | eval attack_type="Suspicious Model Loading / Potential RCE" | stats count by first_error, last_error, host, code_sources, error_count, unique_error_types, error_types, error_messages, error_details, severity, attack_type | `ollama_possible_rce_via_model_loading_filter`'
+search: |
+    `ollama_server` level=ERROR ("*llama runner*" OR "*model*" OR "*server.go*" OR "*exited*") | rex field=_raw "source=(?<code_source>[^\s]+)" | rex field=_raw "msg=\"(?<msg>[^\"]+)\"" | rex field=_raw "err=\"(?<err>[^\"]+)\"" | rex field=_raw "level=(?<log_level>\w+)" | eval error_type=case( match(_raw, "exited"), "service_crash", match(_raw, "model"), "model_error", match(_raw, "llama runner"), "runner_error", 1=1, "unknown_error" ) | bin _time span=1h | stats count as error_count, earliest(_time) as first_error, latest(_time) as last_error, values(msg) as error_messages, values(err) as error_details, values(code_source) as code_sources, values(error_type) as error_types, dc(error_type) as unique_error_types by host | where error_count > 0 | eval first_error=strftime(first_error, "%Y-%m-%d %H:%M:%S") | eval last_error=strftime(last_error, "%Y-%m-%d %H:%M:%S") | eval severity=case( match(error_details, "exit status") OR error_count > 5, "critical", error_count > 2, "high", 1=1, "medium" ) | eval attack_type="Suspicious Model Loading / Potential RCE" | stats count by first_error, last_error, host, code_sources, error_count, unique_error_types, error_types, error_messages, error_details, severity, attack_type | `ollama_possible_rce_via_model_loading_filter`
 how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
 known_false_positives: Corrupted model files from interrupted downloads, insufficient disk space or memory during legitimate model loading, incompatible model formats or versions, network timeouts when pulling models from registries, file permission issues in multi-user environments, or genuine configuration errors during initial Ollama setup may generate similar error patterns during normal operations.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$host$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$", | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: host
@@ -40,14 +41,14 @@ product:
     - Splunk Cloud
 category: application
 security_domain: endpoint
+deprecation_info:
+    reason: This experimental rule is being deprecated while we enhance Ollama model-loading detection. Model-loading errors alone do not confirm code execution, so the detection needs stronger evidence of execution.
+    removed_in_version: 6.12.0
+    replacement_content: []
 tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log
-          sourcetype: ollama:server
           source: app.log
+          sourcetype: ollama:server
       test_type: unit
-deprecation_info:
-    reason: This experimental rule is being deprecated while we enhance Ollama model-loading detection. Model-loading errors alone do not confirm code execution, so the detection needs stronger evidence of execution.
-    removed_in_version: 6.12.0
-    replacement_content: []
diff --git a/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml b/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml
index 691b8187d54..8d338c4c2e7 100644
--- a/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml
+++ b/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs. This detection monitors /api/generate and /api/chat endpoints for requests exceeding 30 seconds, which may indicate sophisticated jailbreak techniques, multi-stage prompt injections, or attempts to extract sensitive information from the model.
 data_source:
     - Ollama Server
-search: '`ollama_server` "GIN" ("*/api/generate*" OR "*/v1/chat/completions*") | rex field=_raw "\|\s+(?<status_code>\d+)\s+\|\s+(?<response_time>[\d\.]+[a-z]+)\s+\|\s+(?<src_ip>[\:\da-f\.]+)\s+\|\s+(?<http_method>\w+)\s+\"(?<uri_path>[^\"]+)\"" | rex field=response_time "^(?:(?<minutes>\d+)m)?(?<seconds>[\d\.]+)s$" | eval response_time_seconds=if(isnotnull(minutes), tonumber(minutes)*60+tonumber(seconds), tonumber(seconds)) | eval src=src_ip | where response_time_seconds > 30 | bin _time span=10m | stats count as long_request_count, avg(response_time_seconds) as avg_response_time, max(response_time_seconds) as max_response_time, values(uri_path) as uri_path, values(status_code) as status_codes by _time, src, host | where long_request_count > 170 | eval avg_response_time=round(avg_response_time, 2) | eval max_response_time=round(max_response_time, 2) | eval severity=case( long_request_count > 50 OR max_response_time > 55, "critical", long_request_count > 20 OR max_response_time > 40, "high", 1=1, "medium" ) | eval attack_type="Potential Prompt Injection / Jailbreak" | table _time, host, src, uri_path, long_request_count, avg_response_time, max_response_time, status_codes, severity, attack_type | `ollama_suspicious_prompt_injection_jailbreak_filter`'
+search: |
+    `ollama_server` "GIN" ("*/api/generate*" OR "*/v1/chat/completions*") | rex field=_raw "\|\s+(?<status_code>\d+)\s+\|\s+(?<response_time>[\d\.]+[a-z]+)\s+\|\s+(?<src_ip>[\:\da-f\.]+)\s+\|\s+(?<http_method>\w+)\s+\"(?<uri_path>[^\"]+)\"" | rex field=response_time "^(?:(?<minutes>\d+)m)?(?<seconds>[\d\.]+)s$" | eval response_time_seconds=if(isnotnull(minutes), tonumber(minutes)*60+tonumber(seconds), tonumber(seconds)) | eval src=src_ip | where response_time_seconds > 30 | bin _time span=10m | stats count as long_request_count, avg(response_time_seconds) as avg_response_time, max(response_time_seconds) as max_response_time, values(uri_path) as uri_path, values(status_code) as status_codes by _time, src, host | where long_request_count > 170 | eval avg_response_time=round(avg_response_time, 2) | eval max_response_time=round(max_response_time, 2) | eval severity=case( long_request_count > 50 OR max_response_time > 55, "critical", long_request_count > 20 OR max_response_time > 40, "high", 1=1, "medium" ) | eval attack_type="Potential Prompt Injection / Jailbreak" | table _time, host, src, uri_path, long_request_count, avg_response_time, max_response_time, status_codes, severity, attack_type | `ollama_suspicious_prompt_injection_jailbreak_filter`
 how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
 known_false_positives: Legitimate complex queries requiring extensive model reasoning, large context windows processing substantial amounts of text, batch processing operations, or resource-constrained systems experiencing performance degradation may trigger this detection during normal operations.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -42,15 +43,15 @@ product:
     - Splunk Cloud
 category: application
 security_domain: endpoint
+deprecation_info:
+    reason: This experimental rule is being deprecated while we enhance Ollama prompt-injection detection. Long response times do not reveal prompt content or show that safeguards were bypassed, so they are not enough to identify these attacks reliably.
+    removed_in_version: 6.12.0
+    replacement_content:
+        - Ollama Long-Running Inference Requests
 tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log
-          sourcetype: ollama:server
           source: server.log
+          sourcetype: ollama:server
       test_type: unit
-deprecation_info:
-    reason: This experimental rule is being deprecated while we enhance Ollama prompt-injection detection. Long response times do not reveal prompt content or show that safeguards were bypassed, so they are not enough to identify these attacks reliably.
-    removed_in_version: 6.12.0
-    replacement_content:
-        - Ollama Long-Running Inference Requests
diff --git a/detections/deprecated/possible_browser_pass_view_parameter.yml b/detections/deprecated/possible_browser_pass_view_parameter.yml
index b21bcb9a319..b41c5f70ece 100644
--- a/detections/deprecated/possible_browser_pass_view_parameter.yml
+++ b/detections/deprecated/possible_browser_pass_view_parameter.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process  IN ("*/stext *", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*", "*/LoadPasswordsOpera*", "*/LoadPasswordsSafari*" , "*/UseOperaPasswordFile*", "*/OperaPasswordFile*","*/stab*", "*/scomma*", "*/stabular*", "*/shtml*", "*/sverhtml*", "*/sxml*", "*/skeepass*" ) AND Processes.process IN ("*\\temp\\*", "*\\users\\public\\*", "*\\programdata\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_browser_pass_view_parameter_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*/stext *", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*", "*/LoadPasswordsOpera*", "*/LoadPasswordsSafari*", "*/UseOperaPasswordFile*", "*/OperaPasswordFile*", "*/stab*", "*/scomma*", "*/stabular*", "*/shtml*", "*/sverhtml*", "*/sxml*", "*/skeepass*") Processes.process IN ("*\\temp\\*", "*\\users\\public\\*", "*\\programdata\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_browser_pass_view_parameter_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positive is quite limited. Filter is needed
 references:
@@ -28,6 +29,11 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated due to duplicated content already covered by other detections.
+    removed_in_version: 6.12.0
+    replacement_content:
+        - Windows NirSoft Utilities
 tests:
     - name: True Positive Test
       attack_data:
@@ -35,8 +41,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated due to duplicated content already covered by other detections.
-    removed_in_version: 6.12.0
-    replacement_content:
-        - Windows NirSoft Utilities
diff --git a/detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml b/detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml
index ec137b5b28c..7b8bb088733 100644
--- a/detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml
+++ b/detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name!=microsoft.workflow.compiler.exe
-        AND
-        Processes.original_file_name=Microsoft.Workflow.Compiler.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_microsoft_workflow_compiler_rename_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.process_name="*microsoft.workflow.compiler.exe" Processes.original_file_name="Microsoft.Workflow.Compiler.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_rename_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may use a moved copy of microsoft.workflow.compiler.exe, triggering a false positive.
 references:
@@ -49,6 +35,11 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
+    removed_in_version: 6.10.0
+    replacement_content:
+        - Windows Renamed LOLBAS Binary was Executed
 tests:
     - name: True Positive Test
       attack_data:
@@ -56,8 +47,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
-    removed_in_version: 6.10.0
-    replacement_content:
-        - Windows Renamed LOLBAS Binary was Executed
diff --git a/detections/deprecated/suspicious_msbuild_rename.yml b/detections/deprecated/suspicious_msbuild_rename.yml
index 4fb2bbb641e..a16a74ecc27 100644
--- a/detections/deprecated/suspicious_msbuild_rename.yml
+++ b/detections/deprecated/suspicious_msbuild_rename.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name!=msbuild.exe
-        AND
-        Processes.original_file_name=MSBuild.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_msbuild_rename_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.process_name="*msbuild.exe" Processes.original_file_name="MSBuild.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_msbuild_rename_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may use a moved copy of msbuild, triggering a false positive.
 references:
@@ -51,6 +37,11 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
+    removed_in_version: 6.10.0
+    replacement_content:
+        - Windows Renamed LOLBAS Binary was Executed
 tests:
     - name: True Positive Test
       attack_data:
@@ -58,8 +49,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
-    removed_in_version: 6.10.0
-    replacement_content:
-        - Windows Renamed LOLBAS Binary was Executed
diff --git a/detections/deprecated/windows_lolbas_executed_as_renamed_file.yml b/detections/deprecated/windows_lolbas_executed_as_renamed_file.yml
index 94d1538a1af..0354c5ed5a5 100644
--- a/detections/deprecated/windows_lolbas_executed_as_renamed_file.yml
+++ b/detections/deprecated/windows_lolbas_executed_as_renamed_file.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '|  tstats `security_content_summariesonly` latest(Processes.parent_process) as parent_process, latest(Processes.process) as process, latest(Processes.process_guid) as process_guid count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where NOT Processes.original_file_name IN("-","unknown") AND NOT Processes.process_path IN ("*\\Program Files*","*\\PROGRA~*","*\\Windows\\System32\\*","*\\Windows\\Syswow64\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` | where NOT match(process_name, "(?i)".original_file_name) | lookup local=t lolbas_file_path lolbas_file_name as original_file_name OUTPUT description as desc | search desc!="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lolbas_executed_as_renamed_file_filter`'
+search: |
+    |  tstats `security_content_summariesonly` latest(Processes.parent_process) as parent_process, latest(Processes.process) as process, latest(Processes.process_guid) as process_guid count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where NOT Processes.original_file_name IN("-","unknown") AND NOT Processes.process_path IN ("*\\Program Files*","*\\PROGRA~*","*\\Windows\\System32\\*","*\\Windows\\Syswow64\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` | where NOT match(process_name, "(?i)".original_file_name) | lookup local=t lolbas_file_path lolbas_file_name as original_file_name OUTPUT description as desc | search desc!="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lolbas_executed_as_renamed_file_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: A certain amount of false positives are likely with this detection. MSI based installers often trigger for SETUPAPL.dll and vendors will often copy system exectables to a different path for application usage.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The file originally named $original_file_name$ was executed as $process_name$ on $dest$
     entity:
@@ -56,6 +57,11 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated due to renaming of its newer version.
+    removed_in_version: 6.10.0
+    replacement_content:
+        - Windows Renamed LOLBAS Binary was Executed
 tests:
     - name: True Positive Test
       attack_data:
@@ -63,8 +69,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated due to renaming of its newer version.
-    removed_in_version: 6.10.0
-    replacement_content:
-        - Windows Renamed LOLBAS Binary was Executed
diff --git a/detections/deprecated/windows_nirsoft_advancedrun.yml b/detections/deprecated/windows_nirsoft_advancedrun.yml
index 8e8fc5ffdff..4b824572639 100644
--- a/detections/deprecated/windows_nirsoft_advancedrun.yml
+++ b/detections/deprecated/windows_nirsoft_advancedrun.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=advancedrun.exe
-            OR
-            Processes.original_file_name=advancedrun.exe
-        )
-        Processes.process IN ("*EXEFilename*","*/cfg*","*RunAs*", "*WindowState*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_nirsoft_advancedrun_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*advancedrun.exe" OR Processes.original_file_name="advancedrun.exe" Processes.process IN ("*EXEFilename*", "*/cfg*", "*RunAs*", "*WindowState*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_nirsoft_advancedrun_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited as it is specific to AdvancedRun. Filter as needed based on legitimate usage.
 references:
@@ -44,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of advancedrun.exe, $process_name$, was spawned by $parent_process_name$ on $dest$ by $user$.
     entity:
@@ -78,6 +61,11 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated due to duplicated content already covered by other detections.
+    removed_in_version: 6.12.0
+    replacement_content:
+        - Windows NirSoft Utilities
 tests:
     - name: True Positive Test
       attack_data:
@@ -85,8 +73,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated due to duplicated content already covered by other detections.
-    removed_in_version: 6.12.0
-    replacement_content:
-        - Windows NirSoft Utilities
diff --git a/detections/deprecated/windows_process_injection_into_notepad.yml b/detections/deprecated/windows_process_injection_into_notepad.yml
index d4869ca37be..6f891a484a2 100644
--- a/detections/deprecated/windows_process_injection_into_notepad.yml
+++ b/detections/deprecated/windows_process_injection_into_notepad.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects process injection into Notepad.exe using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40 and 0x1fffff) to Notepad.exe, excluding common system paths like System32, Syswow64, and Program Files. This behavior is often associated with the SliverC2 framework by BishopFox. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code within Notepad.exe. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment.
 data_source:
     - Sysmon EventID 10
-search: '`sysmon` EventCode=10 TargetImage IN (*\\notepad.exe) NOT (SourceImage IN ("*\\system32\\*","*\\syswow64\\*","*\\Program Files\\*")) GrantedAccess IN ("0x40","0x1fffff") | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_into_notepad_filter`'
+search: |
+    `sysmon` EventCode=10 TargetImage="*\\notepad.exe" NOT (SourceImage IN ("*\\system32\\*", "*\\syswow64\\*", "*\\Program Files\\*")) GrantedAccess IN ("0x40", "0x1fffff") | eval granted_access=granted_access, parent_process_path=parent_process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest user_id process_name process_guid process_id signature SourceImage TargetImage GrantedAccess CallTrace | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_into_notepad_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: False positives may be present based on SourceImage paths. If removing the paths is important, realize svchost and many native binaries inject into notepad consistently. Restrict or tune as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -48,6 +49,11 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated as it is already covered by the" Windows Process Injection into Commonly Abused Processes" detection.
+    removed_in_version: 6.10.0
+    replacement_content:
+        - Windows Process Injection into Commonly Abused Processes
 tests:
     - name: True Positive Test
       attack_data:
@@ -55,8 +61,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated as it is already covered by the" Windows Process Injection into Commonly Abused Processes" detection.
-    removed_in_version: 6.10.0
-    replacement_content:
-        - Windows Process Injection into Commonly Abused Processes
diff --git a/detections/deprecated/windows_regsvr32_renamed_binary.yml b/detections/deprecated/windows_regsvr32_renamed_binary.yml
index 4d6940c412e..33795ce9eb6 100644
--- a/detections/deprecated/windows_regsvr32_renamed_binary.yml
+++ b/detections/deprecated/windows_regsvr32_renamed_binary.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name != regsvr32.exe
-        AND
-        Processes.original_file_name=regsvr32.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_regsvr32_renamed_binary_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.process_name="*regsvr32.exe" Processes.original_file_name="regsvr32.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_regsvr32_renamed_binary_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -39,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: regsvr32 was renamed as $process_name$ on $dest$
     entity:
@@ -58,6 +44,11 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
+    removed_in_version: 6.10.0
+    replacement_content:
+        - Windows Renamed LOLBAS Binary was Executed
 tests:
     - name: True Positive Test
       attack_data:
@@ -65,8 +56,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
-    removed_in_version: 6.10.0
-    replacement_content:
-        - Windows Renamed LOLBAS Binary was Executed
diff --git a/detections/deprecated/windows_renamed_powershell_execution.yml b/detections/deprecated/windows_renamed_powershell_execution.yml
index dbb8ef8e183..3b533ac4c81 100644
--- a/detections/deprecated/windows_renamed_powershell_execution.yml
+++ b/detections/deprecated/windows_renamed_powershell_execution.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies instances where the PowerShell executable has been renamed and executed under an alternate filename. This behavior is commonly associated with attempts to evade security controls or bypass logging mechanisms that monitor standard PowerShell usage. While rare in legitimate environments, renamed PowerShell binaries are frequently observed in malicious campaigns leveraging Living-off-the-Land Binaries (LOLBins) and fileless malware techniques. This detection flags executions of PowerShell where the process name does not match the default powershell.exe or pwsh.exe, especially when invoked from unusual paths or accompanied by suspicious command-line arguments.
 data_source:
     - Sysmon EventID 1
-search: "| tstats `security_content_summariesonly`\n  count min(_time) as firstTime\n        max(_time) as lastTime\n\nfrom datamodel=Endpoint.Processes where\n\n(\n  Processes.original_file_name = PowerShell.EXE\n  Processes.process_name != powershell.exe\n)\nOR\n(\n  Processes.original_file_name = pwsh.dll\n  Processes.process_name != pwsh.exe\n)\nOR\n(\n  Processes.original_file_name = powershell_ise.EXE\n  Processes.process_name != powershell_ise.exe\n)\n\nby Processes.action Processes.dest Processes.original_file_name Processes.parent_process\n   Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id\n   Processes.parent_process_name Processes.parent_process_path Processes.process\n   Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id\n   Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user\n   Processes.user_id Processes.vendor_product\n\n| `drop_dm_object_name(Processes)`\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `windows_renamed_powershell_execution_filter`\n"
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.original_file_name="PowerShell.EXE" NOT Processes.process_name="*powershell.exe") OR (Processes.original_file_name="pwsh.dll" NOT Processes.process_name="*pwsh.exe") OR (Processes.original_file_name="powershell_ise.EXE" NOT Processes.process_name="*powershell_ise.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_renamed_powershell_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -42,6 +43,11 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
+    removed_in_version: 6.10.0
+    replacement_content:
+        - Windows Renamed Command Interpreter was Executed
 tests:
     - name: True Positive Test
       attack_data:
@@ -49,8 +55,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons.
-    removed_in_version: 6.10.0
-    replacement_content:
-        - Windows Renamed Command Interpreter was Executed
diff --git a/detections/deprecated/wmi_temporary_event_subscription.yml b/detections/deprecated/wmi_temporary_event_subscription.yml
index abe30ff2973..16448ce9a6a 100644
--- a/detections/deprecated/wmi_temporary_event_subscription.yml
+++ b/detections/deprecated/wmi_temporary_event_subscription.yml
@@ -8,7 +8,7 @@ status: deprecated
 type: TTP
 description: The following analytic detects the creation of WMI temporary event subscriptions. It leverages Windows Event Logs, specifically EventCode 5860, to identify these activities. This detection is significant because attackers often use WMI to execute commands, gather information, or maintain persistence within a compromised system. If confirmed malicious, this activity could allow an attacker to execute arbitrary code, escalate privileges, or persist in the environment. Analysts should review the specific WMI queries and assess their intent, considering potential false positives from legitimate administrative tasks.
 data_source: []
-search: |-
+search: |
     `wmi`
     EventCode=5860
     Temporary
@@ -19,8 +19,7 @@ search: |-
         query!="FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'"
     | stats count min(_time) as firstTime
                   max(_time) as lastTime
-      by ComputerName, query
-    | `security_content_ctime(firstTime)`
+      by ComputerName, query dest | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `wmi_temporary_event_subscription_filter`
 how_to_implement: To successfully implement this search, you must be ingesting the Windows WMI activity logs. This can be done by adding a stanza to inputs.conf on the system generating logs with a title of [WinEventLog://Microsoft-Windows-WMI-Activity/Operational].
@@ -44,8 +43,8 @@ product:
 category: endpoint
 security_domain: endpoint
 deprecation_info:
-    reason: |-
-        This rule is deprecated in its current form because EventID 5860 identifies temporary subscriptions rather than permanent persistence, and the broad match with exact query-string exceptions does not reliably distinguish malicious use from legitimate software.
-        Temporary WMI activity may warrant a separate behavior-focused detection.
+    reason: 'This rule is deprecated in its current form because EventID 5860 identifies temporary subscriptions rather than permanent persistence, and the broad match with exact query-string exceptions does not reliably distinguish malicious use from legitimate software.
+
+        Temporary WMI activity may warrant a separate behavior-focused detection.'
     removed_in_version: 6.10.0
     replacement_content: []
diff --git a/detections/deprecated/xmrig_driver_loaded.yml b/detections/deprecated/xmrig_driver_loaded.yml
index 325f1d027df..1f565375db9 100644
--- a/detections/deprecated/xmrig_driver_loaded.yml
+++ b/detections/deprecated/xmrig_driver_loaded.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the installation of the XMRIG coinminer driver on a system. It identifies the loading of the `WinRing0x64.sys` driver, commonly associated with XMRIG, by analyzing Sysmon EventCode 6 logs for specific signatures and image loads. This activity is significant because XMRIG is an open-source CPU miner frequently exploited by adversaries to mine cryptocurrency illicitly. If confirmed malicious, this activity could lead to unauthorized resource consumption, degraded system performance, and potential financial loss due to unauthorized cryptocurrency mining.
 data_source:
     - Sysmon EventID 6
-search: '`sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\WinRing0x64.sys" |  stats  min(_time) as firstTime max(_time) as lastTime count by ImageLoaded dest dvc process_hash process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `xmrig_driver_loaded_filter`'
+search: |
+    `sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded="*\\WinRing0x64.sys" | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc process_hash process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `xmrig_driver_loaded_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: False positives should be limited.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A driver $ImageLoaded$ related to xmrig crytominer loaded in host $dest$
     entity:
@@ -42,6 +43,12 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated as it is inaccurate. WinRing0x64.sys is not related to XMRIG. It is a driver that is used to access the hardware ring0.
+    removed_in_version: 6.10.0
+    replacement_content:
+        - Windows Vulnerable Driver Installed
+        - Windows Vulnerable Driver Loaded
 tests:
     - name: True Positive Test
       attack_data:
@@ -49,9 +56,3 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
-deprecation_info:
-    reason: Detection deprecated as it is inaccurate. WinRing0x64.sys is not related to XMRIG. It is a driver that is used to access the hardware ring0.
-    removed_in_version: 6.10.0
-    replacement_content:
-        - Windows Vulnerable Driver Installed
-        - Windows Vulnerable Driver Loaded
diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml
index b5f97127630..f924acf0db9 100644
--- a/detections/endpoint/7zip_commandline_to_smb_share_path.yml
+++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name ="7z.exe" OR Processes.process_name = "7za.exe" OR Processes.process_name = "7zr.exe" OR Processes.original_file_name = "7z.exe" OR Processes.original_file_name =  "7za.exe" OR Processes.original_file_name =  "7zr.exe") AND (Processes.process="*\\C$\\*" OR Processes.process="*\\Admin$\\*" OR Processes.process="*\\IPC$\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `7zip_commandline_to_smb_share_path_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*7z.exe", "*7za.exe", "*7zr.exe") OR Processes.original_file_name IN ("7z.exe", "7za.exe", "7zr.exe") Processes.process IN ("*\\C$\\*", "*\\Admin$\\*", "*\\IPC$\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `7zip_commandline_to_smb_share_path_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml
index bb435a02c50..99186a396f6 100644
--- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml
+++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml
@@ -9,22 +9,8 @@ type: TTP
 description: The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. It leverages Sysmon logs, specifically EventCode 10, to identify suspicious call traces to dbgcore.dll and dbghelp.dll associated with lsass.exe. This activity is significant as it often precedes the theft of sensitive login credentials, posing a high risk of unauthorized access to systems and data. If confirmed malicious, attackers could gain access to critical credentials, enabling further compromise and lateral movement within the network.
 data_source:
     - Sysmon EventID 10
-search: |-
-    `sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll*
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY CallTrace EventID GrantedAccess
-           Guid Opcode ProcessID
-           SecurityID SourceImage SourceProcessGUID
-           SourceProcessId TargetImage TargetProcessGUID
-           TargetProcessId UserID dest
-           granted_access parent_process_exec parent_process_guid
-           parent_process_id parent_process_name parent_process_path
-           process_exec process_guid process_id
-           process_name process_path signature
-           signature_id user_id vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `access_lsass_memory_for_dump_creation_filter`
+search: |
+    `sysmon` EventCode=10 TargetImage="*lsass.exe" CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*") | eval granted_access=granted_access, parent_process_path=parent_process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest user_id process_name process_guid process_id signature SourceImage TargetImage GrantedAccess CallTrace | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter`
 how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
 known_false_positives: Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual.
 references:
@@ -38,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: process $SourceImage$ injected into $TargetImage$ and was attempted dump LSASS on $dest$. Adversaries tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
     entity:
diff --git a/detections/endpoint/active_directory_lateral_movement_identified.yml b/detections/endpoint/active_directory_lateral_movement_identified.yml
index 2877582be1e..a73a74d7407 100644
--- a/detections/endpoint/active_directory_lateral_movement_identified.yml
+++ b/detections/endpoint/active_directory_lateral_movement_identified.yml
@@ -8,7 +8,7 @@ status: production
 type: Correlation
 description: The following analytic identifies potential lateral movement activities within an organization's Active Directory (AD) environment. It detects this activity by correlating multiple analytics from the Active Directory Lateral Movement analytic story within a specified time frame. This is significant for a SOC as lateral movement is a common tactic used by attackers to expand their access within a network, posing a substantial risk. If confirmed malicious, this activity could allow attackers to escalate privileges, access sensitive information, and persist within the environment, leading to severe security breaches.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
       WHERE All_Risk.analyticstories="Active Directory Lateral Movement" All_Risk.risk_object_type="system"
       BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$risk_object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Active Directory Lateral Movement Identified - $risk_object$
     entity:
diff --git a/detections/endpoint/active_directory_privilege_escalation_identified.yml b/detections/endpoint/active_directory_privilege_escalation_identified.yml
index 1c6e402a55b..23c846cf4f8 100644
--- a/detections/endpoint/active_directory_privilege_escalation_identified.yml
+++ b/detections/endpoint/active_directory_privilege_escalation_identified.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Correlation
 description: The following analytic identifies potential privilege escalation activities within an organization's Active Directory (AD) environment. It detects this activity by correlating multiple analytics from the Active Directory Privilege Escalation analytic story within a specified time frame. This is significant for a SOC as it helps identify coordinated attempts to gain elevated privileges, which could indicate a serious security threat. If confirmed malicious, this activity could allow attackers to gain unauthorized access to sensitive systems and data, leading to potential data breaches and further compromise of the network.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
       WHERE All_Risk.analyticstories="Active Directory Privilege Escalation" All_Risk.risk_object_type="system"
       BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$risk_object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Active Directory Privilege Escalation Identified - $risk_object$
     entity:
diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml
index 2a82d37ecac..de9c0439f54 100644
--- a/detections/endpoint/active_setup_registry_autostart.yml
+++ b/detections/endpoint/active_setup_registry_autostart.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects suspicious modifications to the Active Setup registry for persistence and privilege escalation. It leverages data from the Endpoint.Registry data model, focusing on changes to the "StubPath" value within the "SOFTWARE\\Microsoft\\Active Setup\\Installed Components" path. This activity is significant as it is commonly used by malware, adware, and APTs to maintain persistence on compromised machines. If confirmed malicious, this could allow attackers to execute code upon system startup, potentially leading to further system compromise and unauthorized access.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_name="*StubPath" Registry.registry_path="*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `active_setup_registry_autostart_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: Active setup installer may add or modify this registry.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: modified/added/deleted registry entry $registry_path$ on $dest$
     entity:
diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml
index 66377be96ea..dd71c50977a 100644
--- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml
+++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml
@@ -10,7 +10,8 @@ description: The following analytic detects suspicious registry modifications th
 data_source:
     - Sysmon EventID 12
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.status Registry.user Registry.vendor_product Registry.registry_value_name | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml
index 830893e8bf1..9d1886262cf 100644
--- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml
+++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml
@@ -6,53 +6,45 @@ modification_date: '2026-06-08'
 author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects the use of commands to add or set exclusions
+description: 'The following analytic detects the use of commands to add or set exclusions
+
     in Windows Defender. It leverages data from Endpoint Detection and Response (EDR)
+
     agents, focusing on command-line executions involving "Add-MpPreference" or "Set-MpPreference"
+
     with exclusion parameters. This activity is significant because adversaries often
+
     use it to bypass Windows Defender, allowing malicious code to execute undetected.
+
     If confirmed malicious, this behavior could enable attackers to evade antivirus
+
     detection, maintain persistence, and execute further malicious activities without
-    interference from Windows Defender.
+
+    interference from Windows Defender.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    (
-      Processes.process = "*Add-MpPreference *"
-      OR
-      Processes.process = "*Set-MpPreference *"
-    )
-    Processes.process IN (
-          "*-Exclusion*",
-          "*-ControlledFolderAccessAllowedApplications*",
-          "*-AttackSurfaceReductionOnlyExclusions*"
-          )
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `add_or_set_windows_defender_exclusion_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*Add-MpPreference *", "*Set-MpPreference *") Processes.process IN ("*-Exclusion*", "*-ControlledFolderAccessAllowedApplications*", "*-AttackSurfaceReductionOnlyExclusions*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `add_or_set_windows_defender_exclusion_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    Admin or user may choose to use this windows features. Filter as needed.
+
+    names and speed up the data modeling process.'
+known_false_positives: Admin or user may choose to use this windows features. Filter as needed.
 references:
     - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
     - https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
@@ -66,7 +58,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: exclusion command $process$ executed on $dest$
     entity:
diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml
index 9e7ebdc39cc..f3138e1e4ad 100644
--- a/detections/endpoint/adsisearcher_account_discovery.yml
+++ b/detections/endpoint/adsisearcher_account_discovery.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain users. It leverages PowerShell Script Block Logging (EventCode=4104) to identify script blocks containing `[adsisearcher]`, `objectcategory=user`, and `.findAll()`. This activity is significant as it may indicate an attempt by adversaries or Red Teams to enumerate domain users for situational awareness and Active Directory discovery. If confirmed malicious, this could lead to further reconnaissance, privilege escalation, or lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=user*" ScriptBlockText = "*.findAll()*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `adsisearcher_account_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*[adsisearcher]*" Processes.process="*objectcategory=user*" Processes.process="*.findAll()*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `adsisearcher_account_discovery_filter`
 how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -36,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Powershell process have been used for user enumeration on $dest$
     entity:
diff --git a/detections/endpoint/advanced_ip_or_port_scanner_execution.yml b/detections/endpoint/advanced_ip_or_port_scanner_execution.yml
index 81e4057751a..12bd1fdd5ed 100644
--- a/detections/endpoint/advanced_ip_or_port_scanner_execution.yml
+++ b/detections/endpoint/advanced_ip_or_port_scanner_execution.yml
@@ -6,52 +6,39 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner.
+description: 'The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner.
+
     These legitimate administrative tools are often leveraged by threat actors and ransomware operators during the discovery phase to enumerate active hosts and open ports within a target environment.
+
     Detection is based on process creation telemetry referencing known executable names, original file names, or specific command-line parameters such as "/portable" and "/lng" that are characteristic of these tools.
-    If confirmed malicious, this activity may indicate internal reconnaissance aimed at identifying reachable systems or services prior to lateral movement or further post-compromise actions.
+
+    If confirmed malicious, this activity may indicate internal reconnaissance aimed at identifying reachable systems or services prior to lateral movement or further post-compromise actions.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-      from datamodel=Endpoint.Processes where
-        Processes.process_name IN ("advanced_ip_scanner.exe", "advanced_ip_scanner_console.exe", "advanced_port_scanner.exe", "advanced_port_scanner_console.exe")
-        OR
-        Processes.original_file_name IN ("advanced_ip_scanner.exe", "advanced_ip_scanner_console.exe", "advanced_port_scanner.exe", "advanced_port_scanner_console.exe")
-        OR (
-        Processes.process = "* /portable *"
-        Processes.process = "* /lng *"
-        )
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.process="* /portable *" Processes.process="* /lng *") OR Processes.process_name IN ("*advanced_ip_scanner.exe", "*advanced_ip_scanner_console.exe", "*advanced_port_scanner.exe", "*advanced_port_scanner_console.exe") OR Processes.original_file_name IN ("advanced_ip_scanner.exe", "advanced_ip_scanner_console.exe", "advanced_port_scanner.exe", "advanced_port_scanner_console.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `advanced_ip_or_port_scanner_execution_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-      by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-         Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-         Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-         Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `advanced_ip_or_port_scanner_execution_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    Legitimate administrators or IT staff may use Advanced IP or Port Scanner for authorized
-    network management or inventory purposes. Validate the context of execution and apply any filters as necessary.
+
+    names and speed up the data modeling process.'
+known_false_positives: 'Legitimate administrators or IT staff may use Advanced IP or Port Scanner for authorized
+
+    network management or inventory purposes. Validate the context of execution and apply any filters as necessary.'
 references:
     - https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
     - https://cloud.google.com/blog/topics/threat-intelligence/tactics-techniques-procedures-associated-with-maze-ransomware-incidents/
@@ -66,7 +53,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
index cab11153e30..9cf3d2cf240 100644
--- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
+++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
-    from datamodel=Endpoint.Processes where
-    `process_netsh`
-    Processes.process= "*firewall*"
-    Processes.process= "*group=\"File and Printer Sharing\"*"
-    Processes.process="*enable=Yes*"
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process
-       Processes.process_exec Processes.process_guid Processes.process_hash
-       Processes.process_id Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `allow_file_and_printing_sharing_in_firewall_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*netsh.exe" OR Processes.original_file_name="netsh.exe" Processes.process="*firewall*" Processes.process="*group=\"File and Printer Sharing\"*" Processes.process="*enable=Yes*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_file_and_printing_sharing_in_firewall_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network admin may modify this firewall feature that may cause this rule to be triggered.
 references:
@@ -41,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A suspicious modification of firewall to allow file and printer sharing detected on host - $dest$
     entity:
diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
index a5f5fa26760..c2c02dd9d24 100644
--- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
+++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects suspicious modifications to firewall rule registry settings that allow inbound traffic on specific ports with a public profile. It leverages data from the Endpoint.Registry data model, focusing on registry paths and values indicative of such changes. This activity is significant as it may indicate an adversary attempting to grant remote access to a machine by modifying firewall rules. If confirmed malicious, this could enable unauthorized remote access, potentially leading to further exploitation, data exfiltration, or lateral movement within the network.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = "*|Dir=In|*"  Registry.registry_value_data = "*|LPort=*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data="*|Action=Allow|*" Registry.registry_value_data="*|Dir=In|*" Registry.registry_value_data="*|LPort=*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious firewall allow rule modifications were detected via the registry on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
index f84d4cbb989..725a08f6b72 100644
--- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
+++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects a suspicious PowerShell command that allows inbound traffic to a specific local port within the public profile. It leverages PowerShell script block logging (EventCode 4104) to identify commands containing keywords like "firewall," "Inbound," "Allow," and "-LocalPort." This activity is significant because it may indicate an attacker attempting to establish remote access by modifying firewall rules. If confirmed malicious, this could allow unauthorized access to the machine, potentially leading to further exploitation and data exfiltration.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*firewall*" ScriptBlockText = "*Inbound*" ScriptBlockText = "*Allow*"  ScriptBlockText = "*-LocalPort*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `allow_inbound_traffic_in_firewall_rule_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*firewall*" Processes.process="*Inbound*" Processes.process="*Allow*" Processes.process="*-LocalPort*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
 known_false_positives: administrator may allow inbound traffic in certain network or machine.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_id$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious firewall modification detected on endpoint $dest$ by user $user_id$.
     entity:
diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml
index 496538cbd37..8fea155d1d1 100644
--- a/detections/endpoint/allow_network_discovery_in_firewall.yml
+++ b/detections/endpoint/allow_network_discovery_in_firewall.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_netsh` Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*"  Processes.process="*enable*" Processes.process="*Yes*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `allow_network_discovery_in_firewall_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*netsh.exe" OR Processes.original_file_name="netsh.exe" Processes.process="*firewall*" Processes.process="*group=\"Network Discovery\"*" Processes.process="*enable*" Processes.process="*Yes*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_network_discovery_in_firewall_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network admin may modify this firewall feature that may cause this rule to be triggered.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious modification to the firewall to allow network discovery detected on host - $dest$
     entity:
diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml
index ba5d9768b76..679cc72efaf 100644
--- a/detections/endpoint/allow_operation_with_consent_admin.yml
+++ b/detections/endpoint/allow_operation_with_consent_admin.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a registry modification that allows the 'Consent Admin' to perform operations requiring elevation without user consent or credentials. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the 'ConsentPromptBehaviorAdmin' value within the Windows Policies System registry path. This activity is significant as it indicates a potential privilege escalation attempt, which could allow an attacker to execute high-privilege tasks without user approval. If confirmed malicious, this could lead to unauthorized administrative access and control over the compromised machine, posing a severe security risk.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data = "0x00000000") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name  Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="*ConsentPromptBehaviorAdmin" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation.
     entity:
diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml
index cf91169da1f..b60ae17e062 100644
--- a/detections/endpoint/anomalous_usage_of_7zip.yml
+++ b/detections/endpoint/anomalous_usage_of_7zip.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (Processes.parent_process_name IN ("rundll32.exe", "dllhost.exe") Processes.process_name=*7z*) AND NOT Processes.process_path = "C:\\Program Files\\VMware\\VMware Tools\\7za.exe"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `anomalous_usage_of_7zip_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*rundll32.exe", "*dllhost.exe") Processes.process_path="*7z*" NOT Processes.process_path="C:\\Program Files\\VMware\\VMware Tools\\7za.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `anomalous_usage_of_7zip_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited as this behavior is not normal for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml
index 57ab16b66d7..0694ad47640 100644
--- a/detections/endpoint/attacker_tools_on_endpoint.yml
+++ b/detections/endpoint/attacker_tools_on_endpoint.yml
@@ -6,16 +6,17 @@ modification_date: '2026-09-22'
 author: Bhavin Patel, Splunk, sventec, Github Community
 status: production
 type: TTP
-description: |-
-    The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration.
+description: 'The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration.
+
     It leverages process activity data from Endpoint Detection and Response (EDR) agents, focusing on known attacker tool names.
-    This activity is significant because it serves as an early warning system for potential security incidents, enabling prompt response. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further network compromise, posing a severe threat to the organization's security infrastructure.
+
+    This activity is significant because it serves as an early warning system for potential security incidents, enabling prompt response. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further network compromise, posing a severe threat to the organization''s security infrastructure.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
     - Cisco Network Visibility Module Flow Data
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -56,7 +57,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An attacker tool $process_name$, listed in attacker_tools.csv is executed on host $dest$ by User $user$. $process_name$ is known for [$description$].
     entity:
diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml
index 0d9984159be..a5223b135ab 100644
--- a/detections/endpoint/auto_admin_logon_registry_entry.yml
+++ b/detections/endpoint/auto_admin_logon_registry_entry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a suspicious registry modification that enables auto admin logon on a host. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the "AutoAdminLogon" value within the "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" registry path. This activity is significant because it was observed in BlackMatter ransomware attacks to maintain access after a safe mode reboot, facilitating further encryption. If confirmed malicious, this could allow attackers to automatically log in and continue their operations, potentially leading to widespread network encryption and data loss.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND Registry.registry_value_data=1) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `auto_admin_logon_registry_entry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" Registry.registry_value_name="*AutoAdminLogon" Registry.registry_value_data="1" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `auto_admin_logon_registry_entry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon
     entity:
diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml
index 86e914066df..aa34a80ec28 100644
--- a/detections/endpoint/batch_file_write_to_system32.yml
+++ b/detections/endpoint/batch_file_write_to_system32.yml
@@ -6,48 +6,19 @@ modification_date: '2026-07-02'
 author: Steven Dick, Michael Haag, Rico Valdez, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. It leverages data from the Endpoint datamodel, focusing on process and filesystem events to identify this behavior.
+description: 'The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. It leverages data from the Endpoint datamodel, focusing on process and filesystem events to identify this behavior.
+
     This activity is significant because writing batch files to system directories can be indicative of malicious intent, such as persistence mechanisms or system manipulation.
-    If confirmed malicious, this could allow an attacker to execute arbitrary commands with elevated privileges, potentially compromising the entire system.
+
+    If confirmed malicious, this could allow an attacker to execute arbitrary commands with elevated privileges, potentially compromising the entire system.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Filesystem where
-
-    Filesystem.action IN (
-        "created",
-        "modified"
-    )
-    Filesystem.file_path IN (
-        "*:\\Windows\\System32\\*",
-        "*:\\Windows\\SysWOW64\\*"
-    )
-    Filesystem.file_name IN (
-        "*.bat",
-        "*.cmd"
-    )
-
-    by Filesystem.action Filesystem.dest Filesystem.file_access_time
-       Filesystem.file_create_time Filesystem.file_hash
-       Filesystem.file_modify_time Filesystem.file_name
-       Filesystem.file_path Filesystem.file_acl
-       Filesystem.file_size Filesystem.process_guid
-       Filesystem.process_id Filesystem.user Filesystem.vendor_product
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\system32\\*", "*\\syswow64\\*") Filesystem.file_name IN ("*.bat", "*.cmd") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `batch_file_write_to_system32_filter`
+how_to_implement: 'To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `batch_file_write_to_system32_filter`
-how_to_implement: |-
-    To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-    You must also be ingesting the Endpoint.Filesystem data source.
-known_false_positives: |-
-    Some batch files are written to the system32 directory tree for legitimate purposes, such as system maintenance or configuration. Investigate the batch file to determine if it is legitimate and modify the search to add exclusions, as necessary.
+    You must also be ingesting the Endpoint.Filesystem data source.'
+known_false_positives: Some batch files are written to the system32 directory tree for legitimate purposes, such as system maintenance or configuration. Investigate the batch file to determine if it is legitimate and modify the search to add exclusions, as necessary.
 references: []
 drilldown_searches:
     - name: View the detection results for - "$user$" and "$dest$"
@@ -57,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
index ded1151906c..d419d60ef2f 100644
--- a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
+++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = bcdedit.exe Processes.process="*/deletevalue*" Processes.process="*{current}*"  Processes.process="*safeboot*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `bcdedit_command_back_to_normal_mode_boot_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*bcdedit.exe" Processes.process="*/deletevalue*" Processes.process="*{current}*" Processes.process="*safeboot*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: bcdedit process with commandline $process$ to bring back to normal boot configuration the $dest$
     entity:
diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml
index c2c09667a35..46169230b30 100644
--- a/detections/endpoint/bcdedit_failure_recovery_modification.yml
+++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = bcdedit.exe Processes.process="*recoveryenabled*" (Processes.process="* no*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `bcdedit_failure_recovery_modification_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*bcdedit.exe" Processes.process="*recoveryenabled*" Processes.process="* no*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bcdedit_failure_recovery_modification_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may modify the boot configuration.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable the ability to recover the endpoint.
     entity:
diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml
index d60fb19be34..24e2801cb29 100644
--- a/detections/endpoint/bits_job_persistence.yml
+++ b/detections/endpoint/bits_job_persistence.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_bitsadmin` Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*, *setcustomheaders*, *resume* )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `bits_job_persistence_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*bitsadmin.exe" OR Processes.original_file_name="bitsadmin.exe" Processes.process IN ("*create*", "*addfile*", "*setnotifyflags*", "*setnotifycmdline*", "*setminretrydelay*", "*setcustomheaders*", "*resume*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bits_job_persistence_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives will be present. Typically, applications will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments (legitimate applications) or parent process.
 references:
@@ -41,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to persist using BITS.
     entity:
diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml
index 76c73828b14..5de2d5a9aa1 100644
--- a/detections/endpoint/bitsadmin_download_file.yml
+++ b/detections/endpoint/bitsadmin_download_file.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_bitsadmin` Processes.process IN ("*transfer*", "*addfile*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `bitsadmin_download_file_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*bitsadmin.exe" OR Processes.original_file_name="bitsadmin.exe" Processes.process IN ("*transfer*", "*addfile*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bitsadmin_download_file_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives, however it may be required to filter based on parent process name or network connection.
 references:
@@ -41,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file.
     entity:
diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml
index d281486940c..3e31c71ecdd 100644
--- a/detections/endpoint/certutil_exe_certificate_extraction.yml
+++ b/detections/endpoint/certutil_exe_certificate_extraction.yml
@@ -6,45 +6,21 @@ modification_date: '2026-05-13'
 author: Rod Soto, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic identifies the use of certutil.exe with arguments indicating the manipulation or extraction of certificates.
+description: 'The following analytic identifies the use of certutil.exe with arguments indicating the manipulation or extraction of certificates.
+
     It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments.
+
     This activity is significant because extracting certificates can allow attackers to sign new authentication tokens, particularly in federated environments like Windows ADFS.
-    If confirmed malicious, this could enable attackers to forge authentication tokens, potentially leading to unauthorized access and privilege escalation within the network.
+
+    If confirmed malicious, this could enable attackers to forge authentication tokens, potentially leading to unauthorized access and privilege escalation within the network.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    FROM datamodel=Endpoint.Processes
-    WHERE
-    (
-        Processes.process_name=certutil.exe
-        OR
-        Processes.original_file_name=certutil.exe
-    )
-    Processes.process = "*-exportPFX*"
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `certutil_exe_certificate_extraction_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*certutil.exe" OR Processes.original_file_name="certutil.exe" Processes.process="*-exportPFX*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services.
 references:
     - https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack
     - https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html
@@ -56,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate.
     entity:
diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml
index 69b55219b93..13be0c6296b 100644
--- a/detections/endpoint/certutil_with_decode_argument.yml
+++ b/detections/endpoint/certutil_with_decode_argument.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_certutil` Processes.process=*decode*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `certutil_with_decode_argument_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*certutil.exe" OR Processes.original_file_name="CertUtil.exe" Processes.process="*decode*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_with_decode_argument_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Typically seen used to `encode` files, but it is possible to see legitimate use of `decode`. Filter based on parent-child relationship, file paths, endpoint or user.
 references:
@@ -41,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file.
     entity:
diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml
index 04b2cdaf2ab..cc64ab767ba 100644
--- a/detections/endpoint/change_to_safe_mode_with_network_config.yml
+++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = bcdedit.exe Processes.process="*/set*" Processes.process="*{current}*"  Processes.process="*safeboot*" Processes.process="*network*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `change_to_safe_mode_with_network_config_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*bcdedit.exe" Processes.process="*/set*" Processes.process="*{current}*" Processes.process="*safeboot*" Processes.process="*network*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `change_to_safe_mode_with_network_config_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: bcdedit process with commandline $process$ to force safemode boot the $dest$
     entity:
diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml
index cdd24a19464..17092f1b27e 100644
--- a/detections/endpoint/check_elevated_cmd_using_whoami.yml
+++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process = "*whoami*" Processes.process = "*/group*" Processes.process = "* find *" Processes.process = "*12288*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `check_elevated_cmd_using_whoami_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*whoami*" Processes.process="*/group*" Processes.process="* find *" Processes.process="*12288*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `check_elevated_cmd_using_whoami_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: The combination of these commands is unlikely to occur in a production environment. Any matches should be investigated.
 references: []
@@ -36,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Process name $process_name$ with commandline $process$ on $dest$
     entity:
diff --git a/detections/endpoint/cisco_isovalent___access_to_cloud_metadata_service.yml b/detections/endpoint/cisco_isovalent___access_to_cloud_metadata_service.yml
index de466a914b9..323182c6ff0 100644
--- a/detections/endpoint/cisco_isovalent___access_to_cloud_metadata_service.yml
+++ b/detections/endpoint/cisco_isovalent___access_to_cloud_metadata_service.yml
@@ -10,16 +10,7 @@ description: The following analytic detects workloads accessing the cloud instan
 data_source:
     - Cisco Isovalent Process Connect
 search: |
-    `cisco_isovalent_process_connect` | rename process_connect.parent.binary as binary | `excluded_cloud_binaries`
-    | stats count
-            min(_time) as firstTime
-            max(_time) as lastTime
-            values(dest_port) as dest_port
-            values(src_ip) as src_ip
-        by cluster_name pod_name pod_image_name pod_namespace node_name dest_ip
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_isovalent___access_to_cloud_metadata_service_filter`
+    `cisco_isovalent_process_connect` NOT binary="*/app/aws-vpc-cni" NOT binary="*/bin/amazon-ssm-agent" NOT binary="*/bin/ssm-agent-worker" | stats count min(_time) as firstTime max(_time) as lastTime by dest_ip pod_name pod_namespace cluster_name node_name src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_isovalent___access_to_cloud_metadata_service_filter`
 how_to_implement: This detection relies on Cisco Isovalent Runtime Security process_connect telemetry. Deploy Isovalent Runtime Security and the Cisco Security Cloud TA to collect these logs via HEC and normalize them. Optionally, a similar variant can be built with process_exec by looking for command-lines that reference 169.254.169.254 (for example curl or wget invocations from within pods). Please update a macro named `excluded_cloud_binaries` that returns true for binaries that are known to access the cloud metadata service.
 known_false_positives: Legitimate platform components and node agents may query the metadata service. Validate by namespace, labels and workload identity; suppress expected sources and alert on atypical pods or namespaces.
 references:
@@ -34,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$pod_name$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$pod_name$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: pod_name
diff --git a/detections/endpoint/cisco_isovalent___cron_job_creation.yml b/detections/endpoint/cisco_isovalent___cron_job_creation.yml
index 4e8502388f0..ad18430603a 100644
--- a/detections/endpoint/cisco_isovalent___cron_job_creation.yml
+++ b/detections/endpoint/cisco_isovalent___cron_job_creation.yml
@@ -10,16 +10,7 @@ description: The following analytic detects the creation of a cron job within th
 data_source:
     - Cisco Isovalent Process Exec
 search: |
-    `cisco_isovalent_process_exec` process_name IN ("crond","cron","crontab")
-    | search pod_name!=""
-    | stats count
-            min(_time) as firstTime
-            max(_time) as lastTime
-            values(process) as process
-        by cluster_name pod_name parent_process_name process_name process_exec process_id node_name
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_isovalent___cron_job_creation_filter`
+    `cisco_isovalent_process_exec` process_name IN ("crond", "cron", "crontab") NOT pod_name="" | eval cluster_name=cluster_name, pod_name=pod_name, node_name=node_name | stats count min(_time) as firstTime max(_time) as lastTime by process_name process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_isovalent___cron_job_creation_filter`
 how_to_implement: The detection is based on process execution data generated by Cisco Isovalent Runtime Security. Ensure that Isovalent Runtime Security is deployed and configured in your Kubernetes environment to emit process_exec events. Configure the Cisco Security Cloud TA to collect these logs via HTTP Event Collector (HEC) and normalize them into the Splunk Common Information Model. This integration ensures that all relevant pod, container, and process activity is captured for monitoring and detection of suspicious behavior.
 known_false_positives: This activity may be triggered by legitimate administrative scripts, container images, or third-party operators that use cron for scheduled tasks, so please investigate the alert in context to rule out benign operations.
 references:
@@ -34,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$pod_name$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$pod_name$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: pod_name
diff --git a/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml
index eaf17da0a93..5de7707ab69 100644
--- a/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml
+++ b/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$pod_name$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$pod_name$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: pod_name
diff --git a/detections/endpoint/cisco_isovalent___kprobe_spike.yml b/detections/endpoint/cisco_isovalent___kprobe_spike.yml
index 45333da530e..f4ce3bfc1f8 100644
--- a/detections/endpoint/cisco_isovalent___kprobe_spike.yml
+++ b/detections/endpoint/cisco_isovalent___kprobe_spike.yml
@@ -6,12 +6,15 @@ modification_date: '2026-05-13'
 author: Bhavin Patel, Splunk
 status: production
 type: Hunting
-description: |
-    This analytic detects excessive kernel probe (kprobe) events in a Kubernetes cluster over a short period of time.
+description: 'This analytic detects excessive kernel probe (kprobe) events in a Kubernetes cluster over a short period of time.
+
     Kprobes are a Linux kernel debugging and instrumentation mechanism that allows dynamic monitoring and tracing of kernel functions and system calls.
+
     In containerized or cloud-native environments, kprobes are occasionally used for legitimate low-level diagnostics; however, monitoring a spike in kprobe activity is important because malware or attackers may abuse this mechanism to gain insights into the kernel, attempt privilege escalation, or tamper with host processes.
+
     More than 10 kprobe events within 5 minutes may indicate suspicious activity, such as an attacker probing the kernel through repeated system calls (e.g., nsenter, mount, sethostname).
-    Such abnormal volume and frequency of kprobe usage within application pods or on nodes can signal container escape attempts or low-level tampering with the host, thereby representing a potential security threat.
+
+    Such abnormal volume and frequency of kprobe usage within application pods or on nodes can signal container escape attempts or low-level tampering with the host, thereby representing a potential security threat.'
 data_source:
     - Cisco Isovalent Process Kprobe
 search: |
@@ -23,14 +26,16 @@ search: |
             values(process_kprobe.args{}.string_arg) as args
       by pod_name _time
     | where kprobe_count > 10 | `cisco_isovalent___kprobe_spike_filter`
-how_to_implement: |
-    Requires Cisco Isovalent Runtime Security with kprobe tracing enabled and logs
+how_to_implement: 'Requires Cisco Isovalent Runtime Security with kprobe tracing enabled and logs
+
     forwarded into Splunk. Ensure that your Splunk Technology Add-on (TA) for Cisco
+
     Security Cloud parses the kprobe JSON correctly. Tune the threshold based on
-    your workload baseline.
-known_false_positives: |
-    Busy or noisy pods may legitimately produce bursts of kprobe events during normal
-    operation. Tune thresholds and filter by function_name to reduce false positives.
+
+    your workload baseline.'
+known_false_positives: 'Busy or noisy pods may legitimately produce bursts of kprobe events during normal
+
+    operation. Tune thresholds and filter by function_name to reduce false positives.'
 references:
     - https://docs.isovalent.com/user-guide/sec-ops-visibility/process-execution/index.html
 analytic_story:
diff --git a/detections/endpoint/cisco_isovalent___late_process_execution.yml b/detections/endpoint/cisco_isovalent___late_process_execution.yml
index 73797f6f28b..b1358aaafec 100644
--- a/detections/endpoint/cisco_isovalent___late_process_execution.yml
+++ b/detections/endpoint/cisco_isovalent___late_process_execution.yml
@@ -6,24 +6,17 @@ modification_date: '2026-05-13'
 author: Bhavin Patel, Splunk
 status: production
 type: Anomaly
-description: |
-    Detects process executions that occur well after a container has initialized, which can indicate
+description: 'Detects process executions that occur well after a container has initialized, which can indicate
+
     suspicious activity (e.g., interactive shells, injected binaries, or post-compromise tooling).
+
     The analytic compares the process start time to the container start time and flags processes
-    launched more than 5 minutes (300 seconds) after initialization.
+
+    launched more than 5 minutes (300 seconds) after initialization.'
 data_source:
     - Cisco Isovalent Process Exec
 search: |
-    `cisco_isovalent_process_exec` process_name="sh"
-    | rename process_exec.process.start_time as ProcessStartTime
-    | rename process_exec.process.pod.container.start_time as ContainerStartTime
-    | eval ProcessStartTime=strptime(ProcessStartTime, "%Y-%m-%dT%H:%M:%S.%3Q")
-    | eval ContainerStartTime=strptime(ContainerStartTime, "%Y-%m-%dT%H:%M:%S.%9Q")
-    | eval ContainerTime5min=relative_time(ContainerStartTime, "+5m")
-    | where ProcessStartTime > ContainerTime5min
-    | table node_name cluster_name, pod_name, container_id, process_name, process_exec, process, ProcessStartTime, ContainerTime5min | `security_content_ctime(ProcessStartTime)`
-    | `security_content_ctime(ContainerTime5min)`
-    | `cisco_isovalent___late_process_execution_filter`
+    `cisco_isovalent_process_exec` process_name="sh" | eval cluster_name=cluster_name, pod_name=pod_name, node_name=node_name | stats count min(_time) as firstTime max(_time) as lastTime by process_name process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_isovalent___late_process_execution_filter`
 how_to_implement: The detection is based on process execution data generated by Cisco Isovalent Runtime Security. Ensure that Isovalent Runtime Security is deployed and configured in your Kubernetes environment to emit process_exec events. Configure the Cisco Security Cloud TA to collect these logs via HTTP Event Collector (HEC) and normalize them into the Splunk Common Information Model. This integration ensures that all relevant pod, container, and process activity is captured for monitoring and detection of suspicious behavior.
 known_false_positives: This activity may be triggered by legitimate administrative scripts, container images, or third-party operators that use cron for scheduled tasks, so please investigate the alert in context to rule out benign operations.
 references:
@@ -36,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$pod_name$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$pod_name$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: pod_name
diff --git a/detections/endpoint/cisco_isovalent___non_allowlisted_image_use.yml b/detections/endpoint/cisco_isovalent___non_allowlisted_image_use.yml
index 2e52c34ebd0..4f2906fe983 100644
--- a/detections/endpoint/cisco_isovalent___non_allowlisted_image_use.yml
+++ b/detections/endpoint/cisco_isovalent___non_allowlisted_image_use.yml
@@ -6,32 +6,35 @@ modification_date: '2026-05-13'
 author: Bhavin Patel, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects use of container images that fall outside an approved
+description: 'The following analytic detects use of container images that fall outside an approved
+
     allowlist, leveraging Cisco Isovalent/Tetragon runtime telemetry (image name and
+
     workload identity). Adversaries commonly introduce untrusted or newly published
+
     images to deploy tooling, establish persistence, or abuse supply‑chain trust. This
+
     behavior may indicate image pulls from unauthorized registries, execution of
+
     unvetted software, or a drift from established deployment baselines. Extra scrutiny
+
     is warranted for namespaces and workloads that normally source images from restricted
+
     registries, and for pods that suddenly begin running images outside expected
+
     prefixes.
+
     Maintain an environment‑specific allowlist via the macro `cisco_isovalent_allowed_images`
+
     (for example, allow trusted registries/prefixes such as ImageName="gcr.io/org/*",
+
     "registry.local/*", or "myco/*") and keep it updated as new baseline images are
-    introduced. This analytic alerts on images NOT matching the allowlist.
+
+    introduced. This analytic alerts on images NOT matching the allowlist.'
 data_source:
     - Cisco Isovalent Process Exec
 search: |
-    `cisco_isovalent_process_exec` pod_name!=""
-    | search NOT `cisco_isovalent_allowed_images`
-    | stats count
-            min(_time) as firstTime
-            max(_time) as lastTime
-        by pod_image_name pod_namespace pod_name process_name cluster_name
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_isovalent___non_allowlisted_image_use_filter`
+    `cisco_isovalent_process_exec` NOT pod_name="" NOT (pod_image_name IN ("docker.io/library/ubuntu:22.04", "docker.io/grafana/grafana:12.0.1", "quay.io/isovalent-dev/tetragon-ci", "quay.io/isovalent/tetragon-ci", "quay.io/isovalent/hubble-export-fluentd")) | eval cluster_name=cluster_name, pod_name=pod_name, node_name=node_name | stats count min(_time) as firstTime max(_time) as lastTime by process_name process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_isovalent___non_allowlisted_image_use_filter`
 how_to_implement: The detection is based on process execution data generated by Cisco Isovalent Runtime Security. Ensure that Isovalent Runtime Security is deployed and configured in your Kubernetes environment to emit process_exec events. Configure the Cisco Security Cloud TA to collect these logs via HTTP Event Collector (HEC) and normalize them into the Splunk Common Information Model. This integration ensures that all relevant pod, container, and process activity is captured for monitoring and detection of suspicious behavior. Create and maintain an environment‑specific macro named`cisco_isovalent_allowed_images` that returns true for approved images, for example:(ImageName="gcr.io/org/app:*" OR ImageName="registry.local/*" OR ImageName="myco/*"). The search alerts on images NOT matching that allowlist. Tune by namespace or team as needed.
 known_false_positives: New legitimate images during rollouts or blue/green deployments may appear until the allowlist is updated. Coordinate with platform/DevOps teams to synchronize allowlist changes.
 references:
@@ -45,7 +48,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$pod_name$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$pod_name$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: pod_name
diff --git a/detections/endpoint/cisco_isovalent___nsenter_usage_in_kubernetes_pod.yml b/detections/endpoint/cisco_isovalent___nsenter_usage_in_kubernetes_pod.yml
index c26a02c10e6..128c9108baa 100644
--- a/detections/endpoint/cisco_isovalent___nsenter_usage_in_kubernetes_pod.yml
+++ b/detections/endpoint/cisco_isovalent___nsenter_usage_in_kubernetes_pod.yml
@@ -6,24 +6,14 @@ modification_date: '2026-05-13'
 author: Bhavin Patel, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects the execution of the nsenter utility from within a container, a technique often used for exploitation and container escape. Nsenter allows an attacker to enter the namespaces of another process—such as the host's init process (PID 1)—and execute a shell or other binaries with elevated privileges. For example, an attacker may use docker exec to gain a shell in a container, enumerate the PID of a target container or the host, and then use nsenter to access all namespaces (mount, UTS, IPC, net, pid) of the host or another container.  Example to escape to the host: `nsenter --target 1 --mount --uts --ipc --net --pid -- bash`. The WorkloadAncestorsBinary field is used to track the ancestry of the process, this is useful to understand the context of the nsenter usage.
+description: 'This analytic detects the execution of the nsenter utility from within a container, a technique often used for exploitation and container escape. Nsenter allows an attacker to enter the namespaces of another process—such as the host''s init process (PID 1)—and execute a shell or other binaries with elevated privileges. For example, an attacker may use docker exec to gain a shell in a container, enumerate the PID of a target container or the host, and then use nsenter to access all namespaces (mount, UTS, IPC, net, pid) of the host or another container.  Example to escape to the host: `nsenter --target 1 --mount --uts --ipc --net --pid -- bash`. The WorkloadAncestorsBinary field is used to track the ancestry of the process, this is useful to understand the context of the nsenter usage.
 
-    The options -m -u -n -i -p correspond to the various Linux namespaces. Adversaries exploit nsenter when pods are misconfigured with excessive privileges (e.g., privileged, hostPID, or broad hostPath mounts), enabling them to interact with the underlying node filesystem and processes. This can be an indicator of a container escape attempt or privilege escalation. Security teams should pay close attention to any nsenter invocation from within containers, especially outside of normal maintenance activity or in workloads with elevated privileges.
+
+    The options -m -u -n -i -p correspond to the various Linux namespaces. Adversaries exploit nsenter when pods are misconfigured with excessive privileges (e.g., privileged, hostPID, or broad hostPath mounts), enabling them to interact with the underlying node filesystem and processes. This can be an indicator of a container escape attempt or privilege escalation. Security teams should pay close attention to any nsenter invocation from within containers, especially outside of normal maintenance activity or in workloads with elevated privileges.'
 data_source:
     - Cisco Isovalent Process Exec
 search: |
-    `cisco_isovalent_process_exec` process_name="nsenter"
-    | eval WorkloadAncestorsBinary=mvjoin(parent_process_name, " <- ")
-    | stats count
-            min(_time) as firstTime
-            max(_time) as lastTime
-            values(process) as process
-            values(WorkloadAncestorsBinary) as WorkloadAncestorsBinary
-        by cluster_name container_id pod_name pod_namespace pod_image_name parent_process_name process_name process_exec process_id node_name
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_isovalent___nsenter_usage_in_kubernetes_pod_filter`
+    `cisco_isovalent_process_exec` process_name="nsenter" | eval cluster_name=cluster_name, pod_name=pod_name, node_name=node_name | stats count min(_time) as firstTime max(_time) as lastTime by process_name process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_isovalent___nsenter_usage_in_kubernetes_pod_filter`
 how_to_implement: The detection is based on process execution data generated by Cisco Isovalent Runtime Security. Ensure that Isovalent Runtime Security is deployed and configured in your Kubernetes environment to emit process_exec events. Configure the Cisco Security Cloud TA to collect these logs via HTTP Event Collector (HEC) and normalize them into the Splunk Common Information Model. This integration ensures that all relevant pod, container, and process activity is captured for monitoring and detection of suspicious behavior.
 known_false_positives: It is highly unlikely that nsenter will be used in a legitimate way, investigate the alert in context to rule out benign operations.
 references:
@@ -37,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$pod_name$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$pod_name$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: pod_name
diff --git a/detections/endpoint/cisco_isovalent___pods_running_offensive_tools.yml b/detections/endpoint/cisco_isovalent___pods_running_offensive_tools.yml
index 6d61ddaeb6c..39409e44ce3 100644
--- a/detections/endpoint/cisco_isovalent___pods_running_offensive_tools.yml
+++ b/detections/endpoint/cisco_isovalent___pods_running_offensive_tools.yml
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$pod_name$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$pod_name$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: pod_name
diff --git a/detections/endpoint/cisco_isovalent___potential_escape_to_host.yml b/detections/endpoint/cisco_isovalent___potential_escape_to_host.yml
index 84df7f27568..b020fd8efde 100644
--- a/detections/endpoint/cisco_isovalent___potential_escape_to_host.yml
+++ b/detections/endpoint/cisco_isovalent___potential_escape_to_host.yml
@@ -6,8 +6,7 @@ modification_date: '2026-05-13'
 author: Bhavin Patel, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects potential container escape or reconnaissance attempts by monitoring for the rapid execution of multiple suspicious Linux commands (nsenter, mount, ps aux, and ls) within a short time window. The search aggregates process execution logs into 5-minute buckets and identifies when two or more distinct commands occur in quick succession. This behavior is noteworthy because attackers often chain these commands together to pivot from a container into the host, enumerate processes, or browse filesystems. For a SOC, catching these clustered command executions is important because it highlights possible adversary activity attempting to break isolation and escalate privileges inside a Kubernetes environment.
+description: This analytic detects potential container escape or reconnaissance attempts by monitoring for the rapid execution of multiple suspicious Linux commands (nsenter, mount, ps aux, and ls) within a short time window. The search aggregates process execution logs into 5-minute buckets and identifies when two or more distinct commands occur in quick succession. This behavior is noteworthy because attackers often chain these commands together to pivot from a container into the host, enumerate processes, or browse filesystems. For a SOC, catching these clustered command executions is important because it highlights possible adversary activity attempting to break isolation and escalate privileges inside a Kubernetes environment.
 data_source:
     - Cisco Isovalent Process Exec
 search: |
@@ -33,16 +32,20 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_isovalent___potential_escape_to_host_filter`
-how_to_implement: |
-    This detection relies on process execution telemetry from Cisco Isovalent Runtime Security.
+how_to_implement: 'This detection relies on process execution telemetry from Cisco Isovalent Runtime Security.
+
     Ensure Isovalent Runtime Security is deployed and configured in your Kubernetes environment
+
     to generate process_exec events. Configure the Cisco Security Cloud TA to collect these logs
+
     via HEC and normalize them into Splunk CIM. Privileged pods and hostPID configurations
-    should be closely monitored as they increase the risk of container escape attempts.
-known_false_positives: |
-    Some legitimate administrative containers or troubleshooting workflows may use nsenter
+
+    should be closely monitored as they increase the risk of container escape attempts.'
+known_false_positives: 'Some legitimate administrative containers or troubleshooting workflows may use nsenter
+
     or mount commands (e.g., debugging nodes with hostPID pods). Such activity should be
-    investigated in context to ensure it is not malicious.
+
+    investigated in context to ensure it is not malicious.'
 references:
     - https://attack.mitre.org/techniques/T1611/
     - https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/
@@ -54,7 +57,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$pod_name$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$pod_name$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: pod_name
diff --git a/detections/endpoint/cisco_isovalent___shell_execution.yml b/detections/endpoint/cisco_isovalent___shell_execution.yml
index 262d09c2935..8c301fe65b5 100644
--- a/detections/endpoint/cisco_isovalent___shell_execution.yml
+++ b/detections/endpoint/cisco_isovalent___shell_execution.yml
@@ -10,8 +10,7 @@ description: The following analytic detects the execution of a shell inside a co
 data_source:
     - Cisco Isovalent Process Exec
 search: |
-    `cisco_isovalent_process_exec` process_name IN ("sh", "ksh", "zsh", "bash", "dash", "rbash", "fish", "csh", "tcsh", "ion", "eshell")
-    | stats count by cluster_name parent_process_name process_name process_exec process_id node_name | `cisco_isovalent___shell_execution_filter`
+    `cisco_isovalent_process_exec` process_name IN ("sh", "ksh", "zsh", "bash", "dash", "rbash", "fish", "csh", "tcsh", "ion", "eshell") | eval cluster_name=cluster_name, pod_name=pod_name, node_name=node_name | stats count min(_time) as firstTime max(_time) as lastTime by process_name process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_isovalent___shell_execution_filter`
 how_to_implement: The detection is based on process execution data generated by Cisco Isovalent Runtime Security. Ensure that Isovalent Runtime Security is deployed and configured in your Kubernetes environment to emit process_exec events. Configure the Cisco Security Cloud TA to collect these logs via HTTP Event Collector (HEC) and normalize them into the Splunk Common Information Model. This integration ensures that all relevant pod, container, and process activity is captured for monitoring and detection of suspicious behavior.
 known_false_positives: This activity may be triggered by legitimate administrative scripts, container images, or third-party operators that use cron for scheduled tasks, so please investigate the alert in context to rule out benign operations.
 references:
@@ -24,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$node_name$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$node_name$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: node_name
diff --git a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml
index 72bbe5d0998..536d2162d1a 100644
--- a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml
+++ b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml
@@ -6,69 +6,27 @@ modification_date: '2026-09-22'
 author: Maria Jose Erquiaga, Splunk
 status: production
 type: Anomaly
-description: |
-    Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination.
+description: 'Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination.
+
     This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems.
-    The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.
+
+    The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.'
 data_source:
     - Cisco Network Visibility Module Flow Data
 search: |
-    `cisco_network_visibility_module_flowdata`
-    process_path IN (
-        "*/bash",
-        "*/csh",
-        "*/dash",
-        "*/fish",
-        "*/sh",
-        "*/tcsh",
-        "*/zsh"
-    )
-    parent_process_path IN (
-        "*/arc", "*/brave", "*/brave-browser", "*/chrome", "*/chromium", "*/duckduckgo", "*/firefox", "*/firefox-bin",
-        "*/google chrome", "*/google-chrome", "*/librewolf", "*/microsoft edge", "*/msedge", "*/opera",
-        "*/opera gx", "*/safari", "*/tor browser", "*/vivaldi", "*/waterfox"
-    )
-    NOT dest IN (
-            "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
-            "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
-            "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
-            "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
-            "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1"
-        )
-
-    | stats count
-        min(_time) as firstTime
-        max(_time) as lastTime
-        values(parent_process_hash) as parent_process_hash
-        values(process_hash) as process_hash
-        values(module_name_list) as module_name_list
-        values(module_hash_list) as module_hash_list
-        values(dest_port) as dest_port
-        values(dest_hostname) as dest_hostname
-
-      by src src_ip dest dest_ip bytes_in bytes_out
-         user process_id process_name process_path process
-         parent_process_id parent_process_name parent_process_path parent_process
-
-    | table
-      firstTime lastTime user
-      parent_process_path parent_process_name parent_process parent_process_hash
-      process_path process_name process process_hash process_id
-      module_name_list module_hash_list
-      src src_ip dest_hostname dest dest_ip dest_port bytes_in bytes_out
+    source="not_applicable" process_path IN ("*/bash", "*/csh", "*/dash", "*/fish", "*/sh", "*/tcsh", "*/zsh") parent_process_path IN ("*/arc", "*/brave", "*/brave-browser", "*/chrome", "*/chromium", "*/duckduckgo", "*/firefox", "*/firefox-bin", "*/google chrome", "*/google-chrome", "*/librewolf", "*/microsoft edge", "*/msedge", "*/opera", "*/opera gx", "*/safari", "*/tor browser", "*/vivaldi", "*/waterfox") NOT (dest IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1")) | eval src=src, dest_hostname=dest_hostname, dest_ip=dest_ip, dest_port=dest_port, process_path=process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_nvm___browser_spawned_unix_shell_with_external_connection_filter`
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
 
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_nvm___browser_spawned_unix_shell_with_external_connection_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
-    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-known_false_positives: |
-    Legitimate workflows may launch Unix command interpreters from browser contexts, including developer tooling, software installers, SSO helpers, browser extensions, and automation wrappers. Tuning may be required for approved applications, users, and destinations.
+
+    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).'
+known_false_positives: Legitimate workflows may launch Unix command interpreters from browser contexts, including developer tooling, software installers, SSO helpers, browser extensions, and automation wrappers. Tuning may be required for approved applications, users, and destinations.
 references:
     - https://attack.mitre.org/tactics/TA0002/
     - https://attack.mitre.org/techniques/T1059/
@@ -81,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml
index 62be4e512f7..6a5af0c1748 100644
--- a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml
+++ b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml
@@ -6,13 +6,17 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects the use of `curl.exe` with insecure flags such as `-k`, `--insecure`, `--proxy-insecure`, or `--doh-insecure`
+description: 'This analytic detects the use of `curl.exe` with insecure flags such as `-k`, `--insecure`, `--proxy-insecure`, or `--doh-insecure`
+
     which disable TLS certificate validation.
+
     It leverages Cisco Network Visibility Module (NVM) flow data and process arguments
+
     to identify outbound connections initiated by curl where TLS checks were explicitly disabled.
+
     This behavior may indicate an attempt to bypass certificate validation to connect to potentially untrusted or malicious endpoints,
-    a common tactic in red team operations, malware staging, or data exfiltration over HTTPS.
+
+    a common tactic in red team operations, malware staging, or data exfiltration over HTTPS.'
 data_source:
     - Cisco Network Visibility Module Flow Data
 search: |
@@ -45,16 +49,20 @@ search: |
       additional_logged_in_users_list module_name_list module_hash_list
       src dest_hostname dest dest_port transport firstTime lastTime
     | `cisco_nvm___curl_execution_with_insecure_flags_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
-    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-known_false_positives: |
-    Usage of these flags to reach public IPs or uncommon destinations should be reviewed.
-    Tuning may be required for domains with known certificate issues.
+
+    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).'
+known_false_positives: 'Usage of these flags to reach public IPs or uncommon destinations should be reviewed.
+
+    Tuning may be required for domains with known certificate issues.'
 references:
     - https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/
 drilldown_searches:
@@ -65,7 +73,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml
index 7784dec31a4..989f0add218 100644
--- a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml
+++ b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml
@@ -6,10 +6,11 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    This analytic detects suspicious python package installations where the package name resembles popular Python libraries but may be typosquatted or slightly altered.
+description: 'This analytic detects suspicious python package installations where the package name resembles popular Python libraries but may be typosquatted or slightly altered.
+
     Typosquatting is a common technique used by attackers to trick users into installing malicious packages that mimic legitimate ones.
-    This detection leverages Cisco NVM flow telemetry and checks for pip or poetry package managers with the "install" or "add" flags, making outbound connections to package repository such as `pypi.org` with known or suspected typo package names.
+
+    This detection leverages Cisco NVM flow telemetry and checks for pip or poetry package managers with the "install" or "add" flags, making outbound connections to package repository such as `pypi.org` with known or suspected typo package names.'
 data_source:
     - Cisco Network Visibility Module Flow Data
 search: |
@@ -43,16 +44,20 @@ search: |
       process_integrity_level process_path process_name process_arguments process_hash process_id
       additional_logged_in_users_list module_name_list module_hash_list
     | `cisco_nvm___installation_of_typosquatted_python_package_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
+
     The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-    In addition to this, the search make use of the lookup "typo_squatted_python_packages". Which needs to be configured and tuned.
-known_false_positives: |
-    False positives should be very minimal to non existent, as the names of the packages in the lookup are all extracted from previously malicious packages.
+
+    In addition to this, the search make use of the lookup "typo_squatted_python_packages". Which needs to be configured and tuned.'
+known_false_positives: False positives should be very minimal to non existent, as the names of the packages in the lookup are all extracted from previously malicious packages.
 references:
     - https://securelist.com/two-more-malicious-python-packages-in-the-pypi/107218/
     - https://blog.checkpoint.com/securing-the-cloud/pypi-inundated-by-malicious-typosquatting-campaign/
@@ -65,7 +70,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Host $src$ used pip or poetry to install a likely typosquatted python package $package_name$ from $dest_hostname$
     entity:
diff --git a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml
index ff2f2a11089..09616361d08 100644
--- a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml
+++ b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml
@@ -6,57 +6,33 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects suspicious use of 'mshta.exe' or 'rundll32.exe' invoking 'mshtml.dll'
-    or the 'RunHTMLApplication' export without including a direct HTTP/HTTPS URL in the command line.
+description: 'This analytic detects suspicious use of ''mshta.exe'' or ''rundll32.exe'' invoking ''mshtml.dll''
+
+    or the ''RunHTMLApplication'' export without including a direct HTTP/HTTPS URL in the command line.
+
     This pattern could be associated with obfuscated script execution used by threat actors during
+
     initial access or payload staging. The absence of a visible URL may indicate attempts to evade static
+
     detections by embedding the URL via string concatenation, encoding (e.g., hex), or indirect script loaders
-    like 'GetObject()'.
+
+    like ''GetObject()''.'
 data_source:
     - Cisco Network Visibility Module Flow Data
 search: |
-    `cisco_network_visibility_module_flowdata`
-    (
-      (
-        process_name = "mshta.exe"
-        process_arguments IN ("*javascript*", "*vbscript*")
-      )
-      OR
-      ( process_name = "rundll32.exe" AND
-        process_arguments = "*mshtml*" AND
-        process_arguments = "*RunHTMLApplication*"
-      )
-    )
-    NOT process_arguments IN ("*http://*", "*https://*")
-    | stats count min(_time) as firstTime max(_time) as lastTime
-            values(parent_process_arguments) as parent_process_arguments
-            values(process_arguments) as process_arguments
-            values(parent_process_hash) as parent_process_hash
-            values(process_hash) as process_hash
-            values(module_name_list) as module_name_list
-            values(module_hash_list) as module_hash_list
-            values(dest_port) as dest_port
-            values(aliul) as additional_logged_in_users_list
-            values(dest_hostname) as dest_hostname
-            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table
-      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
-      process_integrity_level process_path process_name process_arguments process_hash process_id
-      additional_logged_in_users_list module_name_list module_hash_list
-      src dest_hostname dest dest_port transport firstTime lastTime
-    | `cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+    source="not_applicable" (process_name="mshta.exe" process_arguments IN ("*javascript*", "*vbscript*")) OR (process_name="rundll32.exe" process_arguments="*mshtml*" process_arguments="*RunHTMLApplication*") NOT (process_arguments IN ("*http://*", "*https://*")) | eval src=src, dest_hostname=dest_hostname, dest_ip=dest_ip, dest_port=dest_port, process_path=process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli_filter`
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
-    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-known_false_positives: |
-    False positives should be minimal as the presence of a network connection during such executions increases the likelihood of malicious behavior.
+
+    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).'
+known_false_positives: False positives should be minimal as the presence of a network connection during such executions increases the likelihood of malicious behavior.
 references:
     - https://attack.mitre.org/techniques/T1218/005/
     - https://redcanary.com/blog/mshta-attack-technique/
@@ -70,7 +46,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml
index 5d9707b4712..3163dbe161c 100644
--- a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml
+++ b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml
@@ -6,56 +6,31 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects network connections initiated by binaries that are not typically associated with network communication,
-    such as 'notepad.exe', 'calc.exe' or 'write.exe'.
+description: 'This analytic detects network connections initiated by binaries that are not typically associated with network communication,
+
+    such as ''notepad.exe'', ''calc.exe'' or ''write.exe''.
+
     It leverages Cisco Network Visibility Module logs to correlate network flow activity with process context, including command-line arguments, process path, and parent process information.
-    These applications are normally used for locally and do not require outbound network access. When they do initiate such connections, it may indicate process hollowing, code injection, or proxy execution, where adversaries abuse a trusted process to mask malicious activity.
+
+    These applications are normally used for locally and do not require outbound network access. When they do initiate such connections, it may indicate process hollowing, code injection, or proxy execution, where adversaries abuse a trusted process to mask malicious activity.'
 data_source:
     - Cisco Network Visibility Module Flow Data
 search: |
-    `cisco_network_visibility_module_flowdata`
-    process_name IN (
-            "notepad.exe", "write.exe", "mspaint.exe", "calc.exe",
-            "win32calc.exe", "addinutil.exe", "cmstp.exe", "dialer.exe",
-            "eqnedt32.exe", "IMEWDBLD.exe"
-            )
-    NOT dest IN (
-            "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
-            "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
-            "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
-            "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
-            "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1"
-            )
-    | stats count min(_time) as firstTime max(_time) as lastTime
-            values(parent_process_arguments) as parent_process_arguments
-            values(process_arguments) as process_arguments
-            values(parent_process_hash) as parent_process_hash
-            values(process_hash) as process_hash
-            values(module_name_list) as module_name_list
-            values(module_hash_list) as module_hash_list
-            values(dest_port) as dest_port
-            values(aliul) as additional_logged_in_users_list
-            values(dest_hostname) as dest_hostname
-            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table
-      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
-      process_integrity_level process_path process_name process_arguments process_hash process_id
-      additional_logged_in_users_list module_name_list module_hash_list
-      src dest_hostname dest dest_port transport firstTime lastTime
-    | `cisco_nvm___non_network_binary_making_network_connection_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+    source="not_applicable" process_name IN ("notepad.exe", "write.exe", "mspaint.exe", "calc.exe", "win32calc.exe", "addinutil.exe", "cmstp.exe", "dialer.exe", "eqnedt32.exe", "IMEWDBLD.exe") NOT (dest IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1")) | eval src=src, dest_hostname=dest_hostname, dest_ip=dest_ip, dest_port=dest_port, process_path=process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_nvm___non_network_binary_making_network_connection_filter`
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
-    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-known_false_positives: |
-    Rare cases may exist where these binaries are used by plugins or third-party extensions to initiate outbound communication.
-    However, such behavior is extremely uncommon and should be investigated for potential injection or abuse.
+
+    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).'
+known_false_positives: 'Rare cases may exist where these binaries are used by plugins or third-party extensions to initiate outbound communication.
+
+    However, such behavior is extremely uncommon and should be investigated for potential injection or abuse.'
 references:
     - https://redcanary.com/threat-detection-report/techniques/process-injection/
     - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
@@ -67,7 +42,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml
index f9a7a87931a..2ec2a3118fa 100644
--- a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml
+++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml
@@ -6,12 +6,12 @@ modification_date: '2026-09-22'
 author: Radka Viskova, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds).
-    Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections.
+description: 'This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds).
+
+    Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections.'
 data_source:
     - Cisco Network Visibility Module Flow Data
-search: |-
+search: |
     `cisco_network_visibility_module_flowdata`
     (
         parent_process_name="osascript"
@@ -43,15 +43,18 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_nvm___osascript_network_connection_for_a_long_duration_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
-    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-known_false_positives: |-
-    Legitimate administrative scripting, automation, software deployment, or support workflows that use osascript for long-running network operations.
+
+    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).'
+known_false_positives: Legitimate administrative scripting, automation, software deployment, or support workflows that use osascript for long-running network operations.
 references:
     - https://attack.mitre.org/tactics/TA0002/
     - https://attack.mitre.org/tactics/TA0011/
@@ -66,7 +69,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for "$src$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml
index 61d00ba1160..a43c3dbbba0 100644
--- a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml
+++ b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml
@@ -6,11 +6,13 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects any outbound network connection from an endpoint process to a known suspicious or non-standard port.
+description: 'The following analytic detects any outbound network connection from an endpoint process to a known suspicious or non-standard port.
+
     It leverages Cisco Network Visibility Module flow data logs to identify potentially suspicious behavior by looking at processes
+
     communicating over ports like 4444, 2222, or 51820 are commonly used by tools like Metasploit, SliverC2 or other pentest, red team or malware.
-    These connections are worth investigating further, especially when initiated by unexpected or non-network-native binaries.
+
+    These connections are worth investigating further, especially when initiated by unexpected or non-network-native binaries.'
 data_source:
     - Cisco Network Visibility Module Flow Data
 search: |
@@ -43,17 +45,22 @@ search: |
       additional_logged_in_users_list module_name_list module_hash_list
       src dest_hostname dest dest_port transport firstTime lastTime
     | `cisco_nvm___outbound_connection_to_suspicious_port_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
-    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-known_false_positives: |
-    Some legitimate applications may use high or non-standard ports, such as alternate SSH daemons or development tools.
+
+    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).'
+known_false_positives: 'Some legitimate applications may use high or non-standard ports, such as alternate SSH daemons or development tools.
+
     However, many of these ports are commonly used by threat actors for reverse shells or C2 communications.
-    Review the associated process and command-line context to determine intent.
+
+    Review the associated process and command-line context to determine intent.'
 references:
     - https://mthcht.medium.com/hunting-for-suspicious-ports-activities-50ef56d5cef
 drilldown_searches:
@@ -64,7 +71,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml
index f08391700bf..8567ddd5d90 100644
--- a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml
+++ b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml
@@ -6,61 +6,33 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This detection identifies execution of the file synchronization utility "rclone".
+description: 'This detection identifies execution of the file synchronization utility "rclone".
+
     It leverages Cisco Network Visibility Module logs, specifically flow data in order to capture process executions
+
     initiating network connections.
+
     While rclone is a legitimate command-line tool for syncing data to cloud storage providers, it has been widely abused by threat actors for data exfiltration.
+
     This analytic inspects process name and arguments for rclone and flags usage of suspicious flags.
-    If matched, this could indicate malicious usage for stealthy data exfiltration or cloud abuse.
+
+    If matched, this could indicate malicious usage for stealthy data exfiltration or cloud abuse.'
 data_source:
     - Cisco Network Visibility Module Flow Data
 search: |
-    `cisco_network_visibility_module_flowdata`
-    (
-      process_name = "rclone.exe"
-      OR
-      (
-        process_arguments = "* copy *"
-        process_arguments = "*\\\\*"
-        process_arguments IN ("*remote:*", "*mega:*", "*ftp:*", "*ftp1:*")
-      )
-      OR
-      (
-        process_arguments IN ("*remote:*", "*mega:*", "*ftp:*", "*ftp1:*")
-        process_arguments = "*--transfers"
-        process_arguments = "*--ignore-existing*"
-        process_arguments = "*--auto-confirm*"
-      )
-    )
-    | stats count min(_time) as firstTime max(_time) as lastTime
-            values(parent_process_arguments) as parent_process_arguments
-            values(process_arguments) as process_arguments
-            values(parent_process_hash) as parent_process_hash
-            values(process_hash) as process_hash
-            values(module_name_list) as module_name_list
-            values(module_hash_list) as module_hash_list
-            values(dest_port) as dest_port
-            values(aliul) as additional_logged_in_users_list
-            values(dest_hostname) as dest_hostname
-            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table
-      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
-      process_integrity_level process_path process_name process_arguments process_hash process_id
-      additional_logged_in_users_list module_name_list module_hash_list
-      src dest_hostname dest dest_port transport firstTime lastTime
-    | `cisco_nvm___rclone_execution_with_network_activity_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+    source="not_applicable" (process_arguments="* copy *" process_arguments="*\\*" process_arguments IN ("*remote:*", "*mega:*", "*ftp:*", "*ftp1:*")) OR (process_arguments IN ("*remote:*", "*mega:*", "*ftp:*", "*ftp1:*") process_arguments="*--transfers" process_arguments="*--ignore-existing*" process_arguments="*--auto-confirm*") OR process_name="rclone.exe" | eval src=src, dest_hostname=dest_hostname, dest_ip=dest_ip, dest_port=dest_port, process_path=process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_nvm___rclone_execution_with_network_activity_filter`
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
-    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-known_false_positives: |
-    Rclone is used legitimately in some backup or other workflows. Tune this rule based on known-good operational usage or restrict by known user/service accounts an specific folders or remote names.
+
+    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).'
+known_false_positives: Rclone is used legitimately in some backup or other workflows. Tune this rule based on known-good operational usage or restrict by known user/service accounts an specific folders or remote names.
 references:
     - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
     - https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/
@@ -74,7 +46,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml
index b64b3f4cbee..dc4c72dd208 100644
--- a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml
+++ b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml
@@ -6,48 +6,33 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects suspicious use of `rundll32.exe` in combination with `mshtml.dll` and the export `RunHTMLApplication`.
+description: 'This analytic detects suspicious use of `rundll32.exe` in combination with `mshtml.dll` and the export `RunHTMLApplication`.
+
     This behavior is often observed in malware to execute JavaScript or VBScript in memory, enabling payload staging or
+
     bypassing script execution policies and bypassing the usage of the "mshta.exe" binary.
+
     The detection leverages Cisco Network Visibility Module telemetry which offers network flow activity
+
     along with process information such as command-line arguments
-    If confirmed malicious, this activity may indicate initial access or payload download.
+
+    If confirmed malicious, this activity may indicate initial access or payload download.'
 data_source:
     - Cisco Network Visibility Module Flow Data
 search: |
-    `cisco_network_visibility_module_flowdata`
-    process_name = "rundll32.exe"
-    process_arguments = "*mshtml*"
-    process_arguments IN ("*135*", "*RunHTMLApplication*")
-    | stats count min(_time) as firstTime max(_time) as lastTime
-            values(parent_process_arguments) as parent_process_arguments
-            values(process_arguments) as process_arguments
-            values(parent_process_hash) as parent_process_hash
-            values(process_hash) as process_hash
-            values(module_name_list) as module_name_list
-            values(module_hash_list) as module_hash_list
-            values(dest_port) as dest_port
-            values(aliul) as additional_logged_in_users_list
-            values(dest_hostname) as dest_hostname
-            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table
-      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
-      process_integrity_level process_path process_name process_arguments process_hash process_id
-      additional_logged_in_users_list module_name_list module_hash_list
-      src dest_hostname dest dest_port transport firstTime lastTime
-    | `cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+    source="not_applicable" process_name="rundll32.exe" process_arguments="*mshtml*" process_arguments IN ("*135*", "*RunHTMLApplication*") | eval src=src, dest_hostname=dest_hostname, dest_ip=dest_ip, dest_port=dest_port, process_path=process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download_filter`
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
-    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-known_false_positives: |
-    `rundll32.exe` using `mshtml.dll` is rare in legitimate environments. However, edge cases might exist. Tuning may be needed in environments with custom automation scripts.
+
+    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).'
+known_false_positives: '`rundll32.exe` using `mshtml.dll` is rare in legitimate environments. However, edge cases might exist. Tuning may be needed in environments with custom automation scripts.'
 references:
     - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/
     - https://redcanary.com/blog/threat-detection/threat-research-questions/
@@ -62,7 +47,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml
index fe101b8b271..c9eeed2115f 100644
--- a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml
+++ b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml
@@ -6,50 +6,35 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects script execution (`wscript.exe` or `cscript.exe`) triggered from compressed files opened directly using
+description: 'This analytic detects script execution (`wscript.exe` or `cscript.exe`) triggered from compressed files opened directly using
+
     `explorer.exe`, `winrar.exe`, or `7zFM.exe`.
+
     When a user double clicks on a ".js" file from within one of these compressed files. Its extracted temporally in the temp directory in folder with certain markers.
+
     It leverages Cisco Network Visibility Module (NVM) flow data, in order to look for a specific parent/child relationship and an initiated network connection.
-    This behavior is exploited by threat actors such as Scarlet Goldfinch to deliver and run malicious scripts as an initial access technique.
+
+    This behavior is exploited by threat actors such as Scarlet Goldfinch to deliver and run malicious scripts as an initial access technique.'
 data_source:
     - Cisco Network Visibility Module Flow Data
 search: |
-    `cisco_network_visibility_module_flowdata`
-    parent_process_name IN ("explorer.exe", "winrar.exe", "7zFM.exe")
-    process_name IN ("wscript.exe", "cscript.exe")
-    process_arguments = "*\\AppData\\Local\\Temp\\*"
-    process_arguments IN ("*\\rar*", "*\\7z*", "*.zip*")
-    | stats count min(_time) as firstTime max(_time) as lastTime
-            values(parent_process_arguments) as parent_process_arguments
-            values(process_arguments) as process_arguments
-            values(parent_process_hash) as parent_process_hash
-            values(process_hash) as process_hash
-            values(module_name_list) as module_name_list
-            values(module_hash_list) as module_hash_list
-            values(dest_port) as dest_port
-            values(aliul) as additional_logged_in_users_list
-            values(dest_hostname) as dest_hostname
-            by src dest parent_process_path parent_process_name parent_process_integrity_level process_path process_name process_integrity_level process_id transport
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table
-      parent_process_integrity_level parent_process_name parent_process_path parent_process_arguments parent_process_hash
-      process_integrity_level process_path process_name process_arguments process_hash process_id
-      additional_logged_in_users_list module_name_list module_hash_list
-      src dest_hostname dest dest_port transport firstTime lastTime
-    | `cisco_nvm___susp_script_from_archive_triggering_network_activity_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+    source="not_applicable" parent_process_name IN ("explorer.exe", "winrar.exe", "7zFM.exe") process_name IN ("wscript.exe", "cscript.exe") process_arguments="*\\AppData\\Local\\Temp\\*" process_arguments IN ("*\\rar*", "*\\7z*", "*.zip*") | eval src=src, dest_hostname=dest_hostname, dest_ip=dest_ip, dest_port=dest_port, process_path=process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_nvm___susp_script_from_archive_triggering_network_activity_filter`
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
-    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-known_false_positives: |
-    Some software installers or automation scripts may extract and run scripts from archive files in temporary directories.
+
+    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).'
+known_false_positives: 'Some software installers or automation scripts may extract and run scripts from archive files in temporary directories.
+
     However, it is uncommon for such scripts to initiate outbound network connections immediately upon extraction.
-    This behavior should be considered suspicious and investigated, especially in environments where such scripting is not typical.
+
+    This behavior should be considered suspicious and investigated, especially in environments where such scripting is not typical.'
 references:
     - https://redcanary.com/threat-detection-report/threats/scarlet-goldfinch/
 drilldown_searches:
@@ -60,7 +45,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml
index 790d763268a..976ba88c6ea 100644
--- a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml
+++ b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml
@@ -6,66 +6,39 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects suspicious downloads from common file sharing and content delivery platforms using known living-off-the-land binaries (LOLBins)
-    such as 'curl.exe', 'certutil.exe', 'msiexec.exe', 'powershell.exe', 'wmic.exe', and others.
+description: 'This analytic detects suspicious downloads from common file sharing and content delivery platforms using known living-off-the-land binaries (LOLBins)
+
+    such as ''curl.exe'', ''certutil.exe'', ''msiexec.exe'', ''powershell.exe'', ''wmic.exe'', and others.
+
     It leverages Cisco Network Visibility Module logs to correlate network flow activity with process context, including command-line arguments, process path,
+
     and parent process information. These tools are often abused by adversaries and malware to retrieve payloads from public hosting platforms
+
     such as GitHub, Discord CDN, Transfer.sh, or Pastebin.
-    This detection helps identify potential initial access, payload staging, or command and control activity using legitimate services.
+
+    This detection helps identify potential initial access, payload staging, or command and control activity using legitimate services.'
 data_source:
     - Cisco Network Visibility Module Flow Data
 search: |
-    `cisco_network_visibility_module_flowdata`
-    (
-      (process_name = "svchost.exe" process_arguments = "*-s BITS*")
-      OR
-      process_name IN (
-          "curl.exe", "wmic.exe", "wscript.exe", "cscript.exe", "certutil.exe",
-          "msiexec.exe", "hh.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe",
-          "installutil.exe", "certoc.exe", "bitsadmin.exe"
-      )
-    )
-    dest_hostname IN (
-        "*.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*",
-        "*dl.dropboxusercontent.com*", "*ghostbin.co*", "*glitch.me*", "*gofile.io*",
-        "*hastebin.com*", "*mediafire.com*", "*mega.nz*", "*onrender.com*", "*pages.dev*",
-        "*paste.ee*", "*pastebin.*", "*pastetext.net*", "*privatlab.*",
-        "*send.exploit.in*", "*sendspace.com*", "*storage.googleapis.com*",
-        "*storjshare.io*", "*supabase.co*", "*temp.sh*", "*transfer.sh*", "*trycloudflare.com*",
-        "*ufile.io*", "*w3spaces.com*", "*workers.dev*"
-      )
-    | stats count min(_time) as firstTime max(_time) as lastTime
-            values(parent_process_arguments) as parent_process_arguments
-            values(process_arguments) as process_arguments
-            values(parent_process_hash) as parent_process_hash
-            values(process_hash) as process_hash
-            values(module_name_list) as module_name_list
-            values(module_hash_list) as module_hash_list
-            values(dest_port) as dest_port
-            values(aliul) as additional_logged_in_users_list
-            values(dest_hostname) as dest_hostname
-            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table
-      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
-      process_integrity_level process_path process_name process_arguments process_hash process_id
-      additional_logged_in_users_list module_name_list module_hash_list
-      src dest_hostname dest dest_port transport firstTime lastTime
-    | `cisco_nvm___suspicious_download_from_file_sharing_website_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+    source="not_applicable" (process_name="svchost.exe" process_arguments="*-s BITS*") OR process_name IN ("curl.exe", "wmic.exe", "wscript.exe", "cscript.exe", "certutil.exe", "msiexec.exe", "hh.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe", "installutil.exe", "certoc.exe", "bitsadmin.exe") dest_hostname IN ("*.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*", "*dl.dropboxusercontent.com*", "*ghostbin.co*", "*glitch.me*", "*gofile.io*", "*hastebin.com*", "*mediafire.com*", "*mega.nz*", "*onrender.com*", "*pages.dev*", "*paste.ee*", "*pastebin.*", "*pastetext.net*", "*privatlab.*", "*send.exploit.in*", "*sendspace.com*", "*storage.googleapis.com*", "*storjshare.io*", "*supabase.co*", "*temp.sh*", "*transfer.sh*", "*trycloudflare.com*", "*ufile.io*", "*w3spaces.com*", "*workers.dev*") | eval src=src, dest_hostname=dest_hostname, dest_ip=dest_ip, dest_port=dest_port, process_path=process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_nvm___suspicious_download_from_file_sharing_website_filter`
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
-    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-known_false_positives: |
-    Some system administrators or development teams may use tools like curl or PowerShell to download files from public services
+
+    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).'
+known_false_positives: 'Some system administrators or development teams may use tools like curl or PowerShell to download files from public services
+
     for legitimate automation or scripting purposes. However, use of these binaries to contact domains commonly associated with file sharing or temporary hosting
+
     should be carefully reviewed, as such services are frequently abused by threat actors for malware delivery and staging.
-    Tuning by domain allowlisting or internal usage policies is recommended.
+
+    Tuning by domain allowlisting or internal usage policies is recommended.'
 references:
     - https://twitter.com/jhencinski/status/1102695118455349248
     - https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/
@@ -80,7 +53,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml
index 868531d2817..bf66e15f391 100644
--- a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml
+++ b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml
@@ -6,11 +6,13 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    This analytic identifies the use of Chromium-based browsers (like Microsoft Edge) running in headless mode with the `--dump-dom` argument.
+description: 'This analytic identifies the use of Chromium-based browsers (like Microsoft Edge) running in headless mode with the `--dump-dom` argument.
+
     This behavior has been observed in attack campaigns such as DUCKTAIL, where browsers are automated to stealthily download content from the internet using direct URLs or suspicious hosting platforms.
+
     The detection focuses on identifying connections to known file-sharing domains or direct IPs extracted from command-line arguments and cross-checks those against the destination of the flow.
-    Since it leverages Cisco Network Visibility Module telemetry, the rule triggers only if a network connection is made.
+
+    Since it leverages Cisco Network Visibility Module telemetry, the rule triggers only if a network connection is made.'
 data_source:
     - Cisco Network Visibility Module Flow Data
 search: |
@@ -74,17 +76,22 @@ search: |
        additional_logged_in_users_list module_name_list module_hash_list
        src dest_hostname dest dest_port transport firstTime lastTime
      | `cisco_nvm___suspicious_file_download_via_headless_browser_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
-    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-known_false_positives: |
-    Some internal automation frameworks may invoke Chromium browsers in headless mode to programmatically access internal services or webpages.
+
+    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).'
+known_false_positives: 'Some internal automation frameworks may invoke Chromium browsers in headless mode to programmatically access internal services or webpages.
+
     These tools may occasionally download legitimate resources as part of their normal behavior.
-    Tuning based on command-line patterns or known dest hostnames may be required to avoid noise.
+
+    Tuning based on command-line patterns or known dest hostnames may be required to avoid noise.'
 references:
     - https://labs.withsecure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf
     - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
@@ -98,7 +105,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious file download using the Chromium-based browser $parent_process_name$ via the commandline $process_arguments$. Observed on host $src$ communicating with $dest$ / $dest_hostname$
     entity:
diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml
index c3ab060c003..8ed1aae6e9e 100644
--- a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml
+++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml
@@ -6,60 +6,37 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects system binaries that are commonly abused in process injection techniques but are observed without any command-line arguments.
+description: 'This analytic detects system binaries that are commonly abused in process injection techniques but are observed without any command-line arguments.
+
     It leverages Cisco Network Visibility Module (NVM) flow data and process arguments
+
     to identify outbound connections initiated by curl where TLS checks were explicitly disabled.
+
     Binaries such as `rundll32.exe`, `regsvr32.exe`, `dllhost.exe`, `svchost.exe`, and others are legitimate Windows processes that are often injected into by malware or post-exploitation frameworks (e.g., Cobalt Strike) to hide execution.
+
     When these processes are seen initiating a network connection with an empty or missing command line, it can indicate
-    potential injection and communication with a command and control server.
+
+    potential injection and communication with a command and control server.'
 data_source:
     - Cisco Network Visibility Module Flow Data
 search: |
-    `cisco_network_visibility_module_flowdata`
-    process_name IN (
-      "backgroundtaskhost.exe", "svchost.exe", "dllhost.exe", "werfault.exe",
-      "searchprotocolhost.exe", "wuauclt.exe", "spoolsv.exe", "rundll32.exe",
-      "regasm.exe", "regsvr32.exe", "regsvcs.exe"
-    )
-    NOT process_arguments="*"
-    NOT dest IN (
-            "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
-            "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
-            "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
-            "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
-            "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1"
-            )
-    | stats count min(_time) as firstTime max(_time) as lastTime
-            values(parent_process_arguments) as parent_process_arguments
-            values(process_arguments) as process_arguments
-            values(parent_process_hash) as parent_process_hash
-            values(process_hash) as process_hash
-            values(module_name_list) as module_name_list
-            values(module_hash_list) as module_hash_list
-            values(dest_port) as dest_port
-            values(aliul) as additional_logged_in_users_list
-            values(dest_hostname) as dest_hostname
-            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table
-      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
-      process_integrity_level process_path process_name process_arguments process_hash process_id
-      additional_logged_in_users_list module_name_list module_hash_list
-      src dest_hostname dest dest_port transport firstTime lastTime
-    | `cisco_nvm___suspicious_network_connection_from_process_with_no_args_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+    source="not_applicable" process_name IN ("backgroundtaskhost.exe", "svchost.exe", "dllhost.exe", "werfault.exe", "searchprotocolhost.exe", "wuauclt.exe", "spoolsv.exe", "rundll32.exe", "regasm.exe", "regsvr32.exe", "regsvcs.exe") NOT process_arguments="*" NOT (dest IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1")) | eval src=src, dest_hostname=dest_hostname, dest_ip=dest_ip, dest_port=dest_port, process_path=process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_nvm___suspicious_network_connection_from_process_with_no_args_filter`
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
-    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-known_false_positives: |
-    Some system binaries may execute without arguments in rare legitimate scenarios (e.g., certain service launches), and initiate
+
+    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).'
+known_false_positives: 'Some system binaries may execute without arguments in rare legitimate scenarios (e.g., certain service launches), and initiate
+
     a network connection to microsoft servers for telemetry or update purposes. Apply additional filters as needed.
-    However, binaries such as `rundll32.exe` or `dllhost.exe` running with no command-line context are highly suspicious and warrant investigation.
+
+    However, binaries such as `rundll32.exe` or `dllhost.exe` running with no command-line context are highly suspicious and warrant investigation.'
 references:
     - https://redcanary.com/threat-detection-report/techniques/process-injection/
 drilldown_searches:
@@ -70,7 +47,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml
index 7a99176ded8..982898f3188 100644
--- a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml
+++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml
@@ -6,54 +6,35 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic identifies the use of `msxsl.exe` initiating a network connection to a non-private IP address.
+description: 'This analytic identifies the use of `msxsl.exe` initiating a network connection to a non-private IP address.
+
     Although `msxsl.exe` is a legitimate Microsoft utility used to apply XSLT transformations, adversaries can abuse it
+
     to execute arbitrary code or load external resources in an evasive manner.
+
     This detection leverages Cisco NVM telemetry to identify potentially malicious use of `msxsl.exe` making network connections
-    that may indicate command and control (C2) or data exfiltration activity.
+
+    that may indicate command and control (C2) or data exfiltration activity.'
 data_source:
     - Cisco Network Visibility Module Flow Data
 search: |
-    `cisco_network_visibility_module_flowdata`
-    process_name = "msxsl.exe"
-    NOT dest IN (
-            "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
-            "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
-            "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
-            "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
-            "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1"
-            )
-    | stats count min(_time) as firstTime max(_time) as lastTime
-            values(parent_process_arguments) as parent_process_arguments
-            values(process_arguments) as process_arguments
-            values(parent_process_hash) as parent_process_hash
-            values(process_hash) as process_hash
-            values(module_name_list) as module_name_list
-            values(module_hash_list) as module_hash_list
-            values(dest_port) as dest_port
-            values(aliul) as additional_logged_in_users_list
-            values(dest_hostname) as dest_hostname
-            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table
-      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
-      process_integrity_level process_path process_name process_arguments process_hash process_id
-      additional_logged_in_users_list module_name_list module_hash_list
-      src dest_hostname dest dest_port transport firstTime lastTime
-    | `cisco_nvm___suspicious_network_connection_initiated_via_msxsl_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+    source="not_applicable" process_name="msxsl.exe" NOT (dest IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1")) | eval src=src, dest_hostname=dest_hostname, dest_ip=dest_ip, dest_port=dest_port, process_path=process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_nvm___suspicious_network_connection_initiated_via_msxsl_filter`
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
-    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-known_false_positives: |
-    False positives may occur in development or administrative environments where msxsl.exe is used
+
+    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).'
+known_false_positives: 'False positives may occur in development or administrative environments where msxsl.exe is used
+
     for legitimate XML transformations. However, its use is uncommon in standard user activity
-    and should be reviewed in most environments.
+
+    and should be reviewed in most environments.'
 references:
     - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
 drilldown_searches:
@@ -64,7 +45,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml
index 6586f1d026e..d2e40dc23c4 100644
--- a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml
+++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml
@@ -6,63 +6,37 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk, Janantha Marasinghe
 status: production
 type: Anomaly
-description: |
-    This analytic identifies non-browser processes reaching out to public IP lookup or geolocation services,
+description: 'This analytic identifies non-browser processes reaching out to public IP lookup or geolocation services,
+
     such as `ipinfo.io`, `icanhazip.com`, `ip-api.com`, and others.
+
     These domains are commonly used by legitimate tools, but their usage outside of browsers may indicate
+
     network reconnaissance, virtual machine detection, or staging by malware.
+
     This activity is observed in post-exploitation frameworks, stealer malware, and advanced threat actor campaigns.
+
     The detection relies on Cisco Network Visibility Module (NVM) telemetry and excludes known browser
-    processes to reduce noise.
+
+    processes to reduce noise.'
 data_source:
     - Cisco Network Visibility Module Flow Data
 search: |
-    `cisco_network_visibility_module_flowdata`
-    dest_hostname IN (
-            "*api.2ip.ua*", "*api.bigdatacloud.net*", "*api.ipify.org*", "*whatismyipaddress.com*",
-            "*canireachthe.net*", "*checkip.amazonaws.com*", "*checkip.dyndns.org*", "*curlmyip.com*",
-            "*db-ip.com*", "*edns.ip-api.com*", "*eth0.me*", "*freegeoip.app*", "*geoipy.com*", "*getip.pro*",
-            "*icanhazip.com*", "*ident.me*", "*ifconfig.io*", "*ifconfig.me*", "*ip-api.com*", "*ip.360.cn*",
-            "*ip.anysrc.net*", "*ip.taobao.com*", "*ip.tyk.nu*", "*ipaddressworld.com*", "*ipapi.co*",
-            "*ipconfig.io*", "*ipecho.net*", "*ipinfo.io*", "*ipip.net*", "*iplocation.net*",
-            "*ipof.in*", "*ipv6-test.com*", "*ipwho.is*", "*trackip.net*", "*inet-ip.info*",
-            "*jsonip.com*", "*myexternalip.com*", "*seeip.org*",  "*wgetip.com*",
-            "*whatismyip.akamai.com*", "*whois.pconline.com.cn*", "*wtfismyip.com*", "*ip.cn"
-            )
-    NOT process_name IN (
-            "brave.exe", "chrome.exe", "firefox.exe", "iexplore.exe", "maxthon.exe",
-            "MicrosoftEdge.exe", "msedge.exe", "msedgewebview2.exe", "opera.exe", "safari.exe",
-            "seamonkey.exe", "vivaldi.exe", "whale.exe"
-      )
-    | stats count min(_time) as firstTime max(_time) as lastTime
-            values(parent_process_arguments) as parent_process_arguments
-            values(process_arguments) as process_arguments
-            values(parent_process_hash) as parent_process_hash
-            values(process_hash) as process_hash
-            values(module_name_list) as module_name_list
-            values(module_hash_list) as module_hash_list
-            values(dest_port) as dest_port
-            values(aliul) as additional_logged_in_users_list
-            values(dest_hostname) as dest_hostname
-            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table
-      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
-      process_integrity_level process_path process_name process_arguments process_hash process_id
-      additional_logged_in_users_list module_name_list module_hash_list
-      src dest_hostname dest dest_port transport firstTime lastTime
-    | `cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+    source="not_applicable" dest_hostname IN ("*api.2ip.ua*", "*api.bigdatacloud.net*", "*api.ipify.org*", "*whatismyipaddress.com*", "*canireachthe.net*", "*checkip.amazonaws.com*", "*checkip.dyndns.org*", "*curlmyip.com*", "*db-ip.com*", "*edns.ip-api.com*", "*eth0.me*", "*freegeoip.app*", "*geoipy.com*", "*getip.pro*", "*icanhazip.com*", "*ident.me*", "*ifconfig.io*", "*ifconfig.me*", "*ip-api.com*", "*ip.360.cn*", "*ip.anysrc.net*", "*ip.taobao.com*", "*ip.tyk.nu*", "*ipaddressworld.com*", "*ipapi.co*", "*ipconfig.io*", "*ipecho.net*", "*ipinfo.io*", "*ipip.net*", "*iplocation.net*", "*ipof.in*", "*ipv6-test.com*", "*ipwho.is*", "*trackip.net*", "*inet-ip.info*", "*jsonip.com*", "*myexternalip.com*", "*seeip.org*", "*wgetip.com*", "*whatismyip.akamai.com*", "*whois.pconline.com.cn*", "*wtfismyip.com*", "*ip.cn*") NOT (process_name IN ("brave.exe", "chrome.exe", "firefox.exe", "iexplore.exe", "maxthon.exe", "MicrosoftEdge.exe", "msedge.exe", "msedgewebview2.exe", "opera.exe", "safari.exe", "seamonkey.exe", "vivaldi.exe", "whale.exe")) | eval src=src, dest_hostname=dest_hostname, dest_ip=dest_ip, dest_port=dest_port, process_path=process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api_filter`
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
-    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-known_false_positives: |
-    Internal scripts or agents performing network checks may query IP geolocation services.
-    Tune by excluding known tools or adding internal allowlists for destination domains or process names and commandlines.
+
+    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).'
+known_false_positives: 'Internal scripts or agents performing network checks may query IP geolocation services.
+
+    Tune by excluding known tools or adding internal allowlists for destination domains or process names and commandlines.'
 references:
     - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_external_ip_lookup.yml
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a
@@ -74,7 +48,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml
index e79046f8d0f..8373c83b25d 100644
--- a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml
+++ b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml
@@ -6,57 +6,33 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin.
+description: 'This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin.
+
     Webservers are rarely expected to perform outbound downloads, especially to dynamic or anonymous file hosting domains. This behavior is often associated with server compromise,
+
     where an attacker uses a reverse shell, webshell, or injected task to fetch malware or tools post-exploitation.
-    The detection leverages Cisco Network Visibility Module flow data, enriched with process context, to identify this highly suspicious behavior.
+
+    The detection leverages Cisco Network Visibility Module flow data, enriched with process context, to identify this highly suspicious behavior.'
 data_source:
     - Cisco Network Visibility Module Flow Data
 search: |
-    `cisco_network_visibility_module_flowdata`
-    process_name IN (
-        "http*.exe", "nginx*.exe", "php*.exe", "php-cgi*.exe", "tomcat*.exe"
-      )
-    dest_hostname IN (
-        "*.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*",
-        "*dl.dropboxusercontent.com*", "*ghostbin.co*", "*glitch.me*", "*gofile.io*",
-        "*hastebin.com*", "*mediafire.com*", "*mega.nz*", "*onrender.com*", "*pages.dev*",
-        "*paste.ee*", "*pastebin.*", "*pastetext.net*", "*privatlab.*",
-        "*send.exploit.in*", "*sendspace.com*", "*storage.googleapis.com*",
-        "*storjshare.io*", "*supabase.co*", "*temp.sh*", "*transfer.sh*", "*trycloudflare.com*",
-        "*ufile.io*", "*w3spaces.com*", "*workers.dev*"
-      )
-    | stats count min(_time) as firstTime max(_time) as lastTime
-            values(parent_process_arguments) as parent_process_arguments
-            values(process_arguments) as process_arguments
-            values(parent_process_hash) as parent_process_hash
-            values(process_hash) as process_hash
-            values(module_name_list) as module_name_list
-            values(module_hash_list) as module_hash_list
-            values(dest_port) as dest_port
-            values(aliul) as additional_logged_in_users_list
-            values(dest_hostname) as dest_hostname
-            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table
-      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
-      process_integrity_level process_path process_name process_arguments process_hash process_id
-      additional_logged_in_users_list module_name_list module_hash_list
-      src dest_hostname dest dest_port transport firstTime lastTime
-    | `cisco_nvm___webserver_download_from_file_sharing_website_filter`
-how_to_implement: |-
-    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+    source="not_applicable" process_name IN ("http*.exe", "nginx*.exe", "php*.exe", "php-cgi*.exe", "tomcat*.exe") dest_hostname IN ("*.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*", "*dl.dropboxusercontent.com*", "*ghostbin.co*", "*glitch.me*", "*gofile.io*", "*hastebin.com*", "*mediafire.com*", "*mega.nz*", "*onrender.com*", "*pages.dev*", "*paste.ee*", "*pastebin.*", "*pastetext.net*", "*privatlab.*", "*send.exploit.in*", "*sendspace.com*", "*storage.googleapis.com*", "*storjshare.io*", "*supabase.co*", "*temp.sh*", "*transfer.sh*", "*trycloudflare.com*", "*ufile.io*", "*w3spaces.com*", "*workers.dev*") | eval src=src, dest_hostname=dest_hostname, dest_ip=dest_ip, dest_port=dest_port, process_path=process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_nvm___webserver_download_from_file_sharing_website_filter`
+how_to_implement: 'This search requires Network Visibility Module logs, which includes the flow data sourcetype.
+
     This search uses an input macro named `cisco_network_visibility_module_flowdata`.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
+
     Replace the macro definition with configurations for your Splunk environment.
+
     The search also uses a post-filter macro designed to filter out known false positives.
-    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).
-known_false_positives: |
-    In rare cases, a web server may make outbound connections to pull content for legitimate purposes (e.g., downloading templates or updates from a trusted source).
+
+    The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404).'
+known_false_positives: 'In rare cases, a web server may make outbound connections to pull content for legitimate purposes (e.g., downloading templates or updates from a trusted source).
+
     However, communication to anonymous file-sharing or temporary content domains is strongly suspicious.
-    If legitimate use is confirmed, domain- or process-level allowlisting is recommended.
+
+    If legitimate use is confirmed, domain- or process-level allowlisting is recommended.'
 references:
     - https://www.cisa.gov/news-events/alerts/2023/04/13/cisa-adds-3-known-exploited-vulnerabilities-kev-catalog
     - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
@@ -69,7 +45,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The host $src$ ran web server process $process_path$ which downloaded content from $dest_hostname$ over port $dest_port$
     entity:
diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
index 1847001d8a0..51304d59159 100644
--- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
+++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "cipher.exe" Processes.process = "*/w:*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `clear_unallocated_sector_using_cipher_app_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*cipher.exe" Processes.process="*/w:*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clear_unallocated_sector_using_cipher_app_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: administrator may execute this app to manage disk
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk.
     entity:
diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml
index 824d3337345..226db935348 100644
--- a/detections/endpoint/clop_common_exec_parameter.yml
+++ b/detections/endpoint/clop_common_exec_parameter.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name != "*temp.dat*" Processes.process = "*runrun*"
-        OR
-        Processes.process = "*temp.dat*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `clop_common_exec_parameter_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.process_path="*temp.dat*" Processes.process IN ("*runrun*", "*temp.dat*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Operators can execute third party tools using these parameters.
 references:
@@ -40,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main code or feature of its code related to Clop ransomware.
     entity:
diff --git a/detections/endpoint/clop_ransomware_known_service_name.yml b/detections/endpoint/clop_ransomware_known_service_name.yml
index 0670a19e413..bef08e5d2d9 100644
--- a/detections/endpoint/clop_ransomware_known_service_name.yml
+++ b/detections/endpoint/clop_ransomware_known_service_name.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic identifies the creation of a service with a known name used by CLOP ransomware for persistence and high-privilege code execution. It detects this activity by monitoring Windows Event Logs (EventCode 7045) for specific service names ("SecurityCenterIBM", "WinCheckDRVs"). This activity is significant because the creation of such services is a common tactic used by ransomware to maintain control over infected systems. If confirmed malicious, this could allow attackers to execute code with elevated privileges, maintain persistence, and potentially disrupt or encrypt critical data.
 data_source:
     - Windows Event Log System 7045
-search: |-
-    `wineventlog_system` EventCode=7045 ServiceName IN ("SecurityCenterIBM", "WinCheckDRVs")
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY Computer EventCode ServiceName
-           StartType ServiceType
-      | rename Computer as dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `clop_ransomware_known_service_name_filter`
+search: |
+    `wineventlog_system` EventCode=7045 ServiceName IN ("SecurityCenterIBM", "WinCheckDRVs") | eval ServiceName=ServiceName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_ransomware_known_service_name_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -31,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of a known Clop Ransomware Service Name detected on $dest$
     entity:
diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
index cc24027ca68..c848710a9ae 100644
--- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml
+++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_cmd`
-        AND
-        Processes.process IN ("*/c*", "*/k*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cmd_carry_out_string_command_parameter_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*cmd.exe" OR Processes.original_file_name="Cmd.Exe" Processes.process IN ("*/c*", "*/k*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_carry_out_string_command_parameter_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be high based on legitimate scripted code in any environment. Filter as needed.
 references:
diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml
index ef6dfbc1ec8..4f5774d0165 100644
--- a/detections/endpoint/cmd_echo_pipe___escalation.yml
+++ b/detections/endpoint/cmd_echo_pipe___escalation.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_cmd`
-        OR
-        Processes.process=*%comspec%* (Processes.process=*echo*
-        AND
-        Processes.process=*pipe*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cmd_echo_pipe___escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.process="*%comspec%*" Processes.process="*echo*" Processes.process="*pipe*") OR Processes.process_name="*cmd.exe" OR Processes.original_file_name="Cmd.Exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_echo_pipe___escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time. fidelity.
 references:
@@ -42,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks.
     entity:
diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
index 6216a0ff414..8275167afee 100644
--- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
+++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the use of COM objects like CMLUA or CMSTPLUA to bypass User Account Control (UAC). It leverages Sysmon EventCode 7 to identify the loading of specific DLLs (CMLUA.dll, CMSTPLUA.dll, CMLUAUTIL.dll) by processes not typically associated with these libraries. This activity is significant as it indicates an attempt to gain elevated privileges, a common tactic used by ransomware adversaries. If confirmed malicious, this could allow attackers to execute code with administrative rights, leading to potential system compromise and further malicious activities.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7  ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*", "*\\program files*")) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmlua_or_cmstplua_uac_bypass_filter`'
+search: |
+    `sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT (process_name IN ("CMSTP.exe", "CMMGR32.exe")) NOT (Image IN ("*\\windows\\*", "*\\program files*")) | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmlua_or_cmstplua_uac_bypass_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: Legitimate windows application that are not on the list loading this dll. Filter as needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $dest$
     entity:
diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml
index 7fb53d11a58..3d7d826a9e2 100644
--- a/detections/endpoint/common_ransomware_extensions.yml
+++ b/detections/endpoint/common_ransomware_extensions.yml
@@ -6,10 +6,11 @@ modification_date: '2026-09-22'
 author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk, Steven Dick
 status: production
 type: TTP
-description: |-
-    The following analytic detects modifications to files with extensions commonly associated with ransomware. It leverages the Endpoint.Filesystem data model to identify changes in file extensions that match known ransomware patterns.
+description: 'The following analytic detects modifications to files with extensions commonly associated with ransomware. It leverages the Endpoint.Filesystem data model to identify changes in file extensions that match known ransomware patterns.
+
     This activity is significant because it suggests an attacker is attempting to encrypt or alter files, potentially leading to severe data loss and operational disruption.
-    If confirmed malicious, this activity could result in the encryption of critical data, rendering it inaccessible and causing significant damage to the organization's data integrity and availability.
+
+    If confirmed malicious, this activity could result in the encryption of critical data, rendering it inaccessible and causing significant damage to the organization''s data integrity and availability.'
 data_source:
     - Sysmon EventID 11
 search: |
@@ -92,7 +93,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The device $dest$ wrote $file_count$ files to $path_count$ path(s) with the $file_extension$ extension. This extension and behavior may indicate a $Name$ ransomware attack.
     entity:
diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml
index 73d3d89d0f9..c512a1e8ced 100644
--- a/detections/endpoint/common_ransomware_notes.yml
+++ b/detections/endpoint/common_ransomware_notes.yml
@@ -6,14 +6,19 @@ modification_date: '2026-07-02'
 author: David Dorsey, Splunk
 status: production
 type: Hunting
-description: |
-    The following analytic detects the creation of files with names commonly associated with ransomware notes.
+description: 'The following analytic detects the creation of files with names commonly associated with ransomware notes.
+
     It leverages file-system activity data from the Endpoint Filesystem data model, typically populated by endpoint detection and response (EDR) tools or Sysmon logs.
+
     This activity is significant because ransomware notes indicate a potential ransomware attack, which can lead to data encryption and extortion.
+
     If confirmed malicious, this activity could result in significant data loss, operational disruption, and financial impact due to ransom demands.
+
     Note that this analytic relies on a lookup table (ransomware_notes_lookup) that contains known ransomware note file names.
+
     Ensure that this lookup table is regularly updated to include new ransomware note file names as they are identified in the threat landscape.
-    Also this analytic leverages a sub-search to enhance performance. sub-searches have limitations on the amount of data they can return. Keep this in mind if you have an extensive list of ransomware note file names.
+
+    Also this analytic leverages a sub-search to enhance performance. sub-searches have limitations on the amount of data they can return. Keep this in mind if you have an extensive list of ransomware note file names.'
 data_source:
     - Sysmon EventID 11
 search: |
@@ -48,9 +53,9 @@ search: |
     | `security_content_ctime(firstTime)`
     | `common_ransomware_notes_filter`
 how_to_implement: You must be ingesting data that records file-system activity from your hosts to populate the Endpoint Filesystem data-model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes.
-known_false_positives: |
-    There could be cases where a legitimate file coincidentally matches a known ransomware note
-    name. In such cases, further investigation is required to determine the nature of the file and its context.
+known_false_positives: 'There could be cases where a legitimate file coincidentally matches a known ransomware note
+
+    name. In such cases, further investigation is required to determine the nature of the file and its context.'
 references: []
 analytic_story:
     - Chaos Ransomware
diff --git a/detections/endpoint/connectwise_screenconnect_path_traversal.yml b/detections/endpoint/connectwise_screenconnect_path_traversal.yml
index 3cb60d5e7d2..5a8a85e7bdb 100644
--- a/detections/endpoint/connectwise_screenconnect_path_traversal.yml
+++ b/detections/endpoint/connectwise_screenconnect_path_traversal.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability, which allows path traversal attacks by manipulating file_path and file_name parameters in the URL. It leverages the Endpoint datamodel Filesystem node to identify suspicious file system events, specifically targeting paths and filenames associated with ScreenConnect. This activity is significant as it can lead to unauthorized access to sensitive files and directories, potentially resulting in data exfiltration or arbitrary code execution. If confirmed malicious, attackers could gain unauthorized access and control over the host system, posing a severe security risk.
 data_source:
     - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\ScreenConnect\\App_Extensions\\*") Filesystem.file_name IN ("*.aspx","*.ashx") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `connectwise_screenconnect_path_traversal_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\ScreenConnect\\App_Extensions\\*" Filesystem.file_name IN ("*.aspx", "*.ashx") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `connectwise_screenconnect_path_traversal_filter`
 how_to_implement: This analytic utilizes the Endpoint datamodel Filesystem node to identify path traversal attempts against ScreenConnect. Note that using SACL auditing or other file system monitoring tools may also be used to detect path traversal attempts. Typically the data for this analytic will come from EDR or other properly CIM mapped data sources.
 known_false_positives: False positives are not expected, as the detection is based on the presence of file system events that indicate path traversal attempts. The analytic may be modified to look for any file writes to this path as it is not common for files to write here.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A path traversal attack against ScreenConnect has been detected on $dest$.
     entity:
diff --git a/detections/endpoint/connectwise_screenconnect_path_traversal_windows_sacl.yml b/detections/endpoint/connectwise_screenconnect_path_traversal_windows_sacl.yml
index b2abd432b42..01de26f7a46 100644
--- a/detections/endpoint/connectwise_screenconnect_path_traversal_windows_sacl.yml
+++ b/detections/endpoint/connectwise_screenconnect_path_traversal_windows_sacl.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability using Windows SACL EventCode 4663. It identifies path traversal attacks by monitoring file system events related to the ScreenConnect service. This activity is significant as it allows unauthorized access to sensitive files and directories, potentially leading to data exfiltration or arbitrary code execution. If confirmed malicious, attackers could gain unauthorized access to critical data or execute harmful code, compromising the integrity and security of the affected system. Immediate remediation by updating to version 23.9.8 or above is recommended.
 data_source:
     - Windows Event Log Security 4663
-search: '`wineventlog_security` EventCode=4663  ProcessName=*\\ScreenConnect.Service.exe file_path IN ("*\\ScreenConnect\\App_Extensions\\*") file_name IN ("*.aspx","*.ashx") | stats count min(_time) as firstTime max(_time) as lastTime by  ObjectName ObjectType ProcessName AccessMask process_id EventCode Computer Caller_User_Name | rename Computer as dest Caller_User_Name as user ProcessName as process_name |  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `connectwise_screenconnect_path_traversal_windows_sacl_filter`'
+search: |
+    `wineventlog_security` EventCode=4663 ProcessName="*\\ScreenConnect.Service.exe" file_path="*\\ScreenConnect\\App_Extensions\\*" file_name IN ("*.aspx", "*.ashx") | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `connectwise_screenconnect_path_traversal_windows_sacl_filter`
 how_to_implement: To implement the following query, enable SACL auditing for the ScreenConnect directory(ies). With this data, the following analytic will work correctly. A GIST is provided in the references to assist with enabling SACL Auditing.
 known_false_positives: False positives should be limited as the analytic is specific to ScreenConnect path traversal attempts. Tune as needed, or restrict to specific hosts if false positives are encountered.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A path traversal attack against ScreenConnect has been detected on $dest$.
     entity:
@@ -52,6 +53,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/screenconnect/4663_connectwise_aspx_app_extensions.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Security
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml
index 7162bdb0b1a..67976096b86 100644
--- a/detections/endpoint/conti_common_exec_parameter.yml
+++ b/detections/endpoint/conti_common_exec_parameter.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process IN ("*-m local", "*-m local *", "*-m net", "*-m net *", "*-m all","*-m all *", "*-nomutex", "*-nomutex *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `conti_common_exec_parameter_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*-m local", "*-m local ", "*-m net", "*-m net ", "*-m all", "*-m all ", "*-nomutex", "*-nomutex ") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `conti_common_exec_parameter_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: 3rd party tool may have commandline parameter that can trigger this detection.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters.
     entity:
diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml
index 7eb280d8203..d8428bbebf3 100644
--- a/detections/endpoint/control_loading_from_world_writable_directory.yml
+++ b/detections/endpoint/control_loading_from_world_writable_directory.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=control.exe OR Processes.original_file_name=CONTROL.EXE) AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `control_loading_from_world_writable_directory_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*control.exe" OR Processes.original_file_name="CONTROL.EXE" Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `control_loading_from_world_writable_directory_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives will be present as control.exe does not natively load from writable paths as defined. One may add .cpl or .inf to the command-line if there is any false positives. Tune as needed.
 references:
@@ -29,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
     entity:
diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
index d5039c90a25..d33a94c89e7 100644
--- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
@@ -11,21 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_net`
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | search process IN ("*share* /delete*", "*share* /REMARK:*", "*share* /CACHE:*")
-    | `create_or_delete_windows_shares_using_net_exe_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*net1.exe" OR Processes.original_file_name="net1.exe" Processes.process IN ("*share* /delete*", "*share* /REMARK:*", "*share* /CACHE:*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_or_delete_windows_shares_using_net_exe_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators often leverage net.exe to create or delete network shares. You should verify that the activity was intentional and is legitimate.
 references:
@@ -40,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares.
     entity:
diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml
index be5f1009d44..92de7838f46 100644
--- a/detections/endpoint/create_remote_thread_in_shell_application.yml
+++ b/detections/endpoint/create_remote_thread_in_shell_application.yml
@@ -6,33 +6,17 @@ modification_date: '2026-06-29'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects suspicious process injection in command shell applications, specifically targeting `cmd.exe` and `powershell.exe`.
+description: 'The following analytic detects suspicious process injection in command shell applications, specifically targeting `cmd.exe` and `powershell.exe`.
+
     It leverages Sysmon EventCode 8 to identify the creation of remote threads within these shell processes.
+
     This activity is significant because it is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.
-    If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to system security.
+
+    If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to system security.'
 data_source:
     - Sysmon EventID 8
-search: |-
-    `sysmon`
-    EventCode=8
-    TargetImage IN (
-        "*\\cmd.exe",
-        "*\\powershell_ise.exe",
-        "*\\powershell.exe",
-        "*\\pwsh.exe"
-    )
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-                  values(NewThreadId) as "NewThreadId"
-                  values(StartAddress) as "StartAddress"
-      by dest signature_id signature
-         SourceProcessGuid SourceProcessId SourceImage
-         TargetProcessGuid TargetProcessId TargetImage
-         StartModule StartFunction vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `create_remote_thread_in_shell_application_filter`
+search: |
+    `sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell_ise.exe", "*\\powershell.exe", "*\\pwsh.exe") | stats count min(_time) as firstTime max(_time) as lastTime by dest signature_id signature SourceProcessGuid SourceProcessId SourceImage TargetProcessGuid TargetProcessId TargetImage StartModule StartFunction SourceUser TargetUser vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_remote_thread_in_shell_application_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -45,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The process $SourceImage$ created a remote thread into the shell app process $TargetImage$ in host $dest$
     entity:
diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml
index 683a81b26d3..e1e8d231548 100644
--- a/detections/endpoint/create_remote_thread_into_lsass.yml
+++ b/detections/endpoint/create_remote_thread_into_lsass.yml
@@ -6,29 +6,19 @@ modification_date: '2026-06-29'
 author: Patrick Bareiss, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS).
+description: 'The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS).
+
     This behavior is identified using Sysmon EventID 8 logs, focusing on processes that create remote threads in lsass.exe.
+
     This activity is significant because it is commonly associated with credential dumping, a tactic used by adversaries to steal user authentication credentials.
+
     If confirmed malicious, this could allow attackers to gain unauthorized access to sensitive information, leading to potential compromise of the entire network.
-    Analysts should investigate to differentiate between legitimate tools and potential threats.
+
+    Analysts should investigate to differentiate between legitimate tools and potential threats.'
 data_source:
     - Sysmon EventID 8
-search: |-
-    `sysmon`
-    EventID=8
-    TargetImage="*\\lsass.exe"
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-                  values(NewThreadId) as "NewThreadId"
-                  values(StartAddress) as "StartAddress"
-      by dest signature_id signature
-         SourceProcessGuid SourceProcessId SourceImage
-         TargetProcessGuid TargetProcessId TargetImage
-         StartModule StartFunction vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `create_remote_thread_into_lsass_filter`
+search: |
+    `sysmon` EventCode=8 TargetImage="*\\lsass.exe" | stats count min(_time) as firstTime max(_time) as lastTime by dest signature_id signature SourceProcessGuid SourceProcessId SourceImage TargetProcessGuid TargetProcessId TargetImage StartModule StartFunction SourceUser TargetUser vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_remote_thread_into_lsass_filter`
 how_to_implement: This search needs Sysmon Logs with a Sysmon configuration, which includes EventCode 8 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
 known_false_positives: Other tools can access LSASS for legitimate reasons and generate an event. In these cases, tweaking the search may help eliminate noise.
 references:
@@ -41,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated.
     entity:
diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
index c0b325b2304..b47fc6d3a0f 100644
--- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
+++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
@@ -6,28 +6,15 @@ modification_date: '2026-10-02'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects the creation of an lsass.exe process dump using Windows Task Manager.
+description: 'The following analytic detects the creation of an lsass.exe process dump using Windows Task Manager.
+
     It leverages Sysmon EventID 11 to identify file creation events where the target filename matches *lsass*.dmp.
-    This activity is significant because creating an lsass dump can be a precursor to credential theft, as the dump file contains sensitive information such as user passwords.
+
+    This activity is significant because creating an lsass dump can be a precursor to credential theft, as the dump file contains sensitive information such as user passwords.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    `sysmon`
-    EventID=11
-    process_name=taskmgr.exe
-    file_path=*lsass*.dmp
-
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      BY action dest
-         file_name file_path
-         process_name process_guid process_id
-         user_id vendor_product
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `creation_of_lsass_dump_with_taskmgr_filter`
+search: |
+    `sysmon` EventCode=11 process_name="taskmgr.exe" TargetFilename="lsass*.dmp" | eval process_name=process_name, root_drive=root_drive | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name file_path process_guid process_id user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `creation_of_lsass_dump_with_taskmgr_filter`
 how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
 known_false_positives: Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual.
 references:
@@ -43,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The process [$process_name$] was identified on endpoint [$dest$] writing [$file_path$] to disk.
     entity:
diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml
index d5262c808c0..aebc27e4a27 100644
--- a/detections/endpoint/creation_of_shadow_copy.yml
+++ b/detections/endpoint/creation_of_shadow_copy.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=vssadmin.exe Processes.process=*create* Processes.process=*shadow*
-        )
-        OR (Processes.process_name=wmic.exe Processes.process=*shadowcopy* Processes.process=*create*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `creation_of_shadow_copy_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.process_name="*vssadmin.exe" Processes.process="*create*" Processes.process="*shadow*") OR (Processes.process_name="*wmic.exe" Processes.process="*shadowcopy*" Processes.process="*create*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate administrator usage of Vssadmin or Wmic will create false positives.
 references:
@@ -43,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking.
     entity:
diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
index 92750935e23..a4f621ec562 100644
--- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
+++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_wmic`
-        OR
-        `process_powershell` Processes.process=*shadowcopy* Processes.process=*create*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `creation_of_shadow_copy_with_wmic_and_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") Processes.process="*shadowcopy*" Processes.process="*create*") OR Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `creation_of_shadow_copy_with_wmic_and_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate administrator usage of wmic to create a shadow copy.
 references:
@@ -42,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking.
     entity:
diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
index 39fdc97d94a..8a6fb5c50f2 100644
--- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
+++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` (Processes.process=*\\system32\\config\\sam* OR Processes.process=*\\system32\\config\\security* OR Processes.process=*\\system32\\config\\system* OR Processes.process=*\\windows\\ntds\\ntds.dit*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_copy_command_from_shadow_copy_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*cmd.exe" OR Processes.original_file_name="Cmd.Exe" Processes.process IN ("*\\system32\\config\\sam*", "*\\system32\\config\\security*", "*\\system32\\config\\system*", "*\\windows\\ntds\\ntds.dit*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `credential_dumping_via_copy_command_from_shadow_copy_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking.
     entity:
diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
index 2dc83ba0168..23122125151 100644
--- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
+++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_cmd` Processes.process=*mklink* Processes.process=*HarddiskVolumeShadowCopy*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `credential_dumping_via_symlink_to_shadow_copy_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*cmd.exe" OR Processes.original_file_name="Cmd.Exe" Processes.process="*mklink*" Processes.process="*HarddiskVolumeShadowCopy*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials.
     entity:
diff --git a/detections/endpoint/crowdstrike_admin_weak_password_policy.yml b/detections/endpoint/crowdstrike_admin_weak_password_policy.yml
index 7885bd496c6..9aa2f64a3b4 100644
--- a/detections/endpoint/crowdstrike_admin_weak_password_policy.yml
+++ b/detections/endpoint/crowdstrike_admin_weak_password_policy.yml
@@ -8,7 +8,7 @@ status: production
 type: TTP
 description: The following analytic detects CrowdStrike alerts for admin weak password policy violations, identifying instances where administrative passwords do not meet security standards. These alerts highlight significant vulnerabilities that could be exploited by attackers to gain unauthorized access. Promptly addressing these alerts is crucial for maintaining robust security and protecting critical systems and data from potential threats.
 data_source: []
-search: |-
+search: |
     `crowdstrike_identities` primaryDisplayName = "*admin*"
       | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Weak Password for Admin User found on $domain$
     entity:
@@ -53,6 +53,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/admin_weak_password_policy/crowdstrike_weak_password_admin_cleaned.log
-          sourcetype: crowdstrike:identities
           source: crowdstrike:identities
+          sourcetype: crowdstrike:identities
       test_type: unit
diff --git a/detections/endpoint/crowdstrike_admin_with_duplicate_password.yml b/detections/endpoint/crowdstrike_admin_with_duplicate_password.yml
index 8cd1f8066fa..c18137a3878 100644
--- a/detections/endpoint/crowdstrike_admin_with_duplicate_password.yml
+++ b/detections/endpoint/crowdstrike_admin_with_duplicate_password.yml
@@ -8,7 +8,7 @@ status: production
 type: TTP
 description: The following analytic detects CrowdStrike alerts for admin accounts with duplicate password risk, identifying instances where administrative users share the same password. This practice significantly increases the risk of unauthorized access and potential breaches. Addressing these alerts promptly is crucial for maintaining strong security protocols, ensuring each admin account uses a unique, secure password to protect critical systems and data.
 data_source: []
-search: |-
+search: |
     `crowdstrike_identities` primaryDisplayName = "*admin*"
       | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Duplicate Password for Admin User found on $domain$
     entity:
@@ -53,6 +53,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/admin_duplicate_password/crowdstrike_admin_dup_pwd_cleaned.log
-          sourcetype: crowdstrike:identities
           source: crowdstrike:identities
+          sourcetype: crowdstrike:identities
       test_type: unit
diff --git a/detections/endpoint/crowdstrike_falcon_stream_alerts.yml b/detections/endpoint/crowdstrike_falcon_stream_alerts.yml
index 810b37be924..adc2f6f34be 100644
--- a/detections/endpoint/crowdstrike_falcon_stream_alerts.yml
+++ b/detections/endpoint/crowdstrike_falcon_stream_alerts.yml
@@ -49,9 +49,9 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: View other CrowdStrike events for "$user$ on "$dest$"
-      search: '$annotations.drilldown_search$'
+      search: $annotations.drilldown_search$
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
 intermediate_findings:
diff --git a/detections/endpoint/crowdstrike_high_identity_risk_severity.yml b/detections/endpoint/crowdstrike_high_identity_risk_severity.yml
index 2ac821f46c5..9527e4c4b1a 100644
--- a/detections/endpoint/crowdstrike_high_identity_risk_severity.yml
+++ b/detections/endpoint/crowdstrike_high_identity_risk_severity.yml
@@ -8,7 +8,7 @@ status: production
 type: TTP
 description: The following analytic detects CrowdStrike alerts for High Identity Risk Severity with a risk score of 70 or higher. These alerts indicate significant vulnerabilities in user identities, such as suspicious behavior or compromised credentials. Promptly investigating and addressing these alerts is crucial to prevent potential security breaches and ensure the integrity and protection of sensitive information and systems.
 data_source: []
-search: |-
+search: |
     `crowdstrike_identities` riskScoreSeverity="HIGH" OR riskScore >= 0.70
       | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: High Identity Risk Score Severity found on $domain$
     entity:
@@ -52,6 +52,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/high_risk_score/crowdstrike_high_riskscore_cleaned.log
-          sourcetype: crowdstrike:identities
           source: crowdstrike:identities
+          sourcetype: crowdstrike:identities
       test_type: unit
diff --git a/detections/endpoint/crowdstrike_medium_identity_risk_severity.yml b/detections/endpoint/crowdstrike_medium_identity_risk_severity.yml
index c30c96968b1..62bb44e68fc 100644
--- a/detections/endpoint/crowdstrike_medium_identity_risk_severity.yml
+++ b/detections/endpoint/crowdstrike_medium_identity_risk_severity.yml
@@ -8,7 +8,7 @@ status: production
 type: TTP
 description: The following analytic detects CrowdStrike alerts for Medium Identity Risk Severity with a risk score of 55 or higher. These alerts indicate significant vulnerabilities in user identities, such as suspicious behavior or compromised credentials. Promptly investigating and addressing these alerts is crucial to prevent potential security breaches and ensure the integrity and protection of sensitive information and systems.
 data_source: []
-search: |-
+search: |
     `crowdstrike_identities` riskScoreSeverity = "MEDIUM" OR riskScore >= 0.55 AND riskScore < 0.70
       | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Medium Identity Risk Score Severity found on $domain$
     entity:
@@ -52,6 +52,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/riskscore/crowdstrike_riskscore_cleaned.log
-          sourcetype: crowdstrike:identities
           source: crowdstrike:identities
+          sourcetype: crowdstrike:identities
       test_type: unit
diff --git a/detections/endpoint/crowdstrike_medium_severity_alert.yml b/detections/endpoint/crowdstrike_medium_severity_alert.yml
index 9280fe8ae01..323ee904a3e 100644
--- a/detections/endpoint/crowdstrike_medium_severity_alert.yml
+++ b/detections/endpoint/crowdstrike_medium_severity_alert.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic detects a CrowdStrike alert with MEDIUM severity indicates a potential threat that requires prompt attention. This alert level suggests suspicious activity that may compromise security but is not immediately critical. It typically involves detectable but non-imminent risks, such as unusual behavior or attempted policy violations, which should be investigated further and mitigated quickly to prevent escalation of attacks.
 data_source: []
-search: |-
+search: |
     `crowdstrike_stream`
       | rename event.EndpointIp as src_ip, event.EndpointName as src_host, event.UserName as user, event.IncidentDescription as description, event.IncidentType as type, event.NumbersOfAlerts as count_alerts, event.SeverityName as severity
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -53,7 +53,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/medium_alert/crowdstrike_medium_clean.log
-          sourcetype: CrowdStrike:Event:Streams:JSON
           source: CrowdStrike:Event:Streams
+          sourcetype: CrowdStrike:Event:Streams:JSON
       description: PORTED MANUAL TEST - This detection is marked manual test because the attack_data file and TA do not provide the event.EndpointIp and event.EndpointName fields.  event.EndpointName is required to be present for the Risk Message Validation Integration Testing. This will be investigated and is a tracked issue.
       test_type: experimental
diff --git a/detections/endpoint/crowdstrike_multiple_low_severity_alerts.yml b/detections/endpoint/crowdstrike_multiple_low_severity_alerts.yml
index 9a6493fadba..6b78e0edb9b 100644
--- a/detections/endpoint/crowdstrike_multiple_low_severity_alerts.yml
+++ b/detections/endpoint/crowdstrike_multiple_low_severity_alerts.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic detects multiple CrowdStrike LOW severity alerts, indicating a series of minor suspicious activities or policy violations. These alerts are not immediately critical but should be reviewed to prevent potential threats. They often highlight unusual behavior or low-level risks that, if left unchecked, could escalate into more significant security issues. Regular monitoring and analysis of these alerts are essential for maintaining robust security.
 data_source: []
-search: |-
+search: |
     `crowdstrike_stream` tag=alert event.SeverityName= LOW
       | rename event.EndpointIp as src_ip, event.EndpointName as src_host, event.UserName as user, event.IncidentDescription as description, event.IncidentType as type, event.NumbersOfAlerts as count_alerts, event.SeverityName as severity
       | stats dc(type) as type_count, values(user) as users, values(description) as descriptions, values(type) as types, values(severity) count min(_time) as firstTime max(_time) as lastTime
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_host$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src_host
@@ -51,6 +51,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/multiple_low_alert/crowdstrike_multiple_low_cleaned.log
-          sourcetype: CrowdStrike:Event:Streams:JSON
           source: CrowdStrike:Event:Streams
+          sourcetype: CrowdStrike:Event:Streams:JSON
       test_type: unit
diff --git a/detections/endpoint/crowdstrike_privilege_escalation_for_non_admin_user.yml b/detections/endpoint/crowdstrike_privilege_escalation_for_non_admin_user.yml
index f315e405438..cb883b25dae 100644
--- a/detections/endpoint/crowdstrike_privilege_escalation_for_non_admin_user.yml
+++ b/detections/endpoint/crowdstrike_privilege_escalation_for_non_admin_user.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic detects CrowdStrike alerts for privilege escalation attempts by non-admin users. These alerts indicate unauthorized efforts by regular users to gain elevated permissions, posing a significant security risk. Detecting and addressing these attempts promptly helps prevent potential breaches and ensures that user privileges remain properly managed, maintaining the integrity of the organization's security protocols.
 data_source: []
-search: |-
+search: |
     `crowdstrike_stream` tag=alert
       | rename event.EndpointIp as src_ip, event.EndpointName as src_host, event.UserName as user, event.IncidentDescription as description, event.IncidentType as type, event.NumbersOfAlerts as count_alerts, event.SeverityName as severity
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -53,7 +53,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/privilege_escalation/crowdstrike_priv_esc_cleaned.log
-          sourcetype: CrowdStrike:Event:Streams:JSON
           source: CrowdStrike:Event:Streams
+          sourcetype: CrowdStrike:Event:Streams:JSON
       description: PORTED MANUAL TEST - This detection is marked manual test because the attack_data file and TA do not provide the event.EndpointIp and event.EndpointName fields. event.EndpointName is required to be present for the Risk Message Validation Integration Testing. This will be investigated and is a tracked issue.
       test_type: experimental
diff --git a/detections/endpoint/crowdstrike_user_weak_password_policy.yml b/detections/endpoint/crowdstrike_user_weak_password_policy.yml
index 8c6c6e441b5..28876d5d0ce 100644
--- a/detections/endpoint/crowdstrike_user_weak_password_policy.yml
+++ b/detections/endpoint/crowdstrike_user_weak_password_policy.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic detects CrowdStrike alerts for weak password policy violations, identifying instances where passwords do not meet the required security standards. These alerts highlight potential vulnerabilities that could be exploited by attackers, emphasizing the need for stronger password practices. Addressing these alerts promptly helps to enhance overall security and protect sensitive information from unauthorized access.
 data_source: []
-search: |-
+search: |
     `crowdstrike_identities`  primaryDisplayName != "*admin*"
       | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -53,6 +53,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/non_adminweak_password_policy/crowdstrike_user_weak_password_cleaned.log
-          sourcetype: crowdstrike:identities
           source: crowdstrike:identities
+          sourcetype: crowdstrike:identities
       test_type: unit
diff --git a/detections/endpoint/crowdstrike_user_with_duplicate_password.yml b/detections/endpoint/crowdstrike_user_with_duplicate_password.yml
index b118a82953f..e0ec00339cd 100644
--- a/detections/endpoint/crowdstrike_user_with_duplicate_password.yml
+++ b/detections/endpoint/crowdstrike_user_with_duplicate_password.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic detects CrowdStrike alerts for non-admin accounts with duplicate password risk, identifying instances where multiple non-admin users share the same password. This practice weakens security and increases the potential for unauthorized access. Addressing these alerts is essential to ensure each user account has a unique, strong password, thereby enhancing overall security and protecting sensitive information.
 data_source: []
-search: |-
+search: |
     `crowdstrike_identities` primaryDisplayName != "*admin*"
       | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -53,6 +53,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/user_duplicate_password/crowdstrike_user_dup_pwd_cleaned.log
-          sourcetype: crowdstrike:identities
           source: crowdstrike:identities
+          sourcetype: crowdstrike:identities
       test_type: unit
diff --git a/detections/endpoint/csc_net_on_the_fly_compilation.yml b/detections/endpoint/csc_net_on_the_fly_compilation.yml
index 145c0b18235..14e54e3f3b7 100644
--- a/detections/endpoint/csc_net_on_the_fly_compilation.yml
+++ b/detections/endpoint/csc_net_on_the_fly_compilation.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=csc.exe
-            OR
-            Processes.original_file_name=csc.exe
-        )
-        Processes.process = "*/noconfig*" Processes.process = "*/fullpaths*" Processes.process = "*@*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `csc_net_on_the_fly_compilation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*csc.exe" OR Processes.original_file_name="csc.exe" Processes.process="*/noconfig*" Processes.process="*/fullpaths*" Processes.process="*@*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `csc_net_on_the_fly_compilation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: A network operator or systems administrator may utilize an automated powershell script taht execute .net code that may generate false positive. filter is needed.
 references:
diff --git a/detections/endpoint/curl_execution_with_percent_encoded_url.yml b/detections/endpoint/curl_execution_with_percent_encoded_url.yml
index 66eefae4ecd..5bf932e55e1 100644
--- a/detections/endpoint/curl_execution_with_percent_encoded_url.yml
+++ b/detections/endpoint/curl_execution_with_percent_encoded_url.yml
@@ -6,14 +6,19 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output).
+description: 'The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output).
+
     It leverages process execution telemetry from Endpoint Detection and Response (EDR) data sources to identify curl commands that may be using URL encoding to obfuscate download locations or payload paths.
+
     This behavior is notable because percent-encoded URLs are commonly used by adversaries to evade simple string-based detections, hide malicious infrastructure, or bypass network security controls.
+
     When combined with file download behavior, this activity may indicate malware staging, payload retrieval, or secondary tool deployment.
+
     Analysts should review the decoded URL, destination host, parent process, and downloaded file to determine whether the activity is authorized or malicious.
+
     The analytic calculates the number of percent (%) characters in the curl command line and triggers when a threshold of three or more is met, indicating potential URL encoding.
-    Adjust the threshold as needed based on your environment and tuning requirements.
+
+    Adjust the threshold as needed based on your environment and tuning requirements.'
 data_source:
     - CrowdStrike ProcessRollup2
     - Sysmon EventID 1
@@ -56,18 +61,24 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `curl_execution_with_percent_encoded_url_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    No false positives have been identified at this time.
+
+    names and speed up the data modeling process.'
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://github.com/nasbench/Misc-Research/blob/main/LOLBINs/Curl.md
     - https://attack.mitre.org/techniques/T1027/
@@ -81,7 +92,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml
index 55a0ec44a14..b7c9f73204e 100644
--- a/detections/endpoint/delete_shadowcopy_with_powershell.yml
+++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the use of PowerShell to delete shadow copies via the WMIC PowerShell module. It leverages EventCode 4104 and searches for specific keywords like "ShadowCopy," "Delete," or "Remove" within the ScriptBlockText. This activity is significant because deleting shadow copies is a common tactic used by ransomware, such as DarkSide, to prevent data recovery. If confirmed malicious, this action could lead to irreversible data loss and hinder recovery efforts, significantly impacting business continuity and data integrity.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText= "*ShadowCopy*" (ScriptBlockText = "*Delete*" OR ScriptBlockText = "*Remove*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `delete_shadowcopy_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*ShadowCopy*" Processes.process IN ("*Delete*", "*Remove*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `delete_shadowcopy_with_powershell_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_id$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An attempt to delete ShadowCopy was performed using PowerShell on $dest$ by $user_id$.
     entity:
diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml
index 4e8f64722a3..65ee6a541c8 100644
--- a/detections/endpoint/deleting_shadow_copies.yml
+++ b/detections/endpoint/deleting_shadow_copies.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=vssadmin.exe
-            OR
-            Processes.process_name=wmic.exe
-        )
-        Processes.process=*delete* Processes.process=*shadow*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `deleting_shadow_copies_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*vssadmin.exe", "*wmic.exe") Processes.process="*delete*" Processes.process="*shadow*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `deleting_shadow_copies_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped with modern versions of windows. They may be used by administrators to legitimately delete old backup copies, although this is typically rare.
 references:
@@ -43,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies.
     entity:
diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml
index f2bfac8d764..aa0a1830d97 100644
--- a/detections/endpoint/detect_azurehound_command_line_arguments.yml
+++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process IN ("*invoke-azurehound*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_azurehound_command_line_arguments_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*invoke-azurehound*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_azurehound_command_line_arguments_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -40,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD.
     entity:
diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml
index 95cecfc089e..0eb9f0d0727 100644
--- a/detections/endpoint/detect_azurehound_file_modifications.yml
+++ b/detections/endpoint/detect_azurehound_file_modifications.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the creation of specific AzureHound-related files, such as `*-azurecollection.zip` and various `.json` files, on disk. It leverages data from the Endpoint.Filesystem datamodel, focusing on file creation events with specific filenames. This activity is significant because AzureHound is a tool used to gather information about Azure environments, similar to SharpHound for on-premises Active Directory. If confirmed malicious, this activity could indicate an attacker is collecting sensitive Azure environment data, potentially leading to further exploitation or privilege escalation within the cloud infrastructure.
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.file_name IN ("*-azurecollection.zip", "*-azprivroleadminrights.json", "*-azglobaladminrights.json", "*-azcloudappadmins.json", "*-azapplicationadmins.json")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_azurehound_file_modifications_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*-azurecollection.zip", "*-azprivroleadminrights.json", "*-azglobaladminrights.json", "*-azcloudappadmins.json", "*-azapplicationadmins.json") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_azurehound_file_modifications_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 known_false_positives: False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml
index a5a9c7e68e4..49ff19cf2db 100644
--- a/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml
+++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic detects attempts to exploit the Baron Samedit vulnerability (CVE-2021-3156) by identifying the use of the "sudoedit -s \\" command. This detection leverages logs from Linux systems, specifically searching for instances of the sudoedit command with the "-s" flag followed by a double quote. This activity is significant because it indicates an attempt to exploit a known vulnerability that allows attackers to gain root privileges. If confirmed malicious, this could lead to complete system compromise, unauthorized access to sensitive data, and potential data breaches.
 data_source: []
-search: '`linux_hosts` "sudoedit -s \\" | `detect_baron_samedit_cve_2021_3156_filter`'
+search: '`linux_hosts` "sudoedit -s \\" | `detect_baron_samedit_cve_2021_3156_filter` | stats count by dest'
 how_to_implement: Splunk Universal Forwarder running on Linux systems, capturing logs from the /var/log directory. The vulnerability is exposed when a non privledged user tries passing in a single \ character at the end of the command while using the shell and edit flags.
 known_false_positives: No false positives have been identified at this time.
 references: []
diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml
index 905904246eb..d09fab43b6d 100644
--- a/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml
+++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic identifies a heap-based buffer overflow in sudoedit by detecting Linux logs containing both "sudoedit" and "segfault" terms. This detection leverages Splunk to monitor for more than five occurrences of these terms on a single host within a specified timeframe. This activity is significant because exploiting this vulnerability (CVE-2021-3156) can allow attackers to gain root privileges, leading to potential system compromise, unauthorized access, and data breaches. If confirmed malicious, this could result in elevated privileges and full control over the affected system, posing a severe security risk.
 data_source: []
-search: |-
+search: |
     `linux_hosts` TERM(sudoedit) TERM(segfault)
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY host
diff --git a/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml b/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml
index aa0c50d057a..16e450b9cf2 100644
--- a/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml
+++ b/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml
@@ -8,7 +8,8 @@ status: experimental
 type: TTP
 description: The following analytic detects the execution of the "sudoedit -s *" command, which is associated with the Baron Samedit CVE-2021-3156 heap-based buffer overflow vulnerability. This detection leverages the `osquery_process` data source to identify instances where this specific command is run. This activity is significant because it indicates an attempt to exploit a known vulnerability that allows privilege escalation. If confirmed malicious, an attacker could gain full control of the system, execute arbitrary code, or access sensitive data, leading to potential data breaches and system disruptions.
 data_source: []
-search: '`osquery_process` | search "columns.cmdline"="sudoedit -s \\*" | `detect_baron_samedit_cve_2021_3156_via_osquery_filter`'
+search: |
+    `osquery_process` | search "columns.cmdline"="sudoedit -s \\*" | `detect_baron_samedit_cve_2021_3156_via_osquery_filter` | stats count by dest
 how_to_implement: OSQuery installed and configured to pick up process events (info at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402. The vulnerability is exposed when a non privledged user tries passing in a single \ character at the end of the command while using the shell and edit flags.
 known_false_positives: No false positives have been identified at this time.
 references: []
diff --git a/detections/endpoint/detect_certify_command_line_arguments.yml b/detections/endpoint/detect_certify_command_line_arguments.yml
index 7e431075552..7dd3cc4008a 100644
--- a/detections/endpoint/detect_certify_command_line_arguments.yml
+++ b/detections/endpoint/detect_certify_command_line_arguments.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process IN ("* find *","* auth *","* request *","* req *","* download *",)
-        AND
-        Processes.process IN ("* /vulnerable*","* /enrolleeSuppliesSubject *","* /json /outfile*","* /ca*", "* -username *","* -u *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_certify_command_line_arguments_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("* find *", "* auth *", "* request *", "* req *", "* download *") Processes.process IN ("* /vulnerable*", "* /enrolleeSuppliesSubject *", "* /json /outfile*", "* /ca*", "* -username *", "* -u *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_certify_command_line_arguments_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -41,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Certify/Certipy arguments detected on $dest$.
     entity:
@@ -51,8 +37,6 @@ finding:
 threat_objects:
     - field: process_name
       type: process_name
-    - field: process_name
-      type: process_name
 analytic_story:
     - Compromised Windows Host
     - Windows Certificate Services
diff --git a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml
index 7463956388c..15bd16eef26 100644
--- a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml
+++ b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the use of the Certify tool via an in-memory PowerShell function to enumerate Active Directory Certificate Services (AD CS) environments. It leverages PowerShell Script Block Logging (EventCode 4104) to identify specific command patterns associated with Certify's enumeration and exploitation functions. This activity is significant as it indicates potential reconnaissance or exploitation attempts against AD CS, which could lead to unauthorized certificate issuance. If confirmed malicious, attackers could leverage this to escalate privileges, persist in the environment, or access sensitive information by abusing AD CS.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
+search: |
     `powershell` EventCode=4104 (ScriptBlockText IN ("*find *") AND ScriptBlockText IN ("* /vulnerable*","* -vulnerable*","* /enrolleeSuppliesSubject *","* /json /outfile*")) OR (ScriptBlockText IN (,"*auth *","*req *",) AND ScriptBlockText IN ("* -ca *","* -username *","* -u *")) OR (ScriptBlockText IN ("*request *","*download *") AND ScriptBlockText IN ("* /ca:*"))
       | fillnull
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Certify arguments through PowerShell detected on $dest$.
     entity:
diff --git a/detections/endpoint/detect_certipy_file_modifications.yml b/detections/endpoint/detect_certipy_file_modifications.yml
index 75dc78a57f2..20a1ddcf19c 100644
--- a/detections/endpoint/detect_certipy_file_modifications.yml
+++ b/detections/endpoint/detect_certipy_file_modifications.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the use of the Certipy tool to enumerate Active Directory Certificate Services (AD CS) environments by identifying unique file modifications. It leverages endpoint process and filesystem data to spot the creation of files with specific names or extensions associated with Certipy's information gathering and exfiltration activities. This activity is significant as it indicates potential reconnaissance and data exfiltration efforts by an attacker. If confirmed malicious, this could lead to unauthorized access to sensitive AD CS information, enabling further attacks or privilege escalation within the network.
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.file_name IN ("*_certipy.zip","*_certipy.txt", "*_certipy.json", "*.ccache")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_certipy_file_modifications_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*_certipy.zip", "*_certipy.txt", "*_certipy.json", "*.ccache") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_certipy_file_modifications_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints as well as file creation or deletion events.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious files $file_name$ related to Certipy detected on $dest$
     entity:
diff --git a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml
index b8011244a23..5753393badb 100644
--- a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml
+++ b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml
@@ -6,29 +6,22 @@ modification_date: '2026-05-13'
 author: Rod Soto, Jose Hernandez, Splunk
 status: production
 type: Hunting
-description: |
-    The following analytic detects changes to computer accounts using an anonymous logon.
+description: 'The following analytic detects changes to computer accounts using an anonymous logon.
+
     It leverages Windows Security Event Codes 4742 (Computer Change) with a SubjectUserName of a value "ANONYMOUS LOGON".
+
     This activity can be significant because anonymous logons should not typically be modifying computer accounts, indicating potential unauthorized access or misconfiguration.
-    If confirmed malicious, this could allow an attacker to alter computer accounts, potentially leading to privilege escalation or persistent access within the network.
+
+    If confirmed malicious, this could allow an attacker to alter computer accounts, potentially leading to privilege escalation or persistent access within the network.'
 data_source:
     - Windows Event Log Security 4742
-search: |-
-    `wineventlog_security`
-    EventCode=4742
-    SubjectUserName="ANONYMOUS LOGON"
-    PasswordLastSet="*"
-    | stats count min(_time) as firstTime max(_time) as lastTime
-        BY action app dest ProcessID PasswordLastSet
-           signature signature_id src_user status
-           SubjectDomainName user user_group vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_computer_changed_with_anonymous_account_filter`
-how_to_implement: |
-    This search requires "Audit Computer Account Management" sub-category in the audit policy to be enabled on the system in order to generate Event ID 4742, as well as "Audit Logon" to generate Event ID 4624.
+search: |
+    `wineventlog_security` EventCode="4742" SubjectUserName="ANONYMOUS LOGON" PasswordLastSet="*" | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_computer_changed_with_anonymous_account_filter`
+how_to_implement: 'This search requires "Audit Computer Account Management" sub-category in the audit policy to be enabled on the system in order to generate Event ID 4742, as well as "Audit Logon" to generate Event ID 4624.
+
     We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Event Logs.
-    Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
+
+    Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.'
 known_false_positives: Some legitimate, legacy devices may utilize this functionality and generate false positives. Apply additional tuning as needed.
 references:
     - https://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/
diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
index 8b8cf46c805..24d20b84b27 100644
--- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the use of PowerShell commands to copy the SAM, SYSTEM, or SECURITY hives, which are critical for credential theft. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed. This activity is significant as it indicates an attempt to exfiltrate sensitive registry hives for offline password cracking. If confirmed malicious, this could lead to unauthorized access to credentials, enabling further compromise of the system and potential lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: '`powershell` EventCode=4104 ScriptBlockText IN ("*copy*","*[System.IO.File]::Copy*") AND ScriptBlockText IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_copy_of_shadowcopy_with_script_block_logging_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*copy*", "*[System.IO.File]::Copy*") Processes.process IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*", "*System32\\config\\SECURITY*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_copy_of_shadowcopy_with_script_block_logging_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_id$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: PowerShell was identified running a script to capture the SAM hive on endpoint $dest$ by user $user_id$.
     entity:
diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml
index a7052b3dca7..9261879b7e4 100644
--- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml
+++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml
@@ -6,12 +6,12 @@ modification_date: '2026-10-09'
 author: Patrick Bareiss, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects attempts to read LSASS memory, indicative of credential dumping.
-    It leverages Sysmon EventCode 10 and checks for "PROCESS_VM_READ" with query information access on lsass.exe.
+description: 'The following analytic detects attempts to read LSASS memory, indicative of credential dumping.
+
+    It leverages Sysmon EventCode 10 and checks for "PROCESS_VM_READ" with query information access on lsass.exe.'
 data_source:
     - Sysmon EventID 10
-search: |-
+search: |
     `sysmon`
     EventCode=10
     TargetImage="*\\lsass.exe"
@@ -58,7 +58,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$TargetImage$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$TargetImage$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The process [$SourceImage$] requested read access via the access mask [$granted_access$] to [$TargetImage$] on [$dest$], which may indicate credential dumping.
     entity:
diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
index 0fab75f09ce..9a225f37aae 100644
--- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
+++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects suspicious PowerShell execution indicative of PowerShell-Empire activity. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze commands sent to PowerShell, specifically looking for patterns involving `system.net.webclient` and base64 encoding. This behavior is significant as it often represents initial stagers used by PowerShell-Empire, a known post-exploitation framework. If confirmed malicious, this activity could allow attackers to download and execute additional payloads, leading to potential code execution, data exfiltration, or further compromise of the affected system.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104  (ScriptBlockText=*system.net.webclient* AND ScriptBlockText=*frombase64string*)
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `detect_empire_with_powershell_script_block_logging_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*system.net.webclient*" Processes.process="*frombase64string*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_empire_with_powershell_script_block_logging_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: False positives may only pertain to it not being related to Empire, but another framework. Filter as needed if any applications use the same pattern.
 references:
@@ -38,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The following behavior was identified and typically related to PowerShell-Empire on $dest$ by $user_id$.
     entity:
diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
index dff22bbc04c..da272680086 100644
--- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
+++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic detects endpoints causing a high number of account lockouts within a short period. It leverages the Windows security event logs ingested into the `Change` datamodel, specifically under the `Account_Management` node, to identify and count lockout events. This activity is significant as it may indicate a brute-force attack or misconfigured system causing repeated authentication failures. If confirmed malicious, this behavior could lead to account lockouts, disrupting user access and potentially indicating an ongoing attack attempting to compromise user credentials.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Changes.user) as user FROM datamodel=Change.All_Changes
       WHERE All_Changes.result="*lock*"
       BY All_Changes.dest All_Changes.result
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml
index c78c5143c48..4b0256ba554 100644
--- a/detections/endpoint/detect_excessive_user_account_lockouts.yml
+++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic identifies user accounts experiencing an excessive number of lockouts within a short timeframe. It leverages the 'Change' data model, specifically focusing on events where the result indicates a lockout. This activity is significant as it may indicate a brute-force attack or misconfiguration, both of which require immediate attention. If confirmed malicious, this behavior could lead to account compromise, unauthorized access, and potential lateral movement within the network.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes
       WHERE All_Changes.result="*lock*"
       BY All_Changes.user All_Changes.result
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml
index 7d30f9c224c..eee847e0741 100644
--- a/detections/endpoint/detect_exchange_web_shell.yml
+++ b/detections/endpoint/detect_exchange_web_shell.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies the creation of suspicious .aspx files in known drop locations for Exchange exploitation, specifically targeting paths associated with HAFNIUM group and vulnerabilities like ProxyShell and ProxyNotShell. It leverages data from the Endpoint datamodel, focusing on process and filesystem events. This activity is significant as it may indicate a web shell deployment, a common method for persistent access and remote code execution. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary commands, and potentially escalate privileges within the Exchange environment.
 data_source:
     - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name IN( "*.aspx", "*.ashx") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_exchange_web_shell_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name IN ("*.aspx", "*.ashx") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_exchange_web_shell_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.
 known_false_positives: The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml
index 5cd4424c36d..2b30d2d672e 100644
--- a/detections/endpoint/detect_html_help_url_in_command_line.yml
+++ b/detections/endpoint/detect_html_help_url_in_command_line.yml
@@ -12,20 +12,8 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
     - Cisco Network Visibility Module Flow Data
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_hh` Processes.process=*http*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_html_help_url_in_command_line_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*hh.exe" OR Processes.original_file_name="HH.EXE" Processes.process="*http*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_url_in_command_line_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may retrieve a CHM remotely, filter as needed.
 references:
@@ -44,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload.
     entity:
diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
index 874d1399a09..20b530a00bb 100644
--- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
+++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_hh` Processes.process IN ("*its:*", "*mk:@MSITStore:*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_html_help_using_infotech_storage_handlers_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*hh.exe" OR Processes.original_file_name="HH.EXE" Processes.process IN ("*its:*", "*mk:@MSITStore:*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_using_infotech_storage_handlers_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: It is rare to see instances of InfoTech Storage Handlers being used, but it does happen in some legitimate instances. Filter as needed.
 references:
@@ -43,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$.
     entity:
diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
index 2879cdee192..1c5d300451d 100644
--- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
+++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). This method captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities such as Pass the Ticket, Pass the Hash, and credential dumping. This activity is significant as Mimikatz is a well-known tool used for credential theft and lateral movement. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*, *kerberos::ptt*, *kerberos::golden*)
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `detect_mimikatz_with_powershell_script_block_logging_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*mimikatz*", "*-dumpcr*", "*sekurlsa::pth*", "*kerberos::ptt*", "*kerberos::golden*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mimikatz_with_powershell_script_block_logging_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: False positives should be limited as the commands being identifies are quite specific to EventCode 4104 and Mimikatz. Filter as needed.
 references:
@@ -37,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $dest$ by $user_id$.
     entity:
diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml
index bac8267504f..f7e0b0ce554 100644
--- a/detections/endpoint/detect_mshta_inline_hta_execution.yml
+++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml
@@ -12,24 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count values(Processes.process)
-    as process values(Processes.parent_process) as parent_process min(_time) as firstTime
-    max(_time) as lastTime from datamodel=Endpoint.Processes where
-
-    `process_mshta`
-    Processes.process IN ("*vbscript*", "*javascript*", "*about*")
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process
-       Processes.process_exec Processes.process_guid Processes.process_hash
-       Processes.process_id Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_mshta_inline_hta_execution_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*mshta.exe" OR Processes.original_file_name="MSHTA.EXE" Processes.process IN ("*vbscript*", "*javascript*", "*about*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mshta_inline_hta_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
 references:
@@ -47,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion.
     entity:
diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml
index e2e33938374..86919fac26c 100644
--- a/detections/endpoint/detect_mshta_url_in_command_line.yml
+++ b/detections/endpoint/detect_mshta_url_in_command_line.yml
@@ -12,22 +12,8 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
     - Cisco Network Visibility Module Flow Data
-search: |-
-    | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_mshta` (Processes.process="*http://*"
-        OR
-        Processes.process="*https://*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_mshta_url_in_command_line_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*mshta.exe" OR Processes.original_file_name="MSHTA.EXE" Processes.process IN ("*http://*", "*https://*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mshta_url_in_command_line_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: It is possible legitimate applications may perform this behavior and will need to be filtered.
 references:
@@ -45,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to access a remote destination to download an additional payload.
     entity:
diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml
index f3230cf3a92..9c90f96844f 100644
--- a/detections/endpoint/detect_new_local_admin_account.yml
+++ b/detections/endpoint/detect_new_local_admin_account.yml
@@ -46,7 +46,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not.
     entity:
diff --git a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml
index d599865fd09..34df064a81f 100644
--- a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml
+++ b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml
@@ -6,11 +6,13 @@ modification_date: '2026-05-13'
 author: Bhavin Patel, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic identifies the execution of `outlook.exe` writing a `.zip` file to the disk.
+description: 'The following analytic identifies the execution of `outlook.exe` writing a `.zip` file to the disk.
+
     It leverages data from the Endpoint data model, specifically monitoring process and filesystem activities.
+
     This behavior can be significant as it may indicate the use of Outlook to deliver malicious payloads or exfiltrate data via compressed files.
-    If confirmed malicious, this activity could lead to unauthorized data access, data exfiltration, or the delivery of malware, potentially compromising the security of the affected system and network.
+
+    If confirmed malicious, this activity could lead to unauthorized data access, data exfiltration, or the delivery of malware, potentially compromising the security of the affected system and network.'
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 11
 search: |
@@ -75,11 +77,13 @@ search: |
 
     | where file_name != ""
     | `detect_outlook_exe_writing_a_zip_file_filter`
-how_to_implement: |
-    You must be ingesting data that records filesystem and process activity
+how_to_implement: 'You must be ingesting data that records filesystem and process activity
+
     from your hosts to populate the Endpoint data model. This is typically populated
+
     via endpoint detection-and-response product, such as Carbon Black, or endpoint data
-    sources, such as Sysmon.
+
+    sources, such as Sysmon.'
 known_false_positives: It is not uncommon for outlook to write legitimate zip files to the disk.
 references:
     - https://www.paubox.com/news/hackers-exploit-corrupted-zip-and-office-files-to-bypass-email-security
@@ -93,7 +97,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml b/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml
index bfd75ec221a..240ba52a291 100644
--- a/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml
+++ b/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml
@@ -10,7 +10,7 @@ description: The following analytic identifies one source failing to authenticat
 data_source:
     - Windows Event Log Security 4624
     - Windows Event Log Security 4625
-search: |-
+search: |
     | tstats `security_content_summariesonly` max(_time) as lastTime, min(_time) as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) as src_category values(Authentication.app) as app count FROM datamodel=Authentication.Authentication
       BY Authentication.action Authentication.app Authentication.authentication_method
          Authentication.dest Authentication.signature Authentication.signature_id
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The source [$src$] attempted to access $user_dc$ distinct users a total of $count$ times between [$firstTime$] and [$lastTime$]. $success$ successful logins detected.
     entity:
diff --git a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml
index f826b7bce61..25b69d0b4fe 100644
--- a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml
+++ b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml
@@ -10,7 +10,7 @@ description: The following analytic identifies any user failing to authenticate
 data_source:
     - Windows Event Log Security 4624
     - Windows Event Log Security 4625
-search: |-
+search: |
     | tstats `security_content_summariesonly` max(_time) as lastTime, min(_time) as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) as src_category values(Authentication.app) as app count FROM datamodel=Authentication.Authentication
       BY Authentication.action Authentication.app Authentication.authentication_method
          Authentication.dest Authentication.signature Authentication.signature_id
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A total of $src_dc$ distinct sources attempted to access the account [$user$], $count$ times between [$firstTime$] and [$lastTime$]. $success$ successful logins detected.
     entity:
diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
index 0e9292cc278..df8df7f65c6 100644
--- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
+++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | rex field=process "^.*?\\\\(?<service_process>[^\\\\]*\.(?:exe|bat|com|ps1))" | eval process_name = lower(process_name) | eval service_process = lower(service_process) | where process_name != service_process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | rex field=process "^.*?\\\\(?<service_process>[^\\\\]*\.(?:exe|bat|com|ps1))" | eval process_name = lower(process_name) | eval service_process = lower(service_process) | where process_name != service_process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths.
     entity:
diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
index 847e1b446b6..617e6993a53 100644
--- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml
+++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name IN ("psexec.exe", "psexec64.exe")
-            OR
-            Processes.original_file_name="psexec.c"
-        )
-        Processes.process=*accepteula*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_psexec_with_accepteula_flag_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*psexec.exe", "*psexec64.exe") OR Processes.original_file_name="psexec.c" Processes.process="*accepteula*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators can leverage PsExec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. However, it is not likely that you'd see multiple occurrences of this event on a machine
 references:
@@ -43,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time.
     entity:
diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml
index ea148c5495c..a6c427e5f94 100644
--- a/detections/endpoint/detect_rare_executables.yml
+++ b/detections/endpoint/detect_rare_executables.yml
@@ -6,52 +6,27 @@ modification_date: '2026-05-13'
 author: Bhavin Patel, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the execution of rare processes that appear only once across the network within a specified timeframe.
+description: 'The following analytic detects the execution of rare processes that appear only once across the network within a specified timeframe.
+
     It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs.
+
     This activity is significant for a SOC as it helps identify potentially malicious activities or unauthorized software, which could indicate a security breach or ongoing attack.
+
     If confirmed malicious, such rare processes could lead to data theft, privilege escalation, or complete system compromise, making early detection crucial for minimizing impact.
-    The search currently identifies processes executed on fewer than 10 hosts, but this threshold can be adjusted based on the organization's environment and risk tolerance.
-    The search groups results by process name which can lead to blind spots if a malicious process uses a common name. To mitigate this, consider enhancing the detection logic to group by additional attributes such as process hash.
+
+    The search currently identifies processes executed on fewer than 10 hosts, but this threshold can be adjusted based on the organization''s environment and risk tolerance.
+
+    The search groups results by process name which can lead to blind spots if a malicious process uses a common name. To mitigate this, consider enhancing the detection logic to group by additional attributes such as process hash.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      dc(Processes.dest) as dc_dest
-      values(Processes.dest) as dest
-      values(Processes.user) as user
-      min(_time) as firstTime
-      max(_time) as lastTime
-      latest(Processes.action) as action
-      values(Processes.original_file_name) as original_file_name
-      values(Processes.parent_process) as parent_process
-      values(Processes.parent_process_exec) as parent_process_exec
-      latest(Processes.parent_process_guid) as parent_process_guid
-      latest(Processes.parent_process_id) as parent_process_id
-      values(Processes.parent_process_name) as parent_process_name
-      values(Processes.parent_process_path) as parent_process_path
-      values(Processes.process) as process
-      values(Processes.process_exec) as process_exec
-      latest(Processes.process_guid) as process_guid
-      values(Processes.process_hash) as process_hash
-      values(Processes.process_path) as process_path
-      latest(Processes.process_id) as process_id
-      latest(Processes.process_integrity_level) as process_integrity_level
-      latest(Processes.user_id) as user_id
-      latest(Processes.vendor_product) as vendor_product
-    from datamodel=Endpoint.Processes
-    by Processes.process_name
-    | `drop_dm_object_name(Processes)`
-    | search dc_dest < 10
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_rare_executables_filter`
+    `sysmon` EventCode=1 dc_dest<10 | eval src_user=src_user | stats count min(_time) as firstTime max(_time) as lastTime by action dest original_file_name parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process process_exec process_guid process_hash process_id process_integrity_level process_name process_path user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rare_executables_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    Some legitimate processes may be only rarely executed in your environment.
-    Apply additional filters as needed.
+known_false_positives: 'Some legitimate processes may be only rarely executed in your environment.
+
+    Apply additional filters as needed.'
 references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
@@ -61,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml
index 70273452aef..3ba3615ed46 100644
--- a/detections/endpoint/detect_rclone_command_line_usage.yml
+++ b/detections/endpoint/detect_rclone_command_line_usage.yml
@@ -13,36 +13,25 @@ data_source:
     - CrowdStrike ProcessRollup2
     - Cisco Network Visibility Module Flow Data
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    (Processes.original_file_name="rclone.exe" OR Processes.process_name="rclone.exe")
-    Processes.process IN (
-            "*copy*", "*mega*", "*pcloud*", "*ftp*",
-            "*--config*", "*--progress*", "*--no-check-certificate*",
-            "*--ignore-existing*", "*--auto-confirm*", "*--transfers*",
-            "*--multi-thread-streams*"
-            )
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    |  `security_content_ctime(lastTime)`
-    | `detect_rclone_command_line_usage_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.original_file_name="rclone.exe" OR Processes.process_name="*rclone.exe" Processes.process IN ("*copy*", "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*", "*--ignore-existing*", "*--auto-confirm*", "*--transfers*", "*--multi-thread-streams*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    False positives should be limited as this is restricted to the Rclone process name. Filter or tune the analytic as needed.
+
+    names and speed up the data modeling process.'
+known_false_positives: False positives should be limited as this is restricted to the Rclone process name. Filter or tune the analytic as needed.
 references:
     - https://redcanary.com/blog/rclone-mega-extortion/
     - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
@@ -56,7 +45,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders.
     entity:
diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml
index a110bc90f61..391d83aeedd 100644
--- a/detections/endpoint/detect_regasm_spawning_a_process.yml
+++ b/detections/endpoint/detect_regasm_spawning_a_process.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=regasm.exe NOT (Processes.process_name IN ("conhost.exe"))
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_regasm_spawning_a_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*regasm.exe" NOT Processes.process_name="*conhost.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_spawning_a_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
 references:
@@ -40,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$.
     entity:
diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml
index b44536f0b80..e2c3cbb26a3 100644
--- a/detections/endpoint/detect_regasm_with_network_connection.yml
+++ b/detections/endpoint/detect_regasm_with_network_connection.yml
@@ -10,23 +10,7 @@ description: The following analytic detects the execution of regasm.exe establis
 data_source:
     - Sysmon EventID 3
 search: |
-    `sysmon`
-    EventID=3
-    process_name=regasm.exe
-    NOT dest_ip IN (
-      "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
-      "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
-      "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
-      "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
-      "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4"
-    )
-    | stats count min(_time) as firstTime max(_time) as lastTime
-      by action app dest dest_ip dest_port direction dvc protocol protocol_version src
-         src_ip src_port transport user vendor_product process_name process_exec process_guid
-         process_id
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_regasm_with_network_connection_filter`
+    `sysmon` EventCode=3 process_name="regasm.exe" NOT (dest_ip IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4")) | eval process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by action app dest dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port transport user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_with_network_connection_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: Although unlikely, limited instances of regasm.exe with a network connection may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
 references:
@@ -41,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $process_name$ contacting a remote destination was identified on endpoint $dest$ by user $user$. This behavior is not normal for $process_name$.
     entity:
diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
index 31cd8f81e5b..9e1ec01d7cb 100644
--- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
+++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
@@ -12,19 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where
-    (Processes.process_name=regasm.exe OR Processes.original_file_name=RegAsm.exe)
-    Processes.process IN ("*regasm","*regasm.exe", "*regasm.exe\"")
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
-       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
-       Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_regasm_with_no_command_line_arguments_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*regasm.exe" OR Processes.original_file_name="RegAsm.exe" Processes.process IN ("*regasm", "*regasm.exe", "*regasm.exe\"") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_with_no_command_line_arguments_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, limited instances of regasm.exe or may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml
index ea9f6e870e9..ed1b69366c6 100644
--- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml
+++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=regsvcs.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_regsvcs_spawning_a_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*regsvcs.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_spawning_a_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$  was identified on endpoint $dest$ by user $user$ typically not normal for this process.
     entity:
diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml
index 452f04e9cb8..b710dba2cb9 100644
--- a/detections/endpoint/detect_regsvcs_with_network_connection.yml
+++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml
@@ -10,23 +10,7 @@ description: The following analytic identifies instances of Regsvcs.exe establis
 data_source:
     - Sysmon EventID 3
 search: |
-    `sysmon`
-    EventID=3
-    NOT dest_ip IN (
-      "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
-      "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
-      "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
-      "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
-      "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4"
-    )
-    process_name=regsvcs.exe
-    | stats count min(_time) as firstTime max(_time) as lastTime
-      by action app dest dest_ip dest_port direction dvc protocol protocol_version src
-         src_ip src_port transport user vendor_product process_name process_exec process_guid
-         process_id
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_regsvcs_with_network_connection_filter`
+    `sysmon` EventCode=3 NOT (dest_ip IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4")) process_name="regsvcs.exe" | eval process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by action app dest dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port transport user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_with_network_connection_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
 references:
@@ -41,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $process_name$ contacting a remote destination was identified on endpoint $dest$ by user $user$. This behavior is not normal for $process_name$.
     entity:
diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
index 6fcaa7e36f2..76c40090814 100644
--- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
+++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
@@ -12,19 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime FROM datamodel=Endpoint.Processes where
-    (Processes.process_name=regsvcs.exe OR Processes.original_file_name=RegSvcs.exe)
-    Processes.process IN ("*regsvcs","*regsvcs.exe", "*regsvcs.exe\"")
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
-       Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_regsvcs_with_no_command_line_arguments_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*regsvcs.exe" OR Processes.original_file_name="RegSvcs.exe" Processes.process IN ("*regsvcs", "*regsvcs.exe", "*regsvcs.exe\"") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_with_no_command_line_arguments_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
index 6c4e565d054..7e65ec5ed47 100644
--- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml
+++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_regsvr32` Processes.process=*scrobj*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_regsvr32_application_control_bypass_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*regsvr32.exe" OR Processes.original_file_name="REGSVR32.EXE" Processes.process="*scrobj*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvr32_application_control_bypass_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives related to third party software registering .DLL's.
 references:
@@ -41,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml
index 0746d33835a..60d716152d0 100644
--- a/detections/endpoint/detect_remote_access_software_usage_file.yml
+++ b/detections/endpoint/detect_remote_access_software_usage_file.yml
@@ -6,14 +6,19 @@ modification_date: '2026-09-22'
 author: Steven Dick
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the writing of files from known remote access software to disk within the environment.
+description: 'The following analytic detects the writing of files from known remote access software to disk within the environment.
+
     It leverages data from Endpoint Detection and Response (EDR) agents, focusing on file path, file name, and user information.
+
     This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access.
+
     If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration, further compromise, or complete control over affected systems.
+
     It is best to update both the remote_access_software_usage_exception.csv lookup and the remote_access_software lookup with any known or approved remote access software to reduce false positives and increase coverage.
+
     In order to enhance performance, the detection filters for specific file names extensions / names that are used in the remote_access_software lookup.
-    If add additional entries, consider updating the search filters to include those file names / extensions as well, if not alread covered.
+
+    If add additional entries, consider updating the search filters to include those file names / extensions as well, if not alread covered.'
 data_source:
     - Sysmon EventID 11
 search: |
@@ -58,7 +63,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate files on $dest$
       search: '| from datamodel:Endpoint.Filesystem | search dest=$dest$ file_name=$file_name$'
       earliest_offset: $info_min_time$
diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
index b7e8eb806bb..62e45a8882d 100644
--- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
+++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the execution of processes with file or code signing attributes from known remote access software within the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration or further compromise of the network.
 data_source:
     - Sysmon EventID 1
-search: |-
+search: |
     `sysmon` EventCode=1
       | stats count min(_time) as firstTime max(_time) as lastTime, values(Company) as Company values(Product) as Product
         BY action dest original_file_name
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate processes on $dest$
       search: '| from datamodel:Endpoint.Processes| search dest=$dest$ process_name=$process_name$'
       earliest_offset: $info_min_time$
diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml
index b579e35a226..1666e1be01c 100644
--- a/detections/endpoint/detect_remote_access_software_usage_process.yml
+++ b/detections/endpoint/detect_remote_access_software_usage_process.yml
@@ -53,7 +53,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate processes on $dest$
       search: '| from datamodel:Endpoint.Processes| search dest=$dest$ process_name=$process_name$'
       earliest_offset: $info_min_time$
diff --git a/detections/endpoint/detect_remote_access_software_usage_registry.yml b/detections/endpoint/detect_remote_access_software_usage_registry.yml
index f000f5d3d43..e1dcb9c40d0 100644
--- a/detections/endpoint/detect_remote_access_software_usage_registry.yml
+++ b/detections/endpoint/detect_remote_access_software_usage_registry.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid  count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=registry_value_data "(\")?.+\\\(?<file_name_1>[^\"=]+\.[^\" ]{1,5})(\")?" | rex field=registry_value_data "(?<file_name_2>[^\.]+\.[^\" ]{1,5}$)" | eval file_name = coalesce(file_name_1,file_name_2) | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid  count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=registry_value_data "(\")?.+\\\(?<file_name_1>[^\"=]+\.[^\" ]{1,5})(\")?" | rex field=registry_value_data "(?<file_name_2>[^\.]+\.[^\" ]{1,5}$)" | eval file_name = coalesce(file_name_1,file_name_2) | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_registry_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Registry` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
 known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate registry changes on $dest$
       search: '| from datamodel:Endpoint.Registry| search dest=$dest$ registry_path=$registry_path$'
       earliest_offset: $info_min_time$
diff --git a/detections/endpoint/detect_rtlo_in_file_name.yml b/detections/endpoint/detect_rtlo_in_file_name.yml
index cbd40128984..b1dce1232e6 100644
--- a/detections/endpoint/detect_rtlo_in_file_name.yml
+++ b/detections/endpoint/detect_rtlo_in_file_name.yml
@@ -6,14 +6,19 @@ modification_date: '2026-05-13'
 author: Steven Dick
 status: production
 type: TTP
-description: |
-    The following analytic identifies the use of the right-to-left override
+description: 'The following analytic identifies the use of the right-to-left override
+
     (RTLO) character in file names. It leverages data from the Endpoint.Filesystem datamodel,
+
     specifically focusing on file creation events and file names containing the RTLO
+
     character (U+202E). This activity is significant because adversaries use RTLO to
+
     disguise malicious files as benign by reversing the text that follows the character.
+
     If confirmed malicious, this technique can deceive users and security tools, leading
-    to the execution of harmful files and potential system compromise.
+
+    to the execution of harmful files and potential system compromise.'
 data_source:
     - Sysmon EventID 11
 search: |
@@ -39,14 +44,16 @@ search: |
     | eval file_name=RTLO_file_1.RTLO_file_2
     | fields - RTLO*
     | `detect_rtlo_in_file_name_filter`
-how_to_implement: |
-    To successfully implement this search you need to be ingesting information
+how_to_implement: 'To successfully implement this search you need to be ingesting information
+
     on process that includes the full command line of the process being launched on
+
     your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+
     confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-    endpoint product.
-known_false_positives: |
-    Implementation in regions that use right to left in native language.
+
+    endpoint product.'
+known_false_positives: Implementation in regions that use right to left in native language.
 references:
     - https://attack.mitre.org/techniques/T1036/002/
     - https://resources.infosecinstitute.com/topic/spoof-using-right-to-left-override-rtlo-technique-2/
@@ -59,7 +66,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious RTLO detected in $file_name$ on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/detect_rtlo_in_process.yml b/detections/endpoint/detect_rtlo_in_process.yml
index 7ad26a772f3..90dc3970f3d 100644
--- a/detections/endpoint/detect_rtlo_in_process.yml
+++ b/detections/endpoint/detect_rtlo_in_process.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process!=unknown AND Processes.action=allowed by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | regex process="\\x{202E}" | rex field=process "(?<RTLO_command_1>.+)(?<RTLO_exist_process>\\x{202E})(?<RTLO_command_2>.+)" | eval process_with_RTLO=process | eval process=RTLO_command_1.RTLO_command_2 | fields - RTLO* | `detect_rtlo_in_process_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process!=unknown AND Processes.action=allowed by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | regex process="\\x{202E}" | rex field=process "(?<RTLO_command_1>.+)(?<RTLO_exist_process>\\x{202E})(?<RTLO_command_2>.+)" | eval process_with_RTLO=process | eval process=RTLO_command_1.RTLO_command_2 | fields - RTLO* | `detect_rtlo_in_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Implementation in regions that use right to left in native language.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious RTLO detected in $process_name$ on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
index 84014e941a4..d8ab78f58b0 100644
--- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml
+++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_rundll32` (Processes.process=*vbscript*
-        OR
-        Processes.process=*javascript*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_rundll32_inline_hta_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" Processes.process IN ("*vbscript*", "*javascript*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_inline_hta_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
 references:
@@ -43,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious rundll32.exe inline HTA execution on $dest$
     entity:
diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml
index 29bf8194068..7653b55999f 100644
--- a/detections/endpoint/detect_sharphound_command_line_arguments.yml
+++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_sharphound_command_line_arguments_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*", "*invoke-bloodhound*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_command_line_arguments_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed.
 references:
@@ -42,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible SharpHound command-Line arguments identified on $dest$
     entity:
diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml
index 30c27dcd9d3..9f1f3d9c50e 100644
--- a/detections/endpoint/detect_sharphound_file_modifications.yml
+++ b/detections/endpoint/detect_sharphound_file_modifications.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the creation of files typically associated with SharpHound, a reconnaissance tool used for gathering domain and trust data. It leverages file modification events from the Endpoint.Filesystem data model, focusing on default file naming patterns like `*_BloodHound.zip` and various JSON files. This activity is significant as it indicates potential domain enumeration, which is a precursor to more targeted attacks. If confirmed malicious, an attacker could gain detailed insights into the domain structure, facilitating lateral movement and privilege escalation.
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.file_name IN ("*bloodhound.zip", "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json", "*_ous.json", "*_containers.json")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_sharphound_file_modifications_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip", "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json", "*_ous.json", "*_containers.json") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_file_modifications_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 known_false_positives: False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed.
 references:
@@ -38,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential SharpHound file modifications identified on $dest$
     entity:
diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml
index db38a68f5dd..aa6486a3de0 100644
--- a/detections/endpoint/detect_sharphound_usage.yml
+++ b/detections/endpoint/detect_sharphound_usage.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=sharphound.exe
-            OR
-            Processes.original_file_name=SharpHound.exe
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_sharphound_usage_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sharphound.exe" OR Processes.original_file_name="SharpHound.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_usage_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited as this is specific to a file attribute not used by anything else. Filter as needed.
 references:
@@ -46,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential SharpHound binary identified on $dest$
     entity:
diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
index 281e1c13ba0..33e71ad791b 100644
--- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
+++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
@@ -6,53 +6,19 @@ modification_date: '2026-05-13'
 author: Bhavin Patel, Mauricio Velazco, Splunk
 status: production
 type: Anomaly
-description: |
-    The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives.
+description: 'The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives.
+
     It focuses on executions originating from user-writable directories such as Users, AppData, Temp, and Downloads, which are commonly abused by attackers to stage and execute malicious scripts, while excluding trusted system paths like C:\Windows\System32\ and C:\Program Files\ that are typically associated with legitimate activity.
-    The detection also filters out service accounts (e.g., accounts ending with $ or known naming conventions) to minimize noise from automated processes and incorporates command-line context to better assess script execution patterns and identify potentially suspicious behavior.
+
+    The detection also filters out service accounts (e.g., accounts ending with $ or known naming conventions) to minimize noise from automated processes and incorporates command-line context to better assess script execution patterns and identify potentially suspicious behavior.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    Processes.parent_process_name="cmd.exe"
-    (
-        Processes.process_name IN ("cscript.exe", "wscript.exe")
-        OR
-        Processes.original_file_name IN ("cscript.exe", "wscript.exe")
-    )
-    NOT Processes.process IN (
-        "* \"C:\\Program Files (x86)\\*",
-        "* \"C:\\Program Files\\*",
-        "* \"C:\\Windows\\System32\\*",
-        "* \"C:\\Windows\\SysWOW64\\*",
-        "* C:\\Program Files (x86)\\*",
-        "* C:\\Program Files\\*",
-        "* C:\\Windows\\System32\\*",
-        "* C:\\Windows\\SysWOW64\\*"
-    )
-    NOT Processes.user="*$"
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_use_of_cmd_exe_to_launch_script_interpreters_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*cmd.exe" Processes.process_name IN ("*cscript.exe", "*wscript.exe") OR Processes.original_file_name IN ("cscript.exe", "wscript.exe") NOT (Processes.process IN ("* \"C:\\Program Files (x86)\\*", "* \"C:\\Program Files\\*", "*\\system32\\*", "*\\syswow64\\*", "* C:\\Program Files (x86)\\*", "* C:\\Program Files\\*")) NOT Processes.user="*$" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_use_of_cmd_exe_to_launch_script_interpreters_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    This detection may still generate alerts from legitimate administrative or enterprise activity, particularly in environments that rely on logon scripts, software deployment tools (e.g., SCCM, Intune), legacy applications, or IT automation frameworks that execute scripts via cmd.exe. Some organizations may also have internally developed scripts that run from user-writable directories, which can appear suspicious but are benign. Additionally, environments with non-standard application installations or portable tools may trigger this detection.
+known_false_positives: This detection may still generate alerts from legitimate administrative or enterprise activity, particularly in environments that rely on logon scripts, software deployment tools (e.g., SCCM, Intune), legacy applications, or IT automation frameworks that execute scripts via cmd.exe. Some organizations may also have internally developed scripts that run from user-writable directories, which can appear suspicious but are benign. Additionally, environments with non-standard application installations or portable tools may trigger this detection.
 references:
     - https://attack.mitre.org/techniques/T1059/
     - https://redcanary.com/threat-detection-report/techniques/windows-command-shell/
@@ -64,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml
index cd6cae4a21f..597d3ff7490 100644
--- a/detections/endpoint/disable_amsi_through_registry.yml
+++ b/detections/endpoint/disable_amsi_through_registry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that disable the Antimalware Scan Interface (AMSI) by setting the "AmsiEnable" value to "0x00000000". This detection leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable". Disabling AMSI is significant as it is a common technique used by ransomware, Remote Access Trojans (RATs), and Advanced Persistent Threats (APTs) to evade detection and impair defenses. If confirmed malicious, this activity could allow attackers to execute payloads with minimal alerts, leading to potential system compromise and data exfiltration.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: network operator may disable this feature of windows but not so common.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Disable AMSI Through Registry on $dest$
     entity:
diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml
index 45b27e2aa92..6b999e986ec 100644
--- a/detections/endpoint/disable_defender_antivirus_registry.yml
+++ b/detections/endpoint/disable_defender_antivirus_registry.yml
@@ -10,18 +10,7 @@ description: The following analytic detects the modification of Windows Defender
 data_source:
     - Sysmon EventID 13
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
-    WHERE (
-            Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" AND
-            Registry.registry_value_name IN ("DisableAntiSpyware","DisableAntiVirus") AND
-            Registry.registry_value_data IN (1, 0x00000001)
-          )
-            by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
-            | `drop_dm_object_name(Registry)`
-            | where isnotnull(registry_value_data)
-            | `security_content_ctime(firstTime)`
-            | `security_content_ctime(lastTime)`
-            | `disable_defender_antivirus_registry_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name IN ("*DisableAntiSpyware", "*DisableAntiVirus") Registry.registry_value_data IN ("1", "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_antivirus_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin or user may choose to disable windows defender product
 references:
@@ -34,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Modified/added/deleted registry entry $registry_path$ on $dest$
     entity:
diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
index 5aa04f100a5..dc7d79c7765 100644
--- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
+++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the modification of the Windows registry to disable the Windows Defender BlockAtFirstSeen feature. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path associated with Windows Defender SpyNet and the DisableBlockAtFirstSeen value. This activity is significant because disabling this feature can allow malicious files to bypass initial detection by Windows Defender, increasing the risk of malware infection. If confirmed malicious, this action could enable attackers to execute malicious code undetected, leading to potential system compromise and data breaches.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_blockatfirstseen_feature_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name="*DisableBlockAtFirstSeen" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_blockatfirstseen_feature_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin or user may choose to disable windows defender product
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: modified/added/deleted registry entry $registry_path$ on $dest$
     entity:
diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml
index e23feef4a8a..94607f94c23 100644
--- a/detections/endpoint/disable_defender_enhanced_notification.yml
+++ b/detections/endpoint/disable_defender_enhanced_notification.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the modification of the registry to disable Windows Defender's Enhanced Notification feature. It leverages data from Endpoint Detection and Response (EDR) agents, specifically monitoring changes to the registry path associated with Windows Defender reporting. This activity is significant because disabling Enhanced Notifications can prevent users and administrators from receiving critical security alerts, potentially allowing malicious activities to go unnoticed. If confirmed malicious, this action could enable an attacker to bypass detection mechanisms, maintain persistence, and escalate their activities without triggering alerts.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_enhanced_notification_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name="*DisableEnhancedNotifications" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_enhanced_notification_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: user may choose to disable windows defender AV
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: modified/added/deleted registry entry $registry_path$ on $dest$
     entity:
diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml
index 23507d48359..916d00b08d2 100644
--- a/detections/endpoint/disable_defender_mpengine_registry.yml
+++ b/detections/endpoint/disable_defender_mpengine_registry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the modification of the Windows Defender MpEngine registry value, specifically setting MpEnablePus to 0x00000000. This detection leverages endpoint registry logs, focusing on changes within the path "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*". This activity is significant as it indicates an attempt to disable key Windows Defender features, potentially allowing malware to evade detection. If confirmed malicious, this could lead to undetected malware execution, persistence, and further system compromise. Immediate investigation and endpoint isolation are recommended.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_mpengine_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name="*MpEnablePus" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_mpengine_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin or user may choose to disable windows defender product
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Modified/added/deleted registry entry $registry_path$ on $dest$
     entity:
diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml
index 3e0ddd7b036..e62676f431b 100644
--- a/detections/endpoint/disable_defender_spynet_reporting.yml
+++ b/detections/endpoint/disable_defender_spynet_reporting.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the modification of the registry to disable Windows Defender SpyNet reporting. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path associated with Windows Defender SpyNet settings. This activity is significant because disabling SpyNet reporting can prevent Windows Defender from sending telemetry data, potentially allowing malicious activities to go undetected. If confirmed malicious, this action could enable an attacker to evade detection, maintain persistence, and carry out further attacks without being flagged by Windows Defender.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_spynet_reporting_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name="*SpynetReporting" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_spynet_reporting_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin or user may choose to disable windows defender product
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: modified/added/deleted registry entry $registry_path$ on $dest$
     entity:
diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
index e3af8d415c6..89528918326 100644
--- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
+++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
@@ -10,18 +10,7 @@ description: The following analytic detects the modification of the Windows regi
 data_source:
     - Sysmon EventID 13
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
-      WHERE (
-              Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" AND
-              Registry.registry_value_name = SubmitSamplesConsent AND
-              Registry.registry_value_data IN (0, 0x00000000)
-             )
-              by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
-         | `drop_dm_object_name(Registry)`
-         | where isnotnull(registry_value_data)
-         | `security_content_ctime(firstTime)`
-         | `security_content_ctime(lastTime)`
-         | `disable_defender_submit_samples_consent_feature_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name="*SubmitSamplesConsent" Registry.registry_value_data IN ("0", "0x00000000") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_submit_samples_consent_feature_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin or user may choose to disable windows defender product
 references:
@@ -34,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: modified/added/deleted registry entry $registry_path$ on $dest$
     entity:
diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml
index 0f2a1fc0a0a..22ee61f43de 100644
--- a/detections/endpoint/disable_etw_through_registry.yml
+++ b/detections/endpoint/disable_etw_through_registry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the registry that disable the Event Tracing for Windows (ETW) feature. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" with a value set to "0x00000000". This activity is significant because disabling ETW can allow attackers to evade detection mechanisms, making it harder for security tools to monitor malicious activities. If confirmed malicious, this could enable attackers to execute payloads with minimal alerts, impairing defenses and potentially leading to further compromise of the system.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_data = "0x00000000") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: network operator may disable this feature of windows but not so common.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Disable ETW Through Registry on $dest$
     entity:
diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml
index 88c0511f904..806af3f7d46 100644
--- a/detections/endpoint/disable_logs_using_wevtutil.yml
+++ b/detections/endpoint/disable_logs_using_wevtutil.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "wevtutil.exe"
-        AND
-        (Processes.process = "*sl*"
-        OR
-        Processes.process = "*set-log*" ) Processes.process IN ("*/e:false*", "*/enabled:false*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `disable_logs_using_wevtutil_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wevtutil.exe" Processes.process IN ("*sl*", "*set-log*") Processes.process IN ("*/e:false*", "*/enabled:false*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_logs_using_wevtutil_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network operator may disable audit event logs for debugging purposes.
 references:
@@ -42,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: WevtUtil.exe used to disable Event Logging on $dest$
     entity:
diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml
index 29007d8b5cd..13b4fdf04ca 100644
--- a/detections/endpoint/disable_registry_tool.yml
+++ b/detections/endpoint/disable_registry_tool.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry aimed at disabling the Registry Editor (regedit). It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" with a value of "0x00000001". This activity is significant because malware, such as RATs or trojans, often disable registry tools to prevent the removal of their entries, aiding in persistence and defense evasion. If confirmed malicious, this could hinder incident response efforts and allow the attacker to maintain control over the compromised system.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_registry_tool_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_registry_tool_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin may disable this application for non technical user.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Disabled Registry Tools on $dest$
     entity:
diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml
index 61df26ce505..2a3f1058ade 100644
--- a/detections/endpoint/disable_schedule_task.yml
+++ b/detections/endpoint/disable_schedule_task.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=schtasks.exe Processes.process=*/change*  Processes.process=*/disable*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `disable_schedule_task_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*schtasks.exe" Processes.process="*/change*" Processes.process="*/disable*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_schedule_task_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: admin may disable problematic schedule task
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml
index 6f4f4c8111f..618e9a13fed 100644
--- a/detections/endpoint/disable_security_logs_using_minint_registry.yml
+++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a suspicious registry modification aimed at disabling security audit logs by adding a specific registry entry. It leverages data from the Endpoint.Registry data model, focusing on changes to the "Control\\MiniNt" registry path. This activity is significant because it can prevent Windows from logging any events to the Security Log, effectively blinding security monitoring efforts. If confirmed malicious, this technique could allow an attacker to operate undetected, making it difficult to trace their actions and compromising the integrity of security audits.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Control\\MiniNt\\*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_security_logs_using_minint_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\MiniNt\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_security_logs_using_minint_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Modified/added/deleted registry entry $registry_path$ on $dest$
     entity:
diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml
index 5f38c7cbd08..8882e2a337b 100644
--- a/detections/endpoint/disable_show_hidden_files.yml
+++ b/detections/endpoint/disable_show_hidden_files.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects modifications to the Windows registry that disable the display of hidden files. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with hidden file settings. This activity is significant because malware, such as worms and trojan spyware, often use hidden files to evade detection. If confirmed malicious, this behavior could allow an attacker to conceal malicious files on the system, making it harder for security tools and analysts to identify and remove the threat.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_data = "0x00000000" )) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data="0x00000001") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_data="0x00000000") OR Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml
index 5e3a1438dfb..ceed76fe192 100644
--- a/detections/endpoint/disable_uac_remote_restriction.yml
+++ b/detections/endpoint/disable_uac_remote_restriction.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the modification of the registry to disable UAC remote restriction by setting the "LocalAccountTokenFilterPolicy" value to "0x00000001". It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\CurrentVersion\\Policies\\System*". This activity is significant because disabling UAC remote restriction can allow an attacker to bypass User Account Control (UAC) protections, potentially leading to privilege escalation. If confirmed malicious, this could enable an attacker to execute unauthorized actions with elevated privileges, compromising the security of the affected system.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001"  ) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_uac_remote_restriction_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="*LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_uac_remote_restriction_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin may set this policy for non-critical machine.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Modified/added/deleted registry entry $registry_path$ on $dest$
     entity:
diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml
index da949b8b336..c7dd3e15087 100644
--- a/detections/endpoint/disable_windows_app_hotkeys.yml
+++ b/detections/endpoint/disable_windows_app_hotkeys.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a suspicious registry modification aimed at disabling Windows hotkeys for native applications. It leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values indicative of this behavior. This activity is significant as it can impair an analyst's ability to use essential tools like Task Manager and Command Prompt, hindering incident response efforts. If confirmed malicious, this technique can allow an attacker to maintain persistence and evade detection, complicating the remediation process.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name = "Debugger") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_app_hotkeys_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" Registry.registry_value_data="HotKey Disabled" Registry.registry_value_name="*Debugger" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_app_hotkeys_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Disabled 'Windows App Hotkeys' on $dest$
     entity:
diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml
index d08ed0971c1..3ab8d62f7c5 100644
--- a/detections/endpoint/disable_windows_behavior_monitoring.yml
+++ b/detections/endpoint/disable_windows_behavior_monitoring.yml
@@ -10,23 +10,7 @@ description: The following analytic identifies modifications in the registry to
 data_source:
     - Sysmon EventID 13
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
-       WHERE (
-               Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR
-               Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR
-               Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR
-               Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR
-               Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR
-               Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR
-               Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" AND
-               Registry.registry_value_data IN (1, "0x00000001")
-               )
-               by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
-         | `drop_dm_object_name(Registry)`
-         | where isnotnull(registry_value_data)
-         | `security_content_ctime(firstTime)`
-         | `security_content_ctime(lastTime)`
-         | `disable_windows_behavior_monitoring_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Real-Time Protection\\DisableScriptScanning" Registry.registry_value_data IN ("1", "0x00000001")) OR Registry.registry_path IN ("*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring", "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection", "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable", "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring", "*\\Real-Time Protection\\DisableIntrusionPreventionSystem", "*\\Real-Time Protection\\DisableIOAVProtection") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin or user may choose to disable this windows features.
 references:
@@ -40,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender real time behavior monitoring disabled on $dest$
     entity:
diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml
index e750dcf81c4..e5b45c1922a 100644
--- a/detections/endpoint/disable_windows_smartscreen_protection.yml
+++ b/detections/endpoint/disable_windows_smartscreen_protection.yml
@@ -10,15 +10,7 @@ description: The following analytic detects modifications to the Windows registr
 data_source:
     - Sysmon EventID 13
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
-       WHERE (
-              Registry.registry_path IN ("*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled", "*\\Microsoft\\Windows\\System\\EnableSmartScreen")
-              Registry.registry_value_data  IN ("Off", "0", 0x00000000))
-              by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
-         | `drop_dm_object_name(Registry)`
-         | `security_content_ctime(firstTime)`
-         | `security_content_ctime(lastTime)`
-         | `disable_windows_smartscreen_protection_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled", "*\\Microsoft\\Windows\\System\\EnableSmartScreen") Registry.registry_value_data IN ("Off", "0", "0x00000000") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_smartscreen_protection_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin or user may choose to disable this windows features.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The Windows Smartscreen was disabled on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
index 8e920cb6161..60e3800975d 100644
--- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
+++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Get-ADUser` PowerShell cmdlet with parameters indicating a search for domain accounts with Kerberos Pre-Authentication disabled. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this specific activity. This behavior is significant because discovering accounts with Kerberos Pre-Authentication disabled can allow adversaries to perform offline password cracking. If confirmed malicious, this activity could lead to unauthorized access to user accounts, potentially compromising sensitive information and escalating privileges within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText = "*Get-ADUser*" AND ScriptBlockText="*4194304*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-ADUser*" Processes.process="*4194304*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use search for accounts with Kerberos Pre Authentication disabled for legitimate purposes.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$
     entity:
diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
index 7bc9700c64a..950173df8d5 100644
--- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
+++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Get-DomainUser` commandlet with the `-PreauthNotRequired` parameter using PowerShell Script Block Logging (EventCode=4104). This command is part of PowerView, a tool used for enumerating Windows Active Directory networks. Identifying domain accounts with Kerberos Pre-Authentication disabled is significant because adversaries can leverage this information to attempt offline password cracking. If confirmed malicious, this activity could lead to unauthorized access to domain accounts, potentially compromising sensitive information and escalating privileges within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-DomainUser*" Processes.process="*PreauthNotRequired*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use PowerView for troubleshooting
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$
     entity:
diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml
index 947161c2e43..037fe8b246d 100644
--- a/detections/endpoint/disabling_cmd_application.yml
+++ b/detections/endpoint/disabling_cmd_application.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the registry that disable the CMD prompt application. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the "DisableCMD" registry value. This activity is significant because disabling CMD can hinder an analyst's ability to investigate and remediate threats, a tactic often used by malware such as RATs, Trojans, or Worms. If confirmed malicious, this could prevent security teams from using CMD for directory and file traversal, complicating incident response and allowing the attacker to maintain persistence.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_cmd_application_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_cmd_application_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin may disable this application for non technical user.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The Windows command prompt was disabled on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml
index e12ef22f584..d17ddb99ceb 100644
--- a/detections/endpoint/disabling_controlpanel.yml
+++ b/detections/endpoint/disabling_controlpanel.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects registry modifications that disable the Control Panel on Windows systems. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" with a value of "0x00000001". This activity is significant as it is commonly used by malware to prevent users from accessing the Control Panel, thereby hindering the removal of malicious artifacts and persistence mechanisms. If confirmed malicious, this could allow attackers to maintain control over the infected machine and prevent remediation efforts.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin may disable this application for non technical user.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The Windows Control Panel was disabled on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml
index 1df74d36546..4c1639f7ca1 100644
--- a/detections/endpoint/disabling_defender_services.yml
+++ b/detections/endpoint/disabling_defender_services.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the disabling of Windows Defender services by monitoring registry modifications. It leverages registry event data to identify changes to specific registry paths associated with Defender services, where the 'Start' value is set to '0x00000004'. This activity is significant because disabling Defender services can indicate an attempt by an adversary to evade detection and maintain persistence on the endpoint. If confirmed malicious, this action could allow attackers to execute further malicious activities undetected, leading to potential data breaches or system compromise.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*", "*SecurityHealthService*")) AND Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_defender_services_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Services\\*" Registry.registry_path IN ("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*", "*WinDefend*", "*SecurityHealthService*") Registry.registry_value_name="*Start" Registry.registry_value_data="0x00000004" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_defender_services_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin or user may choose to disable windows defender product
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: modified/added/deleted registry entry $registry_path$ on $dest$
     entity:
diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml
index a4d34c97b8b..1c973f6da14 100644
--- a/detections/endpoint/disabling_firewall_with_netsh.yml
+++ b/detections/endpoint/disabling_firewall_with_netsh.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_netsh` Processes.process= "*firewall*" (Processes.process= "*off*"
-        OR
-        Processes.process= "*disable*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `disabling_firewall_with_netsh_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*netsh.exe" OR Processes.original_file_name="netsh.exe" Processes.process="*firewall*" Processes.process IN ("*off*", "*disable*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_firewall_with_netsh_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: admin may disable firewall during testing or fixing network problem.
 references:
@@ -39,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml
index b6c7910f0be..8b7f2224e64 100644
--- a/detections/endpoint/disabling_folderoptions_windows_feature.yml
+++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the modification of the Windows registry to disable the Folder Options feature, which prevents users from showing hidden files and file extensions. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" with a value of "0x00000001". This activity is significant as it is commonly used by malware to conceal malicious files and deceive users with fake file extensions. If confirmed malicious, this could allow an attacker to hide their presence and malicious files, making detection and remediation more difficult.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin may disable this application for non technical user.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml
index 60b5c304f44..6e42e3d2b9e 100644
--- a/detections/endpoint/disabling_norun_windows_app.yml
+++ b/detections/endpoint/disabling_norun_windows_app.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the modification of the Windows registry to disable the Run application in the Start menu. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" with a value of "0x00000001". This activity is significant because the Run application is a useful shortcut for executing known applications and scripts. If confirmed malicious, this action could hinder system cleaning efforts and make it more difficult to run essential tools, thereby aiding malware persistence.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin may disable this application for non technical user.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The Windows registry was modified to disable run application in window start menu on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml
index 3332cbc903e..4e41857299b 100644
--- a/detections/endpoint/disabling_remote_user_account_control.yml
+++ b/detections/endpoint/disabling_remote_user_account_control.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies modifications to the registry key that controls the enforcement of Windows User Account Control (UAC). It detects changes to the registry path `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA` where the value is set to `0x00000000`. This activity is significant because disabling UAC can allow unauthorized changes to the system without user consent, potentially leading to privilege escalation. If confirmed malicious, an attacker could gain elevated privileges, making it easier to execute further attacks or maintain persistence within the environment.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA* Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA*" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_remote_user_account_control_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications.
 known_false_positives: This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml
index 3a75b8fc099..9ee4c4b0825 100644
--- a/detections/endpoint/disabling_systemrestore_in_registry.yml
+++ b/detections/endpoint/disabling_systemrestore_in_registry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the modification of registry keys to disable System Restore on a machine. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with System Restore settings. This activity is significant because disabling System Restore can hinder recovery efforts and is a tactic often used by Remote Access Trojans (RATs) to maintain persistence on an infected system. If confirmed malicious, this action could prevent system recovery, allowing the attacker to sustain their foothold and potentially cause further damage or data loss.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig" Registry.registry_value_data="0x00000001") OR Registry.registry_path IN ("*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR", "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig", "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: in some cases admin can disable systemrestore on a machine.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The Windows registry was modified to disable system restore on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml
index 2eb6da023fa..c3cacb8bbf1 100644
--- a/detections/endpoint/disabling_task_manager.yml
+++ b/detections/endpoint/disabling_task_manager.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies modifications to the Windows registry that disable Task Manager. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" with a value of "0x00000001". This activity is significant as it is commonly associated with malware such as RATs, Trojans, and worms, which disable Task Manager to prevent users from terminating malicious processes. If confirmed malicious, this could allow attackers to maintain persistence and control over the infected system.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin may disable this application for non technical user.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The Windows Task Manager was disabled on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml b/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml
index 81e0bc4d679..251608ca9df 100644
--- a/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml
+++ b/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies the deletion of registry keys that disable Local Security Authority (LSA) protection and Microsoft Defender Device Guard. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry actions and paths associated with LSA and Device Guard settings. This activity is significant because disabling these defenses can leave a system vulnerable to various attacks, including credential theft and unauthorized code execution. If confirmed malicious, this action could allow attackers to bypass critical security mechanisms, leading to potential system compromise and persistent access.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` min(_time) as _time from datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Lsa\\LsaCfgFlags", "*\\Lsa\\RunAsPPL", "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard\\*") AND ((Registry.action = deleted) OR (Registry.action = modified AND Registry.registry_value_data IN(0x00000000, 0))) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_windows_local_security_authority_defences_via_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Lsa\\LsaCfgFlags", "*\\Lsa\\RunAsPPL", "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard\\") (Registry.action="modified" Registry.registry_value_data IN ("0x00000000", "0")) OR Registry.action="deleted" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_windows_local_security_authority_defences_via_registry_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Potential to be triggered by an administrator disabling protections for troubleshooting purposes.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An attempt to disable Windows LSA defences was detected on $dest$. The reg key $registry_path$ was deleted by $user$.
     entity:
diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
index 31781800099..0efbe0a5e69 100644
--- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
+++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
@@ -6,15 +6,21 @@ modification_date: '2026-05-13'
 author: Steven Dick, Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects instances of DLLHost.exe running without
+description: 'The following analytic detects instances of DLLHost.exe running without
+
     command line arguments while establishing a network connection.
+
     This behavior is identified using Endpoint Detection and Response (EDR) telemetry,
+
     focusing on process execution and network activity data.
+
     It is significant because DLLHost.exe typically runs with specific arguments,
+
     and its absence can indicate malicious activity, such as Cobalt Strike usage.
+
     If confirmed malicious, this activity could allow attackers to execute code,
-    move laterally, or exfiltrate data, posing a severe threat to the network's security.
+
+    move laterally, or exfiltrate data, posing a severe threat to the network''s security.'
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 3
 search: |
@@ -58,19 +64,26 @@ search: |
       | `drop_dm_object_name(All_Traffic)`
     ]
     | `dllhost_with_no_command_line_arguments_with_network_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    Although unlikely, some legitimate third party applications
-    may use a moved copy of dllhost, triggering a false positive.
+
+    names and speed up the data modeling process.'
+known_false_positives: 'Although unlikely, some legitimate third party applications
+
+    may use a moved copy of dllhost, triggering a false positive.'
 references:
     - https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile
     - https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/
@@ -82,7 +95,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $src$ by $user$.
     entity:
diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml
index a57e388b5db..2806be85af6 100644
--- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml
+++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml
@@ -11,28 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id values(Processes.parent_process) as parent_process count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "nslookup.exe" Processes.process = "*-querytype=*"
-        OR
-        Processes.process="*-qt=*"
-        OR
-        Processes.process="*-q=*"
-        OR
-        Processes.process="*-type=*"
-        OR
-        Processes.process="*-retry=*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `dns_exfiltration_using_nslookup_app_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*nslookup.exe" Processes.process IN ("*-querytype=*", "*-qt=*", "*-q=*", "*-type=*", "*-retry=*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dns_exfiltration_using_nslookup_app_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: admin nslookup usage
 references:
@@ -47,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration.
     entity:
diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml
index e079ff94c76..58ffc48c495 100644
--- a/detections/endpoint/domain_account_discovery_with_dsquery.yml
+++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name="dsquery.exe"
-        AND
-        Processes.process = "*user*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `domain_account_discovery_with_dsquery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*dsquery.exe" Processes.process="*user*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_account_discovery_with_dsquery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -40,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml
index a0ba747dbbd..64408760e14 100644
--- a/detections/endpoint/domain_account_discovery_with_wmic.yml
+++ b/detections/endpoint/domain_account_discovery_with_wmic.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe" AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process = "*ds_user*" AND Processes.process = "*GET*" AND Processes.process = "*ds_samaccountname*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_account_discovery_with_wmic_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" Processes.process="*/NAMESPACE:\\root\\directory\\ldap*" Processes.process="*ds_user*" Processes.process="*GET*" Processes.process="*ds_samaccountname*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_account_discovery_with_wmic_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: an instance of process $process_name$ with commandline $process$ on $dest$
     entity:
diff --git a/detections/endpoint/domain_controller_discovery_with_nltest.yml b/detections/endpoint/domain_controller_discovery_with_nltest.yml
index 5e561e1f26e..0be1baac098 100644
--- a/detections/endpoint/domain_controller_discovery_with_nltest.yml
+++ b/detections/endpoint/domain_controller_discovery_with_nltest.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=nltest.exe
-            OR
-            Processes.original_file_name=nltestrk.exe
-        )
-        (Processes.process="*/dclist:*" OR Processes.process="*/dsgetdc:*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `domain_controller_discovery_with_nltest_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*nltest.exe" OR Processes.original_file_name="nltestrk.exe" Processes.process IN ("*/dclist:*", "*/dsgetdc:*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_controller_discovery_with_nltest_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -43,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Domain controller discovery on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/domain_controller_discovery_with_wmic.yml b/detections/endpoint/domain_controller_discovery_with_wmic.yml
index e76f592a4ac..4626dcdf116 100644
--- a/detections/endpoint/domain_controller_discovery_with_wmic.yml
+++ b/detections/endpoint/domain_controller_discovery_with_wmic.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="wmic.exe"
-        )
-        (Processes.process="" OR Processes.process="*DomainControllerAddress*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `domain_controller_discovery_with_wmic_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" Processes.process IN ("", "*DomainControllerAddress*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_controller_discovery_with_wmic_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml
index 4913e9b7abd..3ad9d51abdf 100644
--- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml
+++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain groups. It leverages PowerShell Script Block Logging (EventCode=4104) to identify specific script blocks containing `[adsisearcher]` and group-related queries. This activity is significant as it may indicate an attempt by adversaries or Red Teams to enumerate domain groups for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could lead to further reconnaissance, privilege escalation, or lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` (ScriptBlockText = "*[adsisearcher]*" AND ScriptBlockText = "*(objectcategory=group)*" AND ScriptBlockText = "*findAll()*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `domain_group_discovery_with_adsisearcher_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*[adsisearcher]*" Processes.process="*(objectcategory=group)*" Processes.process="*findAll()*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_adsisearcher_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use Adsisearcher for troubleshooting.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Domain group discovery enumeration using PowerShell on $dest$ by $user_id$
     entity:
diff --git a/detections/endpoint/domain_group_discovery_with_dsquery.yml b/detections/endpoint/domain_group_discovery_with_dsquery.yml
index a7fc9ff6ac1..fcf9f476149 100644
--- a/detections/endpoint/domain_group_discovery_with_dsquery.yml
+++ b/detections/endpoint/domain_group_discovery_with_dsquery.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="dsquery.exe"
-        )
-        (Processes.process="*group*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `domain_group_discovery_with_dsquery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*dsquery.exe" Processes.process="*group*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_dsquery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -40,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/domain_group_discovery_with_wmic.yml b/detections/endpoint/domain_group_discovery_with_wmic.yml
index 6cec7051a8a..37f97cf9278 100644
--- a/detections/endpoint/domain_group_discovery_with_wmic.yml
+++ b/detections/endpoint/domain_group_discovery_with_wmic.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap* AND Processes.process=*ds_group* AND Processes.process="*GET ds_samaccountname*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_wmic_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process="*/NAMESPACE:\\\\root\\directory\\ldap*" Processes.process="*ds_group*" Processes.process="*GET ds_samaccountname*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_wmic_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml
index 3403eef36a9..85cb0ce525c 100644
--- a/detections/endpoint/download_files_using_telegram.yml
+++ b/detections/endpoint/download_files_using_telegram.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects suspicious file downloads by the Telegram application on a Windows system. It leverages Sysmon EventCode 15 to identify instances where Telegram.exe creates files with a Zone.Identifier, indicating a download. This activity is significant as it may indicate an adversary using Telegram to download malicious tools, such as network scanners, for further exploitation. If confirmed malicious, this behavior could lead to network mapping, lateral movement, and potential compromise of additional systems within the network.
 data_source:
     - Sysmon EventID 15
-search: |-
-    `sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier"
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest dvc file_hash
-           file_name file_path process_exec
-           process_guid process_id process_name
-           process_path signature signature_id
-           user_id vendor_product Contents
-           Image
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `download_files_using_telegram_filter`
+search: |
+    `sysmon` EventCode=15 process_name="telegram.exe" TargetFilename="*:Zone.Identifier" | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc file_hash file_name file_path process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `download_files_using_telegram_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and TargetFilename from your endpoints or Events that monitor filestream events which is happened when process download something. (EventCode 15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: normal download of file in telegram app. (if it was a common app in network)
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious files were downloaded with the Telegram application on $dest$
     entity:
diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml
index 624143ffb2e..a9b3e2b95d7 100644
--- a/detections/endpoint/drop_icedid_license_dat.yml
+++ b/detections/endpoint/drop_icedid_license_dat.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects the dropping of a suspicious file named "license.dat" in %appdata% or %programdata%. This behavior is associated with the IcedID malware, which uses this file to inject its core bot into other processes for banking credential theft. The detection leverages Sysmon EventCode 11 to monitor file creation events in these directories. This activity is significant as it indicates a potential malware infection aiming to steal sensitive banking information. If confirmed malicious, the attacker could gain unauthorized access to financial data, leading to significant financial loss and data breaches.
 data_source:
     - Sysmon EventID 11
-search: '`sysmon` EventCode= 11  TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*" OR TargetFilename="*\\programdata\\*") |stats count min(_time) as firstTime max(_time) as lastTime by TargetFilename EventCode process_id  process_name dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_icedid_license_dat_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\license.dat" Filesystem.file_path IN ("*\\appdata\\*", "*\\programdata\\*") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_icedid_license_dat_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml
index 12add244b61..62ff4e19b85 100644
--- a/detections/endpoint/dsquery_domain_discovery.yml
+++ b/detections/endpoint/dsquery_domain_discovery.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=dsquery.exe Processes.process=*trustedDomain*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `dsquery_domain_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*dsquery.exe" Processes.process="*trustedDomain*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dsquery_domain_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives. If there is a true false positive, filter based on command-line or parent process.
 references:
@@ -41,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
index ce62844c17e..f0e62a63930 100644
--- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
+++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_rundll32` Processes.process=*comsvcs.dll* Processes.process IN ("*MiniDump*", "*#24*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `dump_lsass_via_comsvcs_dll_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" Processes.process="*comsvcs.dll*" Processes.process IN ("*MiniDump*", "*#24*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_comsvcs_dll_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -40,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index f83b777679a..1587678b8fe 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -6,69 +6,44 @@ modification_date: '2026-10-02'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects the use of procdump.exe to dump the LSASS
+description: 'The following analytic detects the use of procdump.exe to dump the LSASS
+
     process, specifically looking for the -mm and -ma command-line arguments. It leverages
+
     data from Endpoint Detection and Response (EDR) agents, focusing on process names,
+
     command-line executions, and parent processes. This activity is significant because
+
     dumping LSASS can expose sensitive credentials, posing a severe security risk. If
+
     confirmed malicious, an attacker could obtain credentials, escalate privileges,
+
     and move laterally within the network, leading to potential data breaches and further
-    compromise of the environment.
+
+    compromise of the environment.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    (
-      Processes.process_name IN (
-        "procdump.exe",
-        "procdump64.exe",
-        "procdump64a.exe"
-      )
-      OR
-      Processes.original_file_name=procdump
-    )
-    Processes.process IN (
-        "*-ma*",
-        "*-mm*",
-        "*-mp*",
-        "*/ma*",
-        "*/mm*",
-        "*/mp*"
-    )
-    Processes.process IN (
-        "* keyiso*",
-        "* ls*",
-        "* samss*"
-    )
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*procdump.exe", "*procdump64.exe", "*procdump64a.exe") OR Processes.original_file_name="procdump" Processes.process IN ("*-ma*", "*-mm*", "*-mp*", "*/ma*", "*/mm*", "*/mp*") Processes.process IN ("* keyiso*", "* ls*", "* samss*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `dump_lsass_via_procdump_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
+
+    names and speed up the data modeling process.'
 known_false_positives: No false positives have been identified at this time.
 references:
     - https://attack.mitre.org/techniques/T1003/001/
@@ -85,7 +60,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe via the command $process$ on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/elevated_group_discovery_with_powerview.yml b/detections/endpoint/elevated_group_discovery_with_powerview.yml
index 04f65392e7c..58ebe794256 100644
--- a/detections/endpoint/elevated_group_discovery_with_powerview.yml
+++ b/detections/endpoint/elevated_group_discovery_with_powerview.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects the execution of the `Get-DomainGroupMember` cmdlet from PowerView, identified through PowerShell Script Block Logging (EventCode=4104). This cmdlet is used to enumerate members of elevated domain groups such as Domain Admins and Enterprise Admins. Monitoring this activity is crucial as it indicates potential reconnaissance efforts by adversaries to identify high-privileged users within the domain. If confirmed malicious, this activity could lead to targeted attacks on privileged accounts, facilitating further compromise and lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainGroupMember*") AND ScriptBlockText IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*" , "*Server Operators*", "*Protected Users*",  "*Dns Admins*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `elevated_group_discovery_with_powerview_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-DomainGroupMember*" Processes.process IN ("*Domain Admins*", "*Enterprise Admins*", "*Schema Admins*", "*Account Operators*", "*Server Operators*", "*Protected Users*", "*Dns Admins*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_powerview_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use this PowerView for troubleshooting.
 references:
diff --git a/detections/endpoint/elevated_group_discovery_with_wmic.yml b/detections/endpoint/elevated_group_discovery_with_wmic.yml
index e8cbc8a6916..d56251ec189 100644
--- a/detections/endpoint/elevated_group_discovery_with_wmic.yml
+++ b/detections/endpoint/elevated_group_discovery_with_wmic.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap*) (Processes.process="*Domain Admins*" OR Processes.process="*Enterprise Admins*" OR Processes.process="*Schema Admins*" OR Processes.process="*Account Operators*" OR Processes.process="*Server Operators*" OR Processes.process="*Protected Users*" OR Processes.process="*Dns Admins*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_wmic_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" Processes.process="*/NAMESPACE:\\\\root\\directory\\ldap*" Processes.process IN ("*Domain Admins*", "*Enterprise Admins*", "*Schema Admins*", "*Account Operators*", "*Server Operators*", "*Protected Users*", "*Dns Admins*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_wmic_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Elevated domain group discovery enumeration on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml
index fa0c2990098..02ef3cde3b5 100644
--- a/detections/endpoint/enable_rdp_in_other_port_number.yml
+++ b/detections/endpoint/enable_rdp_in_other_port_number.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the registry that enable RDP on a machine using a non-default port number. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" and the "PortNumber" value. This activity is significant as attackers often modify RDP settings to facilitate lateral movement and maintain remote access to compromised systems. If confirmed malicious, this could allow attackers to bypass network defenses, gain persistent access, and potentially control the compromised machine.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enable_rdp_in_other_port_number_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name="*PortNumber" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enable_rdp_in_other_port_number_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: RDP was moved to a non-standard port on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml
index e2c065432ac..b689c2c983c 100644
--- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml
+++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a suspicious registry modification that enables the plain text credential feature in Windows by setting the "UseLogonCredential" value to 1 in the WDigest registry path. This detection leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values. This activity is significant because it is commonly used by malware and tools like Mimikatz to dump plain text credentials, indicating a potential credential dumping attempt. If confirmed malicious, this could allow an attacker to obtain sensitive credentials, leading to further compromise and lateral movement within the network.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data=0x00000001) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enable_wdigest_uselogoncredential_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" Registry.registry_value_name="*UseLogonCredential" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enable_wdigest_uselogoncredential_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: wdigest registry $registry_path$ was modified on $dest$
     entity:
diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml
index 7bf1d24fef5..54b49ca8639 100644
--- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml
+++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a Telegram process enumerating all network users in a local group. It leverages EventCode 4798, which is generated when a process enumerates a user's security-enabled local groups on a computer or device. This activity is significant as it may indicate an attempt to gather information on user accounts, a common precursor to further malicious actions. If confirmed malicious, this behavior could allow an attacker to map out user accounts, potentially leading to privilege escalation or lateral movement within the network.
 data_source:
     - Windows Event Log Security 4798
-search: '`wineventlog_security` EventCode=4798  CallerProcessName = "*\\telegram.exe" | stats count min(_time) as firstTime max(_time) as lastTime by user Computer EventCode CallerProcessName  ProcessID SubjectUserSid SubjectDomainName  SubjectLogonId | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enumerate_users_local_group_using_telegram_filter`'
+search: |
+    `wineventlog_security` EventCode="4798" CallerProcessName="*\\telegram.exe" | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enumerate_users_local_group_using_telegram_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and filter known instances of process like logonUI used in your environment.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The Telegram application has been identified enumerating local groups on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml
index 508a661ec4e..386bcadd177 100644
--- a/detections/endpoint/esentutl_sam_copy.yml
+++ b/detections/endpoint/esentutl_sam_copy.yml
@@ -12,20 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    (Processes.process_name=esentutl.exe OR Processes.original_file_name=esentutl.exe)
-    Processes.process IN ("*ntds*", "*SAM*")
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
-       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
-       Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `esentutl_sam_copy_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*esentutl.exe" OR Processes.original_file_name="esentutl.exe" Processes.process IN ("*ntds*", "*SAM*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esentutl_sam_copy_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited. Filter as needed.
 references:
diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml
index a53c06c41dd..86c8f34b77e 100644
--- a/detections/endpoint/etw_registry_disabled.yml
+++ b/detections/endpoint/etw_registry_disabled.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a registry modification that disables the ETW for the .NET Framework. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the ETWEnabled registry value under the .NETFramework path. This activity is significant because disabling ETW can allow attackers to evade Endpoint Detection and Response (EDR) tools and hide their execution from audit logs. If confirmed malicious, this action could enable attackers to operate undetected, potentially leading to further compromise and persistent access within the environment.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*" Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `etw_registry_disabled_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*" Registry.registry_value_name="*ETWEnabled" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `etw_registry_disabled_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Modified/added/deleted registry entry $registry_path$ on $dest$
     entity:
diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml
index 277d02f4520..2d7a6464a1a 100644
--- a/detections/endpoint/eventvwr_uac_bypass.yml
+++ b/detections/endpoint/eventvwr_uac_bypass.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects an Eventvwr UAC bypass by identifying suspicious registry modifications in the path that Eventvwr.msc references upon execution. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry changes and process execution details. This activity is significant because it indicates a potential privilege escalation attempt, allowing an attacker to execute arbitrary commands with elevated privileges. If confirmed malicious, this could lead to unauthorized code execution, persistence, and further compromise of the affected system.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*mscfile\\shell\\open\\command\\*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `eventvwr_uac_bypass_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*mscfile\\shell\\open\\command\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `eventvwr_uac_bypass_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some false positives may be present and will need to be filtered.
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml
index f432dbd97e8..8ed28e6ee26 100644
--- a/detections/endpoint/excessive_attempt_to_disable_services.yml
+++ b/detections/endpoint/excessive_attempt_to_disable_services.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product  count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "sc.exe"
-        AND
-        Processes.process="*config*"
-        OR
-        Processes.process="*Disabled*"
-      BY Processes.process_name Processes.parent_process_name Processes.dest
-         Processes.user _time span=1m
-    | where count >=4
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `excessive_attempt_to_disable_services_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sc.exe" Processes.process IN ("*config*", "*Disabled*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_attempt_to_disable_services_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml b/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml
index 7f135657ba5..2224e87a731 100644
--- a/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml
+++ b/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` distinct_count(Processes.process) as distinct_process_count min(_time) as firstTime max(_time) as lastTime values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_name) as process_name values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product from datamodel=Endpoint.Processes where Processes.process_path = "*\\Windows\\Temp\\*" by Processes.dest Processes.user _time span=20m |  where distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_distinct_processes_from_windows_temp_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path="*\\Windows\\Temp\\*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_distinct_processes_from_windows_temp_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold.  Filter as needed.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml
index b1d07fcdada..ecf11c8b88e 100644
--- a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml
+++ b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml
@@ -10,7 +10,8 @@ description: The following analytic detects excessive file deletion events in th
 data_source:
     - Sysmon EventID 23
     - Sysmon EventID 26
-search: '`sysmon` EventCode IN ("23","26") TargetFilename = "*\\ProgramData\\Microsoft\\Windows Defender\\*" | stats count min(_time) as firstTime, max(_time) as lastTime values(file_path) as file_path values(file_hash) as file_hash values(file_name) as file_name values(file_modify_time) as file_modify_time values(process_name) as process_name values(process_path) as process_path values(process_guid) as process_guid values(process_id) as process_id values(process_exec) as process_exec by action dest dvc signature signature_id user user_id vendor_product | where count >=50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_file_deletion_in_windefender_folder_filter`'
+search: |
+    `sysmon` EventCode=23 EventCode="26" TargetFilename="*\\ProgramData\\Microsoft\\Windows Defender\\*" | stats count min(_time) as firstTime max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_file_deletion_in_windefender_folder_filter`
 how_to_implement: To successfully implement this search, you must ingest logs that include the process name, TargetFilename, and ProcessID executions from your endpoints. If you are utilizing Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed.
 known_false_positives: Windows Defender AV updates may trigger this alert. Please adjust the filter macros to mitigate false positives.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Excessive file deletion events were detected in the Windows Defender folder on $dest$ by $user$. Investigate further to determine if this activity is malicious.
     entity:
diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml
index 999345cb311..21f689bcf5e 100644
--- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml
+++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml
@@ -11,19 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` distinct_count(Processes.process) as distinct_cmdlines values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "sc.exe"
-        AND
-        Processes.process="*start= disabled*"
-      BY Processes.dest Processes.user Processes.parent_process
-         Processes.process_name Processes.parent_process_id, _time
-         span=30m
-    | where distinct_cmdlines >= 8
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `excessive_number_of_service_control_start_as_disabled_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sc.exe" Processes.process="*start= disabled*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_service_control_start_as_disabled_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate programs and administrators will execute sc.exe with the start disabled flag.  It is possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than seven times in a short period of time.
 references:
@@ -37,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml
index 92597620bd7..fe126073a04 100644
--- a/detections/endpoint/excessive_number_of_taskhost_processes.yml
+++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.user) as user values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "taskhost.exe"
-        OR
-        Processes.process_name = "taskhostex.exe"
-      BY Processes.dest Processes.process_name _time
-         span=1h
-    | `drop_dm_object_name(Processes)`
-    | eval pid_count=mvcount(process_id)
-    | eval taskhost_count_=if(process_name == "taskhost.exe", pid_count, 0)
-    | eval taskhostex_count_=if(process_name == "taskhostex.exe", pid_count, 0)
-    | stats sum(taskhost_count_) as taskhost_count, sum(taskhostex_count_) as taskhostex_count values(action) as action values(original_file_name) as original_file_name values(parent_process) as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) as parent_process_path values(process) as process values(process_exec) as process_exec values(process_guid) as process_guid values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) as process_integrity_level values(user) as user values(process_path) as process_path values(user_id) as user_id values(vendor_product) as vendor_product values(process_name) as process_name
-      BY _time, dest, firstTime,
-         lastTime
-    | where taskhost_count > 10 or taskhostex_count > 10
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `excessive_number_of_taskhost_processes_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*taskhost.exe", "*taskhostex.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_taskhost_processes_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently.  Filter as needed.
 references:
@@ -41,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml
index 3a779ef1054..f0b13d20e4e 100644
--- a/detections/endpoint/excessive_usage_of_cacls_app.yml
+++ b/detections/endpoint/excessive_usage_of_cacls_app.yml
@@ -6,60 +6,46 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe`,
+description: 'The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe`,
+
     or `icacls.exe` to change file or folder permissions.
+
     It looks for 10 or more execution of the aforementioned processes in the span of 1 minute.
+
     It leverages data from Endpoint Detection and Response (EDR) agents,
+
     focusing on process names and command-line executions.
+
     This activity is significant as it may indicate an adversary attempting
+
     to restrict access to malware components or artifacts on a compromised system.
+
     If confirmed malicious, this behavior could prevent users from deleting or accessing
-    critical files, aiding in the persistence and concealment of malicious activities.
+
+    critical files, aiding in the persistence and concealment of malicious activities.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      min(_time) as firstTime
-      max(_time) as lastTime
-      values(Processes.dest) as dest
-      values(Processes.user) as user
-      values(Processes.action) as action
-      values(Processes.original_file_name) as original_file_name
-      values(Processes.parent_process_exec) as parent_process_exec
-      values(Processes.parent_process_guid) as parent_process_guid
-      values(Processes.parent_process_id) as parent_process_id
-      values(Processes.parent_process_path) as parent_process_path
-      values(Processes.process) as process
-      values(Processes.process_exec) as process_exec
-      values(Processes.process_guid) as process_guid
-      values(Processes.process_hash) as process_hash
-      values(Processes.process_id) as process_id
-      values(Processes.process_integrity_level) as process_integrity_level
-      values(Processes.process_name) as process_name
-      values(Processes.process_path) as process_path
-      values(Processes.user_id) as user_id
-      values(Processes.vendor_product) as vendor_product count
-    from datamodel=Endpoint.Processes where
-    Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe")
-    by Processes.parent_process_name Processes.parent_process Processes.dest Processes.user _time span=1m
-    | where count >=10
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `excessive_usage_of_cacls_app_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*icacls.exe", "*cacls.exe", "*xcacls.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_cacls_app_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
+
+    names and speed up the data modeling process.'
 known_false_positives: Administrators or administrative scripts may use this application. Filter as needed.
 references:
     - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -71,7 +57,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml
index 89453e0e89a..1cedb429929 100644
--- a/detections/endpoint/excessive_usage_of_nslookup_app.yml
+++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml
@@ -11,7 +11,7 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly` count as numNsLookup min(_time) as firstTime max(_time) as lastTime values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product values(Processes.parent_process) as parent_process values(Processes.process_name) as process_name values(Processes.parent_process_id) as parent_process_id values(Processes.user) as user FROM datamodel=Endpoint.Processes
       WHERE Processes.process_name = "nslookup.exe"
       BY Processes.dest _time span=1m
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml
index 92bb51b474d..a2acaf193ca 100644
--- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml
+++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects excessive usage of the `sc.exe` service utility on a host machine. It leverages Sysmon EventCode 1 logs to identify instances where `sc.exe` is executed more frequently than normal within a 15-minute window. This behavior is significant as it is commonly associated with ransomware, cryptocurrency miners, and other malware attempting to create, modify, delete, or disable services, potentially related to security applications or for privilege escalation. If confirmed malicious, this activity could allow attackers to manipulate critical services, leading to system compromise or disruption of security defenses.
 data_source:
     - Sysmon EventID 1
-search: |-
+search: |
     | tstats `security_content_summariesonly` count as numScExe min(_time) as firstTime max(_time) as lastTime values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product values(Processes.parent_process) as parent_process values(Processes.process_name) as process_name values(Processes.parent_process_id) as parent_process_id values(Processes.user) as user FROM datamodel=Endpoint.Processes
       WHERE Processes.process_name = "sc.exe"
       BY Processes.dest _time span=15m
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml
index 3bdb28e4c09..dfffc1429c6 100644
--- a/detections/endpoint/excessive_usage_of_taskkill.yml
+++ b/detections/endpoint/excessive_usage_of_taskkill.yml
@@ -11,16 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.action) as action values(Processes.dest) as dest values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user) as user  values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "taskkill.exe"
-      BY Processes.parent_process_name Processes.process_name Processes.dest
-         Processes.user _time span=1m
-    | where count >=10
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `excessive_usage_of_taskkill_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*taskkill.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_taskkill_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -34,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml b/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml
index 9259724e6da..000c9c7f342 100644
--- a/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml
+++ b/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic detects suspicious behavior indicative of ProxyShell exploitation against on-premise Microsoft Exchange servers. It identifies HTTP POST requests to `autodiscover.json` containing `PowerShell` in the URI, leveraging server-side request forgery (SSRF) to access backend PowerShell. This detection uses Exchange server logs ingested into Splunk. Monitoring this activity is crucial as it may indicate an attacker attempting to execute commands or scripts on the Exchange server. If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent control over the Exchange environment.
 data_source: []
-search: |-
+search: |
     `windows_exchange_iis` c_uri="*//autodiscover*" cs_uri_query="*PowerShell*" cs_method="POST"
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY dest, cs_uri_query, cs_method,
diff --git a/detections/endpoint/exchange_powershell_module_usage.yml b/detections/endpoint/exchange_powershell_module_usage.yml
index 71f73c1edbe..fa43675c3a6 100644
--- a/detections/endpoint/exchange_powershell_module_usage.yml
+++ b/detections/endpoint/exchange_powershell_module_usage.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the usage of specific Exchange PowerShell modules, such as New-MailboxExportRequest, New-ManagementRoleAssignment, New-MailboxSearch, and Get-Recipient. It leverages PowerShell Script Block Logging (EventCode 4104) to identify these commands. This activity is significant because these modules can be exploited by adversaries who have gained access via ProxyShell or ProxyNotShell vulnerabilities. If confirmed malicious, attackers could export mailbox contents, assign management roles, conduct mailbox searches, or view recipient objects, potentially leading to data exfiltration, privilege escalation, or unauthorized access to sensitive information.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*", "*New-MailboxSearch*", "*Get-Recipient*", "Search-Mailbox")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `exchange_powershell_module_usage_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*", "*New-MailboxSearch*", "*Get-Recipient*", "*Search-Mailbox*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `exchange_powershell_module_usage_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
 references:
@@ -41,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious Exchange PowerShell module usaged was identified on $dest$.
     entity:
diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
index f9f1611df17..9f6f8d6527f 100644
--- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
+++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
@@ -6,44 +6,17 @@ modification_date: '2026-08-05'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects executable files (.exe, .dll, etc.) being written to Windows administrative SMB shares (Admin$, IPC$, C$). It leverages Windows Security Event Logs with EventCode 5145 to identify this activity.
+description: 'The following analytic detects executable files (.exe, .dll, etc.) being written to Windows administrative SMB shares (Admin$, IPC$, C$). It leverages Windows Security Event Logs with EventCode 5145 to identify this activity.
+
     This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed for lateral movement and remote code execution.
-    If confirmed malicious, this activity could allow an attacker to execute arbitrary code remotely, potentially compromising additional systems within the network.
+
+    If confirmed malicious, this activity could allow an attacker to execute arbitrary code remotely, potentially compromising additional systems within the network.'
 data_source:
     - Windows Event Log Security 5145
-search: |-
-    `wineventlog_security`
-    EventCode=5145
-    RelativeTargetName IN (
-        "*.cpl",
-        "*.dll",
-        "*.exe",
-        "*.sys"
-    )
-    ObjectType=File
-    ShareName IN (
-        "\\\\*\\Admin$",
-        "\\\\*\\C$",
-        "\\\\*\\IPC$"
-    )
-
-    | eval AccessMask_ = tonumber(AccessMask, 16)
-    | where (bit_and(AccessMask_, 2) != 0) OR (bit_and(AccessMask_, 4) != 0)
-
-    | stats min(_time) as firstTime
-            max(_time) as lastTime count
-
-      by EventCode ShareName RelativeTargetName ObjectType
-         AccessMask src_user src_port IpAddress dest
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `executable_file_written_in_administrative_smb_share_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
-known_false_positives: |-
-    System Administrators may use tools like PsExec for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list.
+search: |
+    `wineventlog_security` EventCode=5145 RelativeTargetName IN ("*.cpl", "*.dll", "*.exe", "*.sys") ObjectType="File" ShareName IN ("\\*\\Admin$", "\\*\\C$", "\\*\\IPC$") | eval src_user=src_user, AccessMask=AccessMask | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executable_file_written_in_administrative_smb_share_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
+known_false_positives: System Administrators may use tools like PsExec for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list.
 references:
     - https://attack.mitre.org/techniques/T1021/002/
     - https://www.rapid7.com/blog/post/2013/03/09/psexec-demystified/
@@ -59,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The [$src_user$] dropped or created an executable file in known sensitive SMB share. Share name=[$ShareName$], Target name=[$RelativeTargetName$], and Access mask=[$AccessMask$]
     entity:
diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
index 88b6fb4b745..c21b701402f 100644
--- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
@@ -9,49 +9,8 @@ type: Anomaly
 description: The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem dataset to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    from datamodel=Endpoint.Filesystem where
-    Filesystem.file_name IN (
-        "*.bat",
-        "*.cmd",
-        "*.com",
-        "*.dll",
-        "*.exe",
-        "*.js",
-        "*.msc",
-        "*.pif",
-        "*.ps1",
-        "*.sys",
-        "*.vbe",
-        "*.vbs"
-    )
-    Filesystem.file_path IN (
-        "*:\\PerfLogs\\*",
-        "*:\\Users\\Administrator\\Music\\*",
-        "*:\\Users\\Default\\*",
-        "*:\\Users\\Public\\*",
-        "*:\\Windows\\debug\\*",
-        "*:\\Windows\\fonts\\*",
-        "*:\\Windows\\Media\\*",
-        "*:\\Windows\\repair\\*",
-        "*:\\Windows\\servicing\\*",
-        "*\\inetpub\\*",
-        "*\\Microsoft\\Windows\\Libraries\\*",
-        "*Recycle.bin*"
-    )
-    by Filesystem.action Filesystem.dest Filesystem.file_access_time
-       Filesystem.file_create_time Filesystem.file_hash
-       Filesystem.file_modify_time Filesystem.file_name
-       Filesystem.file_path Filesystem.file_acl Filesystem.file_size
-       Filesystem.process_guid Filesystem.process_id Filesystem.user
-       Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `executables_or_script_creation_in_suspicious_path_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.bat", "*.cmd", "*.com", "*.dll", "*.exe", "*.js", "*.msc", "*.pif", "*.ps1", "*.sys", "*.vbe", "*.vbs") Filesystem.file_path IN ("*:\\PerfLogs\\*", "*:\\Users\\Administrator\\Music\\*", "*:\\Users\\Default\\*", "*:\\Users\\Public\\*", "*:\\Windows\\debug\\*", "*:\\Windows\\fonts\\*", "*:\\Windows\\Media\\*", "*:\\Windows\\repair\\*", "*:\\Windows\\servicing\\*", "*\\inetpub\\*", "*\\Microsoft\\Windows\\Libraries\\*", "*Recycle.bin*") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`
 how_to_implement: To successfully implement this search you need to be ingestinginformation on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 known_false_positives: Some false positives may arise from paths like Recycle.bin and \Users\Public. Other than that executable creation and certain script extensions in these suspicious paths should be less common.
 references:
diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml
index 69962abd69f..3c902aad1af 100644
--- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml
@@ -6,51 +6,15 @@ modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic identifies the creation of executables or scripts in temporary file paths on Windows systems. It leverages the Endpoint.Filesystem data set to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in temporary directories (e.g., \windows\Temp\, \AppData\Local\Temp\).
+description: 'The following analytic identifies the creation of executables or scripts in temporary file paths on Windows systems. It leverages the Endpoint.Filesystem data set to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in temporary directories (e.g., \windows\Temp\, \AppData\Local\Temp\).
+
     This activity can be significant as adversaries often use these paths to evade detection and maintain persistence.
-    If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
+
+    If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.action= "created"
-    Filesystem.file_name IN (
-        "*.bat",
-        "*.cmd",
-        "*.com",
-        "*.dll",
-        "*.exe",
-        "*.js",
-        "*.msc",
-        "*.pif",
-        "*.ps1",
-        "*.sys",
-        "*.vbe",
-        "*.vbs"
-    )
-    Filesystem.file_path IN (
-        "*:\\Temp\\*",
-        "*:\\Windows\\Temp\\*",
-        "*\\AppData\\Local\\Temp\\*"
-    )
-    NOT Filesystem.file_path IN ("*\\__PSScriptPolicyTest_*")
-
-    by Filesystem.action Filesystem.dest Filesystem.file_access_time
-       Filesystem.file_create_time Filesystem.file_hash
-       Filesystem.file_modify_time Filesystem.file_name
-       Filesystem.file_path Filesystem.file_acl
-       Filesystem.file_size Filesystem.process_guid
-       Filesystem.process_id Filesystem.user
-       Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `executables_or_script_creation_in_temp_path_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.bat", "*.cmd", "*.com", "*.dll", "*.exe", "*.js", "*.msc", "*.pif", "*.ps1", "*.sys", "*.vbe", "*.vbs") Filesystem.file_path IN ("*:\\Temp\\*", "*:\\Windows\\Temp\\*", "*\\AppData\\Local\\Temp\\*") NOT Filesystem.file_path="*\\__PSScriptPolicyTest_*" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_temp_path_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 known_false_positives: Executable creation and certain script extensions in temporary paths can very common in certain environments and legitimate use cases. It is important to review and filter these events based on your organization''s normal activity and policies.
 references:
diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml
index 3af380c6446..e9f8f980248 100644
--- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml
+++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "cscript.exe" Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `execute_javascript_with_jscript_com_clsid_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*cscript.exe" Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `execute_javascript_with_jscript_com_clsid_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious process of cscript.exe with a parent process $parent_process_name$ where it tries to execute javascript using jscript.encode CLSID (COM OBJ), detected on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml
index cced492e048..75c9a67f50c 100644
--- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml
+++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process IN ("*.doc.exe", "*.xls.exe","*.ppt.exe", "*.htm.exe", "*.html.exe", "*.txt.exe", "*.pdf.exe", "*.docx.exe", "*.xlsx.exe", "*.pptx.exe","*.one.exe", "*.bat.exe", "*.rtf.exe")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `drop_dm_object_name(Processes)`
-    | `execution_of_file_with_multiple_extensions_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*.doc.exe", "*.xls.exe", "*.ppt.exe", "*.htm.exe", "*.html.exe", "*.txt.exe", "*.pdf.exe", "*.docx.exe", "*.xlsx.exe", "*.pptx.exe", "*.one.exe", "*.bat.exe", "*.rtf.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `execution_of_file_with_multiple_extensions_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: process $process$ have double extensions in the file name is executed on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/file_download_or_read_to_pipe_execution.yml b/detections/endpoint/file_download_or_read_to_pipe_execution.yml
index df3d8bb192e..2675aec044a 100644
--- a/detections/endpoint/file_download_or_read_to_pipe_execution.yml
+++ b/detections/endpoint/file_download_or_read_to_pipe_execution.yml
@@ -6,11 +6,13 @@ modification_date: '2026-09-01'
 author: Michael Haag, Nasreddine Bencherchali, Splunk, DipsyTipsy
 status: production
 type: TTP
-description: |
-    The following analytic detects the use of download or file reading utilities from Windows, Linux or MacOS to download or read the contents of a file from a remote or local source and pipe it directly to a shell for execution.
+description: 'The following analytic detects the use of download or file reading utilities from Windows, Linux or MacOS to download or read the contents of a file from a remote or local source and pipe it directly to a shell for execution.
+
     This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions.
+
     This activity is significant as it is commonly associated with malicious actions like coinminers and exploits such as CVE-2021-44228 in Log4j.
-    If confirmed malicious, this behavior could allow attackers to execute arbitrary code, potentially leading to system compromise and unauthorized access to sensitive data.
+
+    If confirmed malicious, this behavior could allow attackers to execute arbitrary code, potentially leading to system compromise and unauthorized access to sensitive data.'
 data_source:
     - Sysmon EventID 1
     - Sysmon for Linux EventID 1
@@ -75,18 +77,24 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `file_download_or_read_to_pipe_execution_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    False positives should be limited, however filtering may be required.
+
+    names and speed up the data modeling process.'
+known_false_positives: False positives should be limited, however filtering may be required.
 references:
     - https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890
     - https://github.com/MHaggis/notes/blob/master/utilities/warp_pipe_tester.py
@@ -101,7 +109,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of [$process_name$] was identified on endpoint [$dest$] attempting to immediately read or download a file and run it via a shell via the CommandLine [$process$] via the ParentProcess [$parent_process$].
     entity:
diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml
index 6138372675a..ad19f14b83a 100644
--- a/detections/endpoint/file_with_samsam_extension.yml
+++ b/detections/endpoint/file_with_samsam_extension.yml
@@ -6,12 +6,15 @@ modification_date: '2026-05-13'
 author: Rico Valdez, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects file writes with extensions indicative of a SamSam ransomware attack.
+description: 'The following analytic detects file writes with extensions indicative of a SamSam ransomware attack.
+
     It leverages file-system activity data to identify file names ending in .stubbin, .berkshire, .satoshi, .sophos, or .keyxml.
+
     This activity is significant because SamSam ransomware is highly destructive, leading to file encryption and ransom demands.
+
     If confirmed malicious, the impact includes significant financial losses, operational disruptions, and reputational damage.
-    Immediate actions should include isolating affected systems, restoring files from backups, and investigating the attack source to prevent further incidents.
+
+    Immediate actions should include isolating affected systems, restoring files from backups, and investigating the attack source to prevent further incidents.'
 data_source:
     - Sysmon EventID 11
 search: |
@@ -42,8 +45,7 @@ search: |
     | search file_extension IN (".berkshire", ".keyxml", ".satoshi", ".sophos", ".stubbin")
     | `file_with_samsam_extension_filter`
 how_to_implement: You must be ingesting data that records file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
-known_false_positives: |
-    Because these extensions are not typically used in normal operations, you should investigate all results.
+known_false_positives: Because these extensions are not typically used in normal operations, you should investigate all results.
 references: []
 drilldown_searches:
     - name: View the detection results for - "$user$" and "$dest$"
@@ -53,7 +55,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$
     entity:
diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml
index b88a6802075..62b79d1417c 100644
--- a/detections/endpoint/firewall_allowed_program_enable.yml
+++ b/detections/endpoint/firewall_allowed_program_enable.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process = "*firewall*" Processes.process = "*allow*" Processes.process = "*add*" Processes.process = "*ENABLE*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `firewall_allowed_program_enable_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*firewall*" Processes.process="*allow*" Processes.process="*add*" Processes.process="*ENABLE*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `firewall_allowed_program_enable_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: A network operator or systems administrator may utilize an automated or manual execution of this firewall rule that may generate false positives. Filter as needed.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml
index 3c4b132b750..387c34a9803 100644
--- a/detections/endpoint/first_time_seen_child_process_of_zoom.yml
+++ b/detections/endpoint/first_time_seen_child_process_of_zoom.yml
@@ -11,7 +11,7 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime values(Processes.user) as user values(Processes.action) as action values(Processes.dest) as dest values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_name) as process_name values(Processes.process_path) as process_path  values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product FROM datamodel=Endpoint.Processes
       WHERE (
             Processes.parent_process_name=zoom.exe
diff --git a/detections/endpoint/first_time_seen_running_windows_service.yml b/detections/endpoint/first_time_seen_running_windows_service.yml
index 32c71e2566e..7390962fa8d 100644
--- a/detections/endpoint/first_time_seen_running_windows_service.yml
+++ b/detections/endpoint/first_time_seen_running_windows_service.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the first occurrence of a Windows service running in your environment. It leverages Windows system event logs, specifically EventCode 7036, to identify services entering the "running" state. This activity is significant because the appearance of a new or previously unseen service could indicate the installation of unauthorized or malicious software. If confirmed malicious, this activity could allow an attacker to execute arbitrary code, maintain persistence, or escalate privileges within the environment. Monitoring for new services helps in early detection of potential threats.
 data_source:
     - Windows Event Log System 7036
-search: |-
+search: |
     `wineventlog_system` EventCode=7036
       | rex field=Message "The (?<service>[-\(\)\s\w]+) service entered the (?<state>\w+) state"
       | where state="running"
diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml
index f42622c18f9..25e4613a637 100644
--- a/detections/endpoint/fodhelper_uac_bypass.yml
+++ b/detections/endpoint/fodhelper_uac_bypass.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=fodhelper.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `fodhelper_uac_bypass_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*fodhelper.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `fodhelper_uac_bypass_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited to no false positives are expected.
 references:
@@ -42,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious registry keys added by process fodhelper.exe with a parent_process of $parent_process_name$ that has been executed on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml
index 1bca79d4fb8..7746165627c 100644
--- a/detections/endpoint/fsutil_zeroing_file.yml
+++ b/detections/endpoint/fsutil_zeroing_file.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=fsutil.exe Processes.process="*setzerodata*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `fsutil_zeroing_file_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*fsutil.exe" Processes.process="*setzerodata*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `fsutil_zeroing_file_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible file data deletion on $dest$ using $process$
     entity:
diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
index 94aabd68e79..7277458cd3f 100644
--- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
+++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
@@ -6,44 +6,20 @@ modification_date: '2026-10-02'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
-description: |-
-    The following analytic detects the execution of `powershell.exe` running the `Get-ADDefaultDomainPasswordPolicy` cmdlet, which is used to retrieve the password policy in a Windows domain.
+description: 'The following analytic detects the execution of `powershell.exe` running the `Get-ADDefaultDomainPasswordPolicy` cmdlet, which is used to retrieve the password policy in a Windows domain.
+
     This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions.
+
     Monitoring this activity is crucial as it can indicate attempts by adversaries to gather information about domain policies for situational awareness and Active Directory discovery.
-    If confirmed malicious, this activity could lead to further reconnaissance and potential exploitation of domain security settings.
+
+    If confirmed malicious, this activity could lead to further reconnaissance and potential exploitation of domain security settings.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    (
-        `process_powershell`
-        OR
-        `process_cmd`
-    )
-    Processes.process = "*Get-ADDefaultDomainPasswordPolicy*"
-
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `get_addefaultdomainpasswordpolicy_with_powershell_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe", "*cmd.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE", "Cmd.Exe") Processes.process="*Get-ADDefaultDomainPasswordPolicy*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_addefaultdomainpasswordpolicy_with_powershell_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
     - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
index e939a6d9f62..33fea0bacac 100644
--- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects the execution of the `Get-ADDefaultDomainPasswordPolicy` PowerShell cmdlet, which is used to retrieve the password policy in a Windows domain. This detection leverages PowerShell Script Block Logging (EventCode=4104) to identify the specific command execution. Monitoring this activity is significant as it can indicate an attempt to gather domain policy information, which is often a precursor to further malicious actions. If confirmed malicious, this activity could allow an attacker to understand password policies, aiding in password attacks or further domain enumeration.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText ="*Get-ADDefaultDomainPasswordPolicy*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-ADDefaultDomainPasswordPolicy*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`
 how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml
index 0fd84d5b523..45771a8f41d 100644
--- a/detections/endpoint/get_aduser_with_powershell.yml
+++ b/detections/endpoint/get_aduser_with_powershell.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="cmd.exe"
-            OR
-            Processes.process_name="powershell*"
-        )
-        AND Processes.process = "*Get-ADUser*" AND Processes.process = "*-filter*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `get_aduser_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*cmd.exe" OR Processes.process_path="powershell*" Processes.process="*Get-ADUser*" Processes.process="*-filter*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml
index 7d47e8dcceb..15f38025eab 100644
--- a/detections/endpoint/get_aduser_with_powershell_script_block.yml
+++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects the execution of the `Get-AdUser` PowerShell cmdlet, which is used to enumerate all domain users. It leverages PowerShell Script Block Logging (EventCode=4104) to identify instances where this command is executed with a filter. This activity is significant as it may indicate an attempt by adversaries or Red Teams to gather information about domain users for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could lead to further reconnaissance and potential exploitation of user accounts within the domain.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*get-aduser*" ScriptBlockText = "*-filter*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `get_aduser_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*get-aduser*" Processes.process="*-filter*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_script_block_filter`
 how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
index 02afab78c80..ce59e885a1a 100644
--- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
+++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="cmd.exe"
-            OR
-            Processes.process_name="powershell*"
-        )
-        AND Processes.process = "*Get-ADUserResultantPasswordPolicy*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `get_aduserresultantpasswordpolicy_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*cmd.exe" OR Processes.process_path="powershell*" Processes.process="*Get-ADUserResultantPasswordPolicy*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduserresultantpasswordpolicy_with_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -44,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: an instance of process $process_name$ with commandline $process$ on $dest$
     entity:
diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
index ad260f1c78e..38e0d66abd5 100644
--- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Get-ADUserResultantPasswordPolicy` PowerShell cmdlet, which is used to obtain the password policy in a Windows domain. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this activity. Monitoring this behavior is significant as it may indicate an attempt to enumerate domain policies, a common tactic used by adversaries for situational awareness and Active Directory discovery. If confirmed malicious, this activity could allow attackers to understand password policies, aiding in further attacks such as password guessing or policy exploitation.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText="*Get-ADUserResultantPasswordPolicy*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-ADUserResultantPasswordPolicy*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`
 how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: powershell process having commandline to query domain user password policy detected on host - $dest$.
     entity:
diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml
index 6a4263494ec..62d60aa4398 100644
--- a/detections/endpoint/get_domainpolicy_with_powershell.yml
+++ b/detections/endpoint/get_domainpolicy_with_powershell.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="cmd.exe"
-            OR
-            Processes.process_name="powershell*"
-        )
-        AND Processes.process = "*Get-DomainPolicy*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `get_domainpolicy_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*cmd.exe" OR Processes.process_path="powershell*" Processes.process="*Get-DomainPolicy*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -45,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: an instance of process $process_name$ with commandline $process$ on $dest$
     entity:
diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
index f3b7fb44c8c..ff33a116e06 100644
--- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Get-DomainPolicy` cmdlet using PowerShell Script Block Logging (EventCode=4104). It leverages logs capturing script block text to identify attempts to obtain the password policy in a Windows domain. This activity is significant as it indicates potential reconnaissance efforts by adversaries or Red Teams to gather domain policy information, which is crucial for planning further attacks. If confirmed malicious, this behavior could lead to detailed knowledge of domain security settings, aiding in privilege escalation or lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText ="*Get-DomainPolicy*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `get_domainpolicy_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-DomainPolicy*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`
 how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Powershell process indicative of querying domain policy, spawned by $user_id$ on $dest$
     entity:
diff --git a/detections/endpoint/get_domaintrust_with_powershell.yml b/detections/endpoint/get_domaintrust_with_powershell.yml
index f74ffdc7a44..f7ddfde4670 100644
--- a/detections/endpoint/get_domaintrust_with_powershell.yml
+++ b/detections/endpoint/get_domaintrust_with_powershell.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process=*get-domaintrust*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `get_domaintrust_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*get-domaintrust*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious PowerShell Get-DomainTrust was identified on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
index 275bc882383..61250ecc0d5 100644
--- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the Get-DomainTrust command from PowerView using PowerShell Script Block Logging (EventCode=4104). This method captures the full command sent to PowerShell, allowing for detailed inspection. Identifying this activity is significant because it may indicate an attempt to gather domain trust information, which is often a precursor to lateral movement or privilege escalation. If confirmed malicious, this activity could enable an attacker to map trust relationships within the domain, potentially leading to further exploitation and compromise of additional systems.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*get-domaintrust*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `get_domaintrust_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*get-domaintrust*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: It is possible certain system management frameworks utilize this command to gather trust information.
 references:
@@ -37,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_id$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious PowerShell Get-DomainTrust was identified on endpoint $dest$ by user $user_id$.
     entity:
diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml
index 88ec1582dff..b0c8b7fbbd2 100644
--- a/detections/endpoint/get_domainuser_with_powershell.yml
+++ b/detections/endpoint/get_domainuser_with_powershell.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="cmd.exe"
-            OR
-            Processes.process_name="powershell*"
-        )
-        AND Processes.process = "*Get-DomainUser*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `get_domainuser_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*cmd.exe" OR Processes.process_path="powershell*" Processes.process="*Get-DomainUser*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -43,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: an instance of process $process_name$ with commandline $process$ on $dest$
     entity:
diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml
index 0ba9527563f..c2ba31fc0fc 100644
--- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Get-DomainUser` cmdlet using PowerShell Script Block Logging (EventCode=4104). This cmdlet is part of PowerView, a tool often used for domain enumeration. The detection leverages PowerShell operational logs to identify instances where this command is executed. Monitoring this activity is crucial as it may indicate an adversary's attempt to gather information about domain users, which is a common step in Active Directory Discovery. If confirmed malicious, this activity could lead to further reconnaissance and potential exploitation of domain resources.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*Get-DomainUser*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `get_domainuser_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-DomainUser*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`
 how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Powershell process having commandline "*Get-DomainUser*" for user enumeration on $dest$
     entity:
diff --git a/detections/endpoint/get_foresttrust_with_powershell.yml b/detections/endpoint/get_foresttrust_with_powershell.yml
index e64ae44fd8a..f540a5d1fc5 100644
--- a/detections/endpoint/get_foresttrust_with_powershell.yml
+++ b/detections/endpoint/get_foresttrust_with_powershell.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=powershell.exe
-        OR
-        Processes.process_name=cmd.exe Processes.process=*get-foresttrust*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `get_foresttrust_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.process_name="*cmd.exe" Processes.process="*get-foresttrust*") OR Processes.process_name="*powershell.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute.
 references:
@@ -40,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious PowerShell Get-ForestTrust was identified on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
index 054411f48cb..67ab225e0f7 100644
--- a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the Get-ForestTrust command from PowerSploit using PowerShell Script Block Logging (EventCode=4104). This method captures the full command sent to PowerShell, providing detailed visibility into potentially suspicious activities. Monitoring this behavior is crucial as it can indicate an attempt to gather domain trust information, which is often a precursor to lateral movement or privilege escalation. If confirmed malicious, this activity could allow an attacker to map trust relationships within the domain, facilitating further exploitation and access to sensitive resources.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*get-foresttrust*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `get_foresttrust_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*get-foresttrust*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: False positives may be present. Tune as needed.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_id$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious PowerShell Get-ForestTrust was identified on endpoint $dest$ by user $user_id$.
     entity:
diff --git a/detections/endpoint/get_wmiobject_group_discovery.yml b/detections/endpoint/get_wmiobject_group_discovery.yml
index 4598e7afaac..af90fddb163 100644
--- a/detections/endpoint/get_wmiobject_group_discovery.yml
+++ b/detections/endpoint/get_wmiobject_group_discovery.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=powershell.exe
-            OR
-            processes.process_name=cmd.exe
-        )
-        (Processes.process="*Get-WMIObject*" AND Processes.process="*Win32_Group*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `get_wmiobject_group_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*powershell.exe", "*cmd.exe") Processes.process="*Get-WMIObject*" Processes.process="*Win32_Group*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_wmiobject_group_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present. Tune as needed.
 references:
diff --git a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml
index 06687a5f053..f43b8b10053 100644
--- a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml
+++ b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects the execution of the `Get-WMIObject Win32_Group` command using PowerShell Script Block Logging (EventCode=4104). This method captures the full command sent to PowerShell, allowing for detailed analysis. Identifying group information on an endpoint is not inherently malicious but can be suspicious based on context such as time, endpoint, and user. This activity is significant as it may indicate reconnaissance efforts by an attacker. If confirmed malicious, it could lead to further enumeration and potential lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*Get-WMIObject*" AND ScriptBlockText = "*Win32_Group*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `get_wmiobject_group_discovery_with_script_block_logging_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-WMIObject*" Processes.process="*Win32_Group*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_wmiobject_group_discovery_with_script_block_logging_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: False positives may be present. Tune as needed.
 references:
diff --git a/detections/endpoint/getadcomputer_with_powershell.yml b/detections/endpoint/getadcomputer_with_powershell.yml
index ba844ea201a..19ee861b632 100644
--- a/detections/endpoint/getadcomputer_with_powershell.yml
+++ b/detections/endpoint/getadcomputer_with_powershell.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="powershell.exe"
-        )
-        (Processes.process=*Get-AdComputer*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `getadcomputer_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*powershell.exe" Processes.process="*Get-AdComputer*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getadcomputer_with_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/getadcomputer_with_powershell_script_block.yml b/detections/endpoint/getadcomputer_with_powershell_script_block.yml
index 4c45f3b0557..2b2cc6aa7ca 100644
--- a/detections/endpoint/getadcomputer_with_powershell_script_block.yml
+++ b/detections/endpoint/getadcomputer_with_powershell_script_block.yml
@@ -9,17 +9,8 @@ type: Hunting
 description: The following analytic detects the execution of the `Get-AdComputer` PowerShell commandlet using PowerShell Script Block Logging (EventCode=4104). This detection leverages script block text to identify when this commandlet is run. The `Get-AdComputer` commandlet is significant as it can be used by adversaries to enumerate all domain computers, aiding in situational awareness and Active Directory discovery. If confirmed malicious, this activity could allow attackers to map the network, identify targets, and plan further attacks, potentially leading to unauthorized access and data exfiltration.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText = "*Get-AdComputer*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `getadcomputer_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-AdComputer*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getadcomputer_with_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
 references:
diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml
index c1bbefd3b0f..d70beb70d23 100644
--- a/detections/endpoint/getadgroup_with_powershell.yml
+++ b/detections/endpoint/getadgroup_with_powershell.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="powershell.exe"
-        )
-        (Processes.process=*Get-AdGroup*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `getadgroup_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*powershell.exe" Processes.process="*Get-AdGroup*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getadgroup_with_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml
index 6e962e28926..119726cdb13 100644
--- a/detections/endpoint/getadgroup_with_powershell_script_block.yml
+++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects the execution of the `Get-AdGroup` PowerShell cmdlet using PowerShell Script Block Logging (EventCode=4104). This cmdlet is used to enumerate all domain groups, which adversaries may exploit for situational awareness and Active Directory discovery. Monitoring this activity is crucial as it can indicate reconnaissance efforts within the network. If confirmed malicious, this behavior could lead to further exploitation, such as privilege escalation or lateral movement, by providing attackers with detailed information about the domain's group structure.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*Get-ADGroup*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `getadgroup_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-ADGroup*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getadgroup_with_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
 references:
diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml
index 4920d258f43..c029e761a7c 100644
--- a/detections/endpoint/getcurrent_user_with_powershell.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell.yml
@@ -11,7 +11,7 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
       WHERE (
             Processes.process_name="powershell.exe"
diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
index a1f4716abcc..df82fe48d67 100644
--- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects the execution of the `GetCurrent` method from the WindowsIdentity .NET class using PowerShell Script Block Logging (EventCode=4104). This method identifies the current Windows user. The detection leverages PowerShell script block logs to identify when this method is called. This activity is significant because adversaries and Red Teams may use it to gain situational awareness and perform Active Directory discovery on compromised endpoints. If confirmed malicious, this could allow attackers to map out user accounts and potentially escalate privileges or move laterally within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*[System.Security.Principal.WindowsIdentity]*"  ScriptBlockText = "*GetCurrent()*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `getcurrent_user_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*[System.Security.Principal.WindowsIdentity]*" Processes.process="*GetCurrent()*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getcurrent_user_with_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
 references:
diff --git a/detections/endpoint/getdomaincomputer_with_powershell.yml b/detections/endpoint/getdomaincomputer_with_powershell.yml
index e43c9f03201..6685f0800da 100644
--- a/detections/endpoint/getdomaincomputer_with_powershell.yml
+++ b/detections/endpoint/getdomaincomputer_with_powershell.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="powershell.exe"
-        )
-        (Processes.process=*Get-DomainComputer*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `getdomaincomputer_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*powershell.exe" Processes.process="*Get-DomainComputer*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaincomputer_with_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use PowerView for troubleshooting.
 references:
@@ -40,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Remote system discovery enumeration on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
index 534c7d38bc3..c3272219ccd 100644
--- a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Get-DomainComputer` commandlet using PowerShell Script Block Logging (EventCode=4104). This commandlet is part of PowerView, a tool often used for enumerating domain computers within Windows environments. The detection leverages script block text analysis to identify this specific command. Monitoring this activity is crucial as it can indicate an adversary's attempt to gather information about domain computers, which is a common step in Active Directory reconnaissance. If confirmed malicious, this activity could lead to further network enumeration and potential lateral movement within the domain.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `getdomaincomputer_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-DomainComputer*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaincomputer_with_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use PowerView for troubleshooting.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Remote system discovery with PowerView on $dest$ by $user_id$
     entity:
diff --git a/detections/endpoint/getdomaincontroller_with_powershell.yml b/detections/endpoint/getdomaincontroller_with_powershell.yml
index 47c45c98fcf..44190d4a491 100644
--- a/detections/endpoint/getdomaincontroller_with_powershell.yml
+++ b/detections/endpoint/getdomaincontroller_with_powershell.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="powershell.exe"
-        )
-        (Processes.process=*Get-DomainController*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `getdomaincontroller_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*powershell.exe" Processes.process="*Get-DomainController*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaincontroller_with_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use PowerView for troubleshooting.
 references:
diff --git a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
index c2d26e41fc6..c2c2f679073 100644
--- a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Get-DomainController` commandlet using PowerShell Script Block Logging (EventCode=4104). This commandlet is part of PowerView, a tool often used for domain enumeration. The detection leverages script block text to identify this specific activity. Monitoring this behavior is crucial as it may indicate an adversary or Red Team performing reconnaissance to map out domain controllers. If confirmed malicious, this activity could lead to further domain enumeration, potentially exposing sensitive information and aiding in lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainController*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `getdomaincontroller_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-DomainController*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaincontroller_with_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
 references:
@@ -33,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Remote system discovery with PowerView on $dest$ by $user_id$
     entity:
diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml
index 4a0f23382c7..45dd05ee236 100644
--- a/detections/endpoint/getdomaingroup_with_powershell.yml
+++ b/detections/endpoint/getdomaingroup_with_powershell.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="powershell.exe"
-        )
-        (Processes.process=*Get-DomainGroup*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `getdomaingroup_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*powershell.exe" Processes.process="*Get-DomainGroup*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaingroup_with_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -42,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Domain group discovery with PowerView on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml
index a02305e9030..067a2052f7c 100644
--- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Get-DomainGroup` cmdlet using PowerShell Script Block Logging (EventCode=4104). This cmdlet, part of the PowerView tool, is used to enumerate domain groups within a Windows domain. The detection leverages script block text to identify this specific command. Monitoring this activity is crucial as it may indicate an adversary or Red Team performing reconnaissance to gain situational awareness and map out Active Directory structures. If confirmed malicious, this activity could lead to further exploitation, including privilege escalation and lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainGroup*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `getdomaingroup_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-DomainGroup*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaingroup_with_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use this PowerView functions for troubleshooting.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Domain group discovery enumeration using PowerView on $dest$ by $user_id$
     entity:
diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml
index e5b1606c69e..bcb8b828918 100644
--- a/detections/endpoint/getlocaluser_with_powershell.yml
+++ b/detections/endpoint/getlocaluser_with_powershell.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="powershell.exe"
-        )
-        (Processes.process=*Get-LocalUser*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `getlocaluser_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*powershell.exe" Processes.process="*Get-LocalUser*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getlocaluser_with_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
 references:
diff --git a/detections/endpoint/getlocaluser_with_powershell_script_block.yml b/detections/endpoint/getlocaluser_with_powershell_script_block.yml
index 4cf6056d473..b47ce229157 100644
--- a/detections/endpoint/getlocaluser_with_powershell_script_block.yml
+++ b/detections/endpoint/getlocaluser_with_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects the execution of the `Get-LocalUser` PowerShell commandlet using PowerShell Script Block Logging (EventCode=4104). This commandlet lists all local users on a system. The detection leverages script block text from PowerShell logs to identify this activity. Monitoring this behavior is significant as adversaries and Red Teams may use it to enumerate local users for situational awareness and Active Directory discovery. If confirmed malicious, this activity could lead to further reconnaissance, enabling attackers to identify potential targets for privilege escalation or lateral movement.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText = "*Get-LocalUser*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `getlocaluser_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-LocalUser*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getlocaluser_with_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
 references:
diff --git a/detections/endpoint/getnettcpconnection_with_powershell.yml b/detections/endpoint/getnettcpconnection_with_powershell.yml
index afa39b9f2d7..35a67e8c184 100644
--- a/detections/endpoint/getnettcpconnection_with_powershell.yml
+++ b/detections/endpoint/getnettcpconnection_with_powershell.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="powershell.exe"
-        )
-        (Processes.process=*Get-NetTcpConnection*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `getnettcpconnection_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*powershell.exe" Processes.process="*Get-NetTcpConnection*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getnettcpconnection_with_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
index ac128fbdb8c..aa6b5a4a5a2 100644
--- a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
+++ b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects the execution of the `Get-NetTcpconnection` PowerShell cmdlet using PowerShell Script Block Logging (EventCode=4104). This cmdlet lists network connections on a system, which adversaries may use for situational awareness and Active Directory discovery. Monitoring this activity is crucial as it can indicate reconnaissance efforts by an attacker. If confirmed malicious, this behavior could allow an attacker to map the network, identify critical systems, and plan further attacks, potentially leading to data exfiltration or lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText = "*Get-NetTcpconnection*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `getnettcpconnection_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-NetTcpconnection*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getnettcpconnection_with_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
 references:
diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml
index fa061c119e2..a29553ee8e1 100644
--- a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml
@@ -6,52 +6,21 @@ modification_date: '2026-10-02'
 author: Mauricio Velazco, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet to discover remote systems, specifically targeting the `DS_Computer` parameter.
+description: 'The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet to discover remote systems, specifically targeting the `DS_Computer` parameter.
+
     This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions.
+
     This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate domain computers and gather situational awareness within Active Directory.
-    If confirmed malicious, this behavior could allow attackers to map the network, identify critical systems, and plan further attacks, potentially leading to unauthorized access and data exfiltration.
+
+    If confirmed malicious, this behavior could allow attackers to map the network, identify critical systems, and plan further attacks, potentially leading to unauthorized access and data exfiltration.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    (
-        `process_powershell`
-        OR
-        `process_cmd`
-    )
-    AND
-    Processes.process = "*Get-WmiObject*"
-    Processes.process = "*namespace *"
-    Processes.process = "*root\\directory\\ldap*"
-    Processes.process = "*class *"
-    Processes.process = "* ds_computer*"
-
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `getwmiobject_ds_computer_with_powershell_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Administrators or power users may use this command for troubleshooting.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe", "*cmd.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE", "Cmd.Exe") Processes.process="*Get-WmiObject*" Processes.process="*namespace *" Processes.process="*root\\directory\\ldap*" Processes.process="*class *" Processes.process="* ds_computer*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_computer_with_powershell_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
     - https://attack.mitre.org/techniques/T1018/
     - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L383
@@ -63,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
index e0baf84ff0c..c19f2a48c2e 100644
--- a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Get-WmiObject` cmdlet with the `DS_Computer` class parameter via PowerShell Script Block Logging (EventCode=4104). This detection leverages script block text to identify queries targeting domain computers using WMI. Monitoring this activity is crucial as adversaries and Red Teams may use it for Active Directory Discovery and situational awareness. If confirmed malicious, this behavior could allow attackers to map out domain computers, facilitating further attacks such as lateral movement or privilege escalation.
 data_source:
     - Powershell Script Block Logging 4104
-search: '`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace root\\directory\\ldap*" AND ScriptBlockText="*class ds_computer*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-WmiObject*" Processes.process="*namespace root\\directory\\ldap*" Processes.process="*class ds_computer*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Remote system discovery enumeration on $dest$ by $user_id$
     entity:
diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml
index 39117732f69..14ca509c436 100644
--- a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml
@@ -6,52 +6,21 @@ modification_date: '2026-05-13'
 author: Mauricio Velazco, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies the execution of `powershell.exe` with command-line arguments used to query domain groups via the `Get-WmiObject` cmdlet and the `-class ds_group` parameter.
+description: 'The following analytic identifies the execution of `powershell.exe` with command-line arguments used to query domain groups via the `Get-WmiObject` cmdlet and the `-class ds_group` parameter.
+
     This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions.
+
     This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate domain groups, which is a common step in Active Directory Discovery.
-    If confirmed malicious, this could allow attackers to gain insights into the domain structure, aiding in further attacks and privilege escalation.
+
+    If confirmed malicious, this could allow attackers to gain insights into the domain structure, aiding in further attacks and privilege escalation.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    (
-        `process_powershell`
-        OR
-        `process_cmd`
-    )
-    AND
-    Processes.process = "*Get-WmiObject*"
-    Processes.process = "*namespace *"
-    Processes.process = "* root\\directory\\ldap*"
-    Processes.process = "* ds_group*"
-    Processes.process = "*class *"
-
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `getwmiobject_ds_group_with_powershell_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Administrators or power users may use this command for troubleshooting.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe", "*cmd.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE", "Cmd.Exe") Processes.process="*Get-WmiObject*" Processes.process="*namespace *" Processes.process="* root\\directory\\ldap*" Processes.process="* ds_group*" Processes.process="*class *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_group_with_powershell_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
     - https://attack.mitre.org/techniques/T1069/002/
     - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1
@@ -63,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
index 8e1f4ac5e66..71a0e81d988 100644
--- a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Get-WmiObject` commandlet with the `DS_Group` parameter via PowerShell Script Block Logging (EventCode=4104). This method leverages WMI to query all domain groups. Monitoring this activity is crucial as adversaries and Red Teams may use it for domain group enumeration, aiding in situational awareness and Active Directory discovery. If confirmed malicious, this activity could allow attackers to map out the domain structure, potentially leading to further exploitation and privilege escalation within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: '`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace root\\directory\\ldap*" AND ScriptBlockText="*class ds_group*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`getwmiobject_ds_group_with_powershell_script_block_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-WmiObject*" Processes.process="*namespace root\\directory\\ldap*" Processes.process="*class ds_group*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_group_with_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Domain group discovery enumeration using PowerShell on $dest$ by $user_id$
     entity:
diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml
index 0301eb561bf..7227d361781 100644
--- a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml
@@ -6,51 +6,21 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the execution of `powershell.exe` with command-line arguments used to query domain users via the `Get-WmiObject` cmdlet and `-class ds_user` parameter.
+description: 'The following analytic detects the execution of `powershell.exe` with command-line arguments used to query domain users via the `Get-WmiObject` cmdlet and `-class ds_user` parameter.
+
     This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions.
+
     This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate domain users, which is a common step in Active Directory Discovery.
-    If confirmed malicious, this could lead to further attacks, including privilege escalation and lateral movement within the network.
+
+    If confirmed malicious, this could lead to further attacks, including privilege escalation and lateral movement within the network.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    (
-        `process_powershell`
-        OR
-        `process_cmd`
-    )
-    AND
-    Processes.process = "*get-wmiobject*"
-    Processes.process = "*ds_user*"
-    Processes.process = "*root\\directory\\ldap*"
-    Processes.process = "*-namespace*"
-
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `getwmiobject_ds_user_with_powershell_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Administrators or power users may use this command for troubleshooting.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe", "*cmd.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE", "Cmd.Exe") Processes.process="*get-wmiobject*" Processes.process="*ds_user*" Processes.process="*root\\directory\\ldap*" Processes.process="*-namespace*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
     - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
 drilldown_searches:
@@ -61,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml
index e93a5c46e76..7691f2df3b2 100644
--- a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Get-WmiObject` cmdlet with the `DS_User` class parameter via PowerShell Script Block Logging (EventCode=4104). It leverages logs to identify attempts to query all domain users using WMI. This activity is significant as it may indicate an adversary or Red Team operation attempting to enumerate domain users for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could lead to further reconnaissance, enabling attackers to map out the network and identify potential targets for privilege escalation or lateral movement.
 data_source:
     - Powershell Script Block Logging 4104
-search: '`powershell` EventCode=4104 ScriptBlockText = "*get-wmiobject*" ScriptBlockText = "*ds_user*" ScriptBlockText = "*-namespace*" ScriptBlockText = "*root\\directory\\ldap*" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*get-wmiobject*" Processes.process="*ds_user*" Processes.process="*-namespace*" Processes.process="*root\\directory\\ldap*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`
 how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: powershell process having commandline for user enumeration detected on host - $dest$
     entity:
diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml
index a6243a49d46..bb1a69dfe39 100644
--- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="powershell.exe"
-        )
-        (Processes.process=*Get-WmiObject* AND Processes.process=*Win32_UserAccount*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `getwmiobject_user_account_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*powershell.exe" Processes.process="*Get-WmiObject*" Processes.process="*Win32_UserAccount*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_user_account_with_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
 references:
diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
index 425c80f8c99..2689e2f0ec8 100644
--- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects the execution of the `Get-WmiObject` commandlet with the `Win32_UserAccount` parameter via PowerShell Script Block Logging (EventCode=4104). This method leverages script block text to identify when a list of all local users is being enumerated. This activity is significant as it may indicate an adversary or Red Team operation attempting to gather user information for situational awareness and Active Directory discovery. If confirmed malicious, this could lead to further reconnaissance, privilege escalation, or lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText="*Get-WmiObject*" AND ScriptBlockText="*Win32_UserAccount*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `getwmiobject_user_account_with_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-WmiObject*" Processes.process="*Win32_UserAccount*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_user_account_with_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
 references:
diff --git a/detections/endpoint/github_workflow_file_creation_or_modification.yml b/detections/endpoint/github_workflow_file_creation_or_modification.yml
index 86e592e2887..d53fe4ddcb8 100644
--- a/detections/endpoint/github_workflow_file_creation_or_modification.yml
+++ b/detections/endpoint/github_workflow_file_creation_or_modification.yml
@@ -6,46 +6,36 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: Hunting
-description: |
-    The following analytic hunts for any creations or modifications to GitHub Actions workflow YAML files across the organization's Linux or Windows endpoints.
+description: 'The following analytic hunts for any creations or modifications to GitHub Actions workflow YAML files across the organization''s Linux or Windows endpoints.
+
     This hunting query tracks all workflow file activity under .github/workflows directories to help defenders establish baselines of legitimate CI/CD workflow creation patterns, identify unusual or unauthorized changes, and detect anomalies that may indicate supply chain compromise.
+
     GitHub Actions workflows execute with privileged access to secrets and deployment credentials, making them high-value targets for attackers.
-    By monitoring workflow file modifications over time, defenders can identify suspicious patterns such as unexpected workflow creation on developer workstations, modifications outside normal change windows, or activity in repositories that don't typically contain workflows.
-    This data is essential for detecting supply chain attacks like Shai-Hulud that inject malicious workflows across multiple repositories.
+
+    By monitoring workflow file modifications over time, defenders can identify suspicious patterns such as unexpected workflow creation on developer workstations, modifications outside normal change windows, or activity in repositories that don''t typically contain workflows.
+
+    This data is essential for detecting supply chain attacks like Shai-Hulud that inject malicious workflows across multiple repositories.'
 data_source:
     - Sysmon for Linux EventID 11
     - Sysmon EventID 11
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.file_path IN (
-      "*/.github/workflows/*.yaml",
-      "*/.github/workflows/*.yml",
-      "*\\.github\\workflows\\*.yaml",
-      "*\\.github\\workflows\\*.yml"
-    )
-
-    by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
-       Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user
-       Filesystem.vendor_product
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("/.github/workflows/*.yaml", "/.github/workflows/*.yml", "\\.github\\workflows\*.yaml", "\\.github\\workflows\*.yml") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_workflow_file_creation_or_modification_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `github_workflow_file_creation_or_modification_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain filesystem events, specifically file creation
+
     events. These logs must be processed using the appropriate Splunk Technology Add-ons
+
     that are specific to the EDR product. The logs must also be mapped to the `Filesystem`
+
     node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM)
-    to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    Legitimate engineering activity regularly creates workflow YAMLs. Suppress by repository path allowlisting, CI hosts, change windows, or approval timeframes.
+
+    to normalize the field names and speed up the data modeling process.'
+known_false_positives: Legitimate engineering activity regularly creates workflow YAMLs. Suppress by repository path allowlisting, CI hosts, change windows, or approval timeframes.
 references:
     - https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem
     - https://securelist.com/shai-hulud-worm-infects-500-npm-packages-in-a-supply-chain-attack/117547/
diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
index 7b64e7b08ff..f94ae7e04fa 100644
--- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
+++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the execution of gpupdate.exe without command line arguments and with an active network connection. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process execution and network traffic data. It is significant because gpupdate.exe typically runs with specific arguments, and its execution without them, especially with network activity, is often associated with malicious software like Cobalt Strike. If confirmed malicious, this activity could indicate an attacker leveraging gpupdate.exe for lateral movement, command and control, or other nefarious purposes, potentially leading to system compromise.
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 3
-search: |-
+search: |
     | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
       WHERE Processes.process_name=gpupdate.exe
       BY Processes.action Processes.dest Processes.original_file_name
@@ -45,7 +45,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Process gpupdate.exe with parent_process $parent_process_name$ is executed on $dest$ by user $user$, followed by an outbound network connection on port $dest_port$. This behaviour is seen with cobaltstrike.
     entity:
diff --git a/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml b/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml
index b7d6980fed5..1560ee8da91 100644
--- a/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml
+++ b/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml
@@ -11,28 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process="*--headless*"
-            AND
-            Processes.process="*--disable-gpu*"
-            AND
-            (Processes.process="*mockbin.org/*"
-            OR
-            Processes.process="*mocky.io/*")
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `headless_browser_mockbin_or_mocky_request_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*--headless*" Processes.process="*--disable-gpu*" Processes.process IN ("*mockbin.org/*", "*mocky.io/*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `headless_browser_mockbin_or_mocky_request_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives are not expected with this detection, unless within the organization there is a legitimate need for headless browsing accessing mockbin.org or mocky.io.
 references:
@@ -46,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Headless browser activity accessing mockbin.org or mocky.io detected on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/headless_browser_usage.yml b/detections/endpoint/headless_browser_usage.yml
index d0bf2168625..a66cbf7eaf7 100644
--- a/detections/endpoint/headless_browser_usage.yml
+++ b/detections/endpoint/headless_browser_usage.yml
@@ -11,9 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe") (Processes.process="*--headless*" AND Processes.process="*--disable-gpu*")
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `headless_browser_usage_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*Chrome.exe", "*Brave.exe", "*Opera.exe", "*Vivaldi.exe", "*msedge.exe") Processes.process="*--headless*" Processes.process="*--disable-gpu*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `headless_browser_usage_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Administrators may enable or disable this feature for framework testing that may cause some false positive.
 references:
@@ -27,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml
index fb5e81bbf2f..c6b590cb776 100644
--- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml
+++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a suspicious registry modification that hides a user account from the Windows Login screen. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" with a value of "0x00000000". This activity is significant as it may indicate an adversary attempting to create a hidden admin account to avoid detection and maintain persistence on the compromised machine. If confirmed malicious, this could allow the attacker to maintain undetected access and control over the system, posing a severe security risk.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data = "0x00000000") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `hide_user_account_from_sign_in_screen_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `hide_user_account_from_sign_in_screen_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious registry modification ($registry_value_name$) which is used go hide a user account on the Windows Login screen detected on $dest$ executed by $user$
     entity:
diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
index b23955db43d..962f5408fb2 100644
--- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
+++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=attrib.exe (Processes.process=*+h*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `hiding_files_and_directories_with_attrib_exe_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*attrib.exe" Processes.process="*+h*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `hiding_files_and_directories_with_attrib_exe_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some applications and users may legitimately use attrib.exe to interact with the files.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected.
     entity:
diff --git a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml
index 70fbfb414aa..e0ca6ee227b 100644
--- a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml
+++ b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml
@@ -6,14 +6,16 @@ modification_date: '2026-08-05'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects a high frequency of file copying or moving within network shares, which may indicate potential data sabotage or exfiltration attempts.
+description: 'The following analytic detects a high frequency of file copying or moving within network shares, which may indicate potential data sabotage or exfiltration attempts.
+
     It leverages Windows Security Event Logs (EventCode 5145) to monitor access to specific file types and network shares.
+
     This activity is significant as it can reveal insider threats attempting to transfer classified or internal files, potentially leading to data breaches or evidence tampering.
-    If confirmed malicious, this behavior could result in unauthorized data access, data loss, or compromised sensitive information.
+
+    If confirmed malicious, this behavior could result in unauthorized data access, data loss, or compromised sensitive information.'
 data_source:
     - Windows Event Log Security 5145
-search: |-
+search: |
     `wineventlog_security`
     EventCode=5145
     RelativeTargetName IN (
@@ -77,10 +79,8 @@ search: |-
     )
     | where isOutlier=1
     | `high_frequency_copy_of_files_in_network_share_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
-known_false_positives: |-
-    This behavior may be seen in normal transfer of files within a network if network shares are commonly used for sharing documents.
+how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
+known_false_positives: This behavior may be seen in normal transfer of files within a network if network shares are commonly used for sharing documents.
 references:
     - https://attack.mitre.org/techniques/T1537/
     - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5145#table-of-file-access-codes
@@ -92,7 +92,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src_user
diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml
index d45a5033e29..b54fad10d85 100644
--- a/detections/endpoint/high_process_termination_frequency.yml
+++ b/detections/endpoint/high_process_termination_frequency.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a high frequency of process termination events on a computer within a short period. It leverages Sysmon EventCode 5 logs to detect instances where 15 or more processes are terminated within a 3-second window. This behavior is significant as it is commonly associated with ransomware attempting to avoid exceptions during file encryption. If confirmed malicious, this activity could indicate an active ransomware attack, potentially leading to widespread file encryption and significant data loss.
 data_source:
     - Sysmon EventID 5
-search: |-
+search: |
     `sysmon` EventCode=5
       | bin _time span=3s
       | stats values(process) as process values(process_exec) as process_exec values(process_guid) as process_guid values(process_id) as process_id values(process_name) as process_name values(process_path) as process_path values(user_id) as user_id min(_time) as firstTime max(_time) as lastTime count
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/hunting_3cxdesktopapp_software.yml b/detections/endpoint/hunting_3cxdesktopapp_software.yml
index 8638d5e1de2..7c189502e1c 100644
--- a/detections/endpoint/hunting_3cxdesktopapp_software.yml
+++ b/detections/endpoint/hunting_3cxdesktopapp_software.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=3CXDesktopApp.exe
-        OR
-        Processes.process_name="3CX Desktop App"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `hunting_3cxdesktopapp_software_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*3CXDesktopApp.exe", "*3CX Desktop App") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `hunting_3cxdesktopapp_software_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: There may be false positives generated due to the reliance on version numbers for identification purposes. Despite this limitation, the primary goal of this approach is to aid in the detection of the software within the environment.
 references:
diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml
index 034bbb883c3..776ddad1052 100644
--- a/detections/endpoint/icacls_deny_command.yml
+++ b/detections/endpoint/icacls_deny_command.yml
@@ -6,56 +6,36 @@ modification_date: '2026-09-01'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects instances where an adversary modifies security permissions of a file or directory using commands like "icacls.exe", "cacls.exe", or "xcacls.exe" with deny options.
+description: 'The following analytic detects instances where an adversary modifies security permissions of a file or directory using commands like "icacls.exe", "cacls.exe", or "xcacls.exe" with deny options.
+
     It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions.
+
     This activity is significant as it is commonly used by Advanced Persistent Threats (APTs) and coinminer scripts to evade detection and impede access to critical files.
-    If confirmed malicious, this could allow attackers to maintain persistence and hinder incident response efforts.
+
+    If confirmed malicious, this could allow attackers to maintain persistence and hinder incident response efforts.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    From datamodel=Endpoint.Processes Where
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*icacls.exe", "*cacls.exe", "*xcacls.exe") Processes.process IN ("*/deny*", "*/d:*", "*/d *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `icacls_deny_command_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-    Processes.process_name IN (
-        "icacls.exe",
-        "cacls.exe",
-        "xcacls.exe"
-    )
-    Processes.process IN (
-        "*/deny*",
-        "*/d:*",
-        "*/d *"
-    )
-
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path
-       Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `icacls_deny_command_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
+
+    names and speed up the data modeling process.'
 known_false_positives: No false positives have been identified at this time. Filter as needed.
 references:
     - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -67,7 +47,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml
index 8cc6632ef11..7396b00609c 100644
--- a/detections/endpoint/icacls_grant_command.yml
+++ b/detections/endpoint/icacls_grant_command.yml
@@ -6,43 +6,44 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the use of the ICACLS command to grant
+description: 'The following analytic detects the use of the ICACLS command to grant
+
     additional access permissions to files or directories. It leverages data from Endpoint
+
     Detection and Response (EDR) agents, focusing on specific process names and command-line
+
     arguments. This activity is significant because it is commonly used by Advanced
+
     Persistent Threats (APTs) and coinminer scripts to evade detection and maintain
+
     control over compromised systems. If confirmed malicious, this behavior could allow
+
     attackers to manipulate file permissions, potentially leading to unauthorized access,
-    data exfiltration, or further system compromise.
+
+    data exfiltration, or further system compromise.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    Processes.process_name IN ( "icacls.exe", "cacls.exe", "xcacls.exe") AND
-    Processes.process IN ("*/grant*", "*/g:*", "*/g *")
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `icacls_grant_command_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*icacls.exe", "*cacls.exe", "*xcacls.exe") Processes.process IN ("*/grant*", "*/g:*", "*/g *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `icacls_grant_command_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
+
+    names and speed up the data modeling process.'
 known_false_positives: No false positives have been identified at this time.
 references:
     - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -54,7 +55,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml
index a937936c8c4..f0d35f6cc73 100644
--- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml
+++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects the creation of suspicious files named passff.tar and cookie.tar, which are indicative of archived stolen browser information such as history and cookies on a machine compromised with IcedID. It leverages Sysmon EventCode 11 to identify these specific filenames. This activity is significant because it suggests that sensitive browser data has been exfiltrated, which could lead to further exploitation or data breaches. If confirmed malicious, this could allow attackers to access personal information, conduct further phishing attacks, or escalate their presence within the network.
 data_source:
     - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\passff.tar" OR Filesystem.file_path="*\\cookie.tar" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\passff.tar", "*\\cookie.tar") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
index dfb3c2ad98a..8dcfe949265 100644
--- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
+++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe (Processes.process = "*/Q /c * \\\\127.0.0.1\\*$*" AND Processes.process IN ("*2>&1*","*2&gt;&amp;1*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `impacket_lateral_movement_commandline_parameters_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*cmd.exe" Processes.process="*/Q /c * \\127.0.0.1\*$*" Processes.process IN ("*2>&1*", "*2&gt;&amp;1*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `impacket_lateral_movement_commandline_parameters_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although uncommon, Administrators may leverage Impackets tools to start a process on remote systems for system administration or automation use cases.
 references:
@@ -32,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious command line parameters on $dest$ may represent a lateral movement attack with Impackets tools
     entity:
diff --git a/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml
index 4e20004aae0..281163b577f 100644
--- a/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml
+++ b/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | where match(process, "(?i)cmd\.exe\s+\/Q\s+\/c") AND match(process,"(?i)echo\s+cd") AND match(process, "(?i)\\__output") AND  match(process, "(?i)C:\\\\Windows\\\\[a-zA-Z]{1,8}\\.bat")  AND match(process, "\\\\127\.0\.0\.1\\.*") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `impacket_lateral_movement_smbexec_commandline_parameters_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*cmd.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `impacket_lateral_movement_smbexec_commandline_parameters_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although uncommon, Administrators may leverage Impackets tools to start a process on remote systems for system administration or automation use cases.
 references:
@@ -32,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious command-line parameters on $dest$ may represent lateral movement using smbexec.
     entity:
diff --git a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml
index c0a9f61513f..d30310043ce 100644
--- a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml
+++ b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | where match(process, "(?i)cmd\.exe\s+\/Q\s+\/c") AND match(process, "\\\\127\.0\.0\.1\\.*") AND match(process, "__\\d{1,10}\\.\\d{1,10}") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `impacket_lateral_movement_wmiexec_commandline_parameters_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*wmiprvse.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `impacket_lateral_movement_wmiexec_commandline_parameters_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although uncommon, Administrators may leverage Impackets tools to start a process on remote systems for system administration or automation use cases.
 references:
@@ -33,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious command-line parameters on $dest$ may represent lateral movement using wmiexec.
     entity:
diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
index 9f66a00ece9..184f0e96c47 100644
--- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
+++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the use of the `Enter-PSSession` cmdlet to establish an interactive session on a remote endpoint via the WinRM protocol. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this activity by searching for specific script block text patterns. This behavior is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this activity could allow attackers to execute commands remotely, potentially leading to further compromise of the network and unauthorized access to sensitive information.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText="*Enter-PSSession*" AND ScriptBlockText="*-ComputerName*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `interactive_session_on_remote_endpoint_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Enter-PSSession*" Processes.process="*-ComputerName*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `interactive_session_on_remote_endpoint_with_powershell_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators may leverage WinRM and `Enter-PSSession` for administrative and troubleshooting tasks. This activity is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An interactive session was opened on a remote endpoint from $dest$
     entity:
diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml
index 3513f4a365b..acfc44be017 100644
--- a/detections/endpoint/java_writing_jsp_file.yml
+++ b/detections/endpoint/java_writing_jsp_file.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the Java process writing a .jsp file to disk, which may indicate a web shell being deployed. It leverages data from the Endpoint datamodel, specifically monitoring process and filesystem activities. This activity is significant because web shells can provide attackers with remote control over the compromised server, leading to further exploitation. If confirmed malicious, this could allow unauthorized access, data exfiltration, or further compromise of the affected system, posing a severe security risk.
 data_source:
     - Sysmon for Linux EventID 1 AND Sysmon for Linux EventID 11
-search: |-
+search: |
     | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
       WHERE Processes.process_name IN ("java","java.exe", "javaw.exe")
       BY _time Processes.action Processes.dest
@@ -51,7 +51,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $process_name$ was identified on endpoint $dest$ writing a jsp file $file_name$ to disk, potentially indicative of exploitation.
     entity:
diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml
index 198f9016e62..0551609db82 100644
--- a/detections/endpoint/jscript_execution_using_cscript_app.yml
+++ b/detections/endpoint/jscript_execution_using_cscript_app.yml
@@ -6,50 +6,19 @@ modification_date: '2026-10-09'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the execution of JScript using the cscript.exe process.
-    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry.
-    This behavior is significant because JScript files are typically executed by wscript.exe, making cscript.exe execution unusual and potentially indicative of malicious activity, such as the FIN7 group's tactics.
-    If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise.
-data_source:
-    - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-    (
-        (
-            Processes.parent_process_name = "cscript.exe"
-            Processes.parent_process = "*//e:jscript*"
-        )
-        OR
-        (
-            Processes.process_name = "cscript.exe"
-            Processes.process = "*//e:jscript*"
-        )
-    )
+description: 'The following analytic detects the execution of JScript using the cscript.exe process.
 
-    NOT Processes.process="*/Job:AgentHIScript*"
-    NOT Processes.parent_process="*/Job:AgentHIScript*"
+    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry.
 
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
+    This behavior is significant because JScript files are typically executed by wscript.exe, making cscript.exe execution unusual and potentially indicative of malicious activity, such as the FIN7 group''s tactics.
 
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `jscript_execution_using_cscript_app_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Symantec Host Integrity check uses Jscript through cscript.exe
+    If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise.'
+data_source:
+    - Sysmon EventID 1
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.parent_process_name="*cscript.exe" Processes.parent_process="*//e:jscript*") OR (Processes.process_name="*cscript.exe" Processes.process="*//e:jscript*") NOT Processes.process="*/Job:AgentHIScript*" NOT Processes.parent_process="*/Job:AgentHIScript*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `jscript_execution_using_cscript_app_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Symantec Host Integrity check uses Jscript through cscript.exe
 references:
     - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
     - https://attack.mitre.org/groups/G0046/
@@ -62,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
index 59273ca788e..9070bd7cdb9 100644
--- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
+++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic detects potential Kerberoasting attacks by identifying Kerberos service ticket requests with RC4 encryption through Event ID 4769. It leverages specific Ticket_Options values commonly used by Kerberoasting tools. This activity is significant as Kerberoasting allows attackers to request service tickets for domain accounts, typically service accounts, and crack them offline to gain privileged access. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and further compromise of the Active Directory environment.
 data_source:
     - Windows Event Log Security 4769
-search: |-
-    `wineventlog_security` EventCode=4769 ServiceName!="*$" (TicketOptions=0x40810000 OR TicketOptions=0x40800000 OR TicketOptions=0x40810010) TicketEncryptionType=0x17
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY Computer, user, service_id,
-           service, TicketEncryptionType, TicketOptions
-      | rename Computer as dest
-      | `security_content_ctime(lastTime)`
-      | `security_content_ctime(firstTime)`
-      | `kerberoasting_spn_request_with_rc4_encryption_filter`
+search: |
+    `wineventlog_security` EventCode=4769 NOT ServiceName="*$" TicketOptions IN ("0x40810000", "0x40800000", "0x40810010") TicketEncryptionType="0x17" | eval user=user, service_id=service_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kerberoasting_spn_request_with_rc4_encryption_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. Whithin environments where this type of communication is common, consider dropping the risk score and add throttling based on the user and service_id for 30 days. This will allow RBA to alert when there is an anomalous spike of these kerberoastable SPN requests within a short period of time.
 known_false_positives: Older systems that support kerberos RC4 by default like NetApp may generate false positives. Filter as needed
 references:
@@ -33,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ requested a service ticket for SPN $service_id$ with RC4 encryption
     entity:
diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
index 39925f0c7a4..738e5dd7bfc 100644
--- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
+++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
@@ -9,12 +9,8 @@ type: TTP
 description: The following analytic detects when the Kerberos Pre-Authentication flag is disabled in a user account, using Windows Security Event 4738. This event indicates a change in the UserAccountControl property of a domain user object. Disabling this flag allows adversaries to perform offline brute force attacks on the user's password using the AS-REP Roasting technique. This activity is significant as it can be used by attackers with existing privileges to escalate their access or maintain persistence. If confirmed malicious, this could lead to unauthorized access and potential compromise of sensitive information.
 data_source:
     - Windows Event Log Security 4738
-search: >
-    `wineventlog_security` EventCode=4738 UserAccountControl="*%%2096*"
-    | rename TargetUserName as user, SubjectUserName as actor | stats count earliest(_time) as firstTime latest(_time) as lastTime by actor, user, dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`
+search: |
+    `wineventlog_security` EventCode=4738 UserAccountControl="*%%2096*" | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `User Account Management` within `Account Management` needs to be enabled.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -29,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Kerberos Pre Authentication was Disabled for $user$
     entity:
diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml
index 53381a39085..c24462b3e7a 100644
--- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml
+++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the use of the `Set-ADAccountControl` PowerShell cmdlet with parameters that disable Kerberos Pre-Authentication. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this specific command execution. Disabling Kerberos Pre-Authentication is significant because it allows adversaries to perform offline brute force attacks against user passwords using the AS-REP Roasting technique. If confirmed malicious, this activity could enable attackers to escalate privileges or maintain persistence within an Active Directory environment, posing a severe security risk.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText = "*Set-ADAccountControl*" AND ScriptBlockText="*DoesNotRequirePreAuth:$true*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `kerberos_pre_authentication_flag_disabled_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Set-ADAccountControl*" Processes.process="*DoesNotRequirePreAuth:$true*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kerberos_pre_authentication_flag_disabled_with_powershell_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Although unlikely, Administrators may need to set this flag for legitimate purposes.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Kerberos Pre Authentication was Disabled using PowerShell on $dest$
     entity:
diff --git a/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml b/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml
index eae6df11baa..ec217d88e31 100644
--- a/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml
+++ b/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml
@@ -9,14 +9,8 @@ type: TTP
 description: 'The following analytic detects Kerberos service ticket requests using RC4 encryption, leveraging Kerberos Event 4769. This method identifies potential Golden Ticket attacks, where adversaries forge Kerberos Granting Tickets (TGT) using the Krbtgt account NTLM password hash to gain unrestricted access to an Active Directory environment. Monitoring for RC4 encryption usage is significant as it is rare in modern networks, indicating possible malicious activity. If confirmed malicious, attackers could move laterally and execute code on remote systems, compromising the entire network. Note: This detection may be bypassed if attackers use the AES key instead of the NTLM hash.'
 data_source:
     - Windows Event Log Security 4769
-search: |-
-    `wineventlog_security` EventCode=4769 ServiceName="*$" (TicketOptions=0x40810000 OR TicketOptions=0x40800000 OR TicketOptions=0x40810010) TicketEncryptionType=0x17
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest, service, service_id,
-           TicketEncryptionType, TicketOptions
-      | `security_content_ctime(lastTime)`
-      | `security_content_ctime(firstTime)`
-      | `kerberos_service_ticket_request_using_rc4_encryption_filter`
+search: |
+    `wineventlog_security` EventCode=4769 ServiceName="*$" TicketOptions IN ("0x40810000", "0x40800000", "0x40810010") TicketEncryptionType="0x17" | eval user=user, service_id=service_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kerberos_service_ticket_request_using_rc4_encryption_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
 known_false_positives: Based on Microsoft documentation, legacy systems or applications will use RC4-HMAC as the default encryption for Kerberos Service Ticket requests. Specifically, systems before Windows Server 2008 and Windows Vista. Newer systems will use AES128 or AES256.
 references:
@@ -33,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Kerberos Service TTicket request with RC4 encryption was requested from $dest$
     entity:
diff --git a/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml b/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml
index d54afbc73f0..2b4989d6d67 100644
--- a/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml
+++ b/detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml
@@ -9,13 +9,8 @@ type: TTP
 description: The following analytic detects a Kerberos Ticket Granting Ticket (TGT) request using RC4-HMAC encryption (type 0x17) by leveraging Event 4768. This encryption type is outdated and its presence may indicate an OverPass The Hash attack. Monitoring this activity is crucial as it can signify credential theft, allowing adversaries to authenticate to the Kerberos Distribution Center (KDC) using a stolen NTLM hash. If confirmed malicious, this could enable unauthorized access to systems and resources, potentially leading to lateral movement and further compromise within the network.
 data_source:
     - Windows Event Log Security 4768
-search: |-
-    `wineventlog_security` EventCode=4768 TicketEncryptionType=0x17 ServiceName!=*$
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY ServiceName src_ip dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `kerberos_tgt_request_using_rc4_encryption_filter`
+search: |
+    `wineventlog_security` EventCode=4768 TicketEncryptionType="0x17" NOT ServiceName="*$" | eval src_ip=src_ip | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kerberos_tgt_request_using_rc4_encryption_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
 known_false_positives: Based on Microsoft documentation, legacy systems or applications will use RC4-HMAC as the default encryption for TGT requests. Specifically, systems before Windows Server 2008 and Windows Vista. Newer systems will use AES128 or AES256.
 references:
@@ -30,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Kerberos TGT request with RC4 encryption was requested for $ServiceName$ from $src_ip$
     entity:
diff --git a/detections/endpoint/kerberos_user_enumeration.yml b/detections/endpoint/kerberos_user_enumeration.yml
index 2b48cbb5438..58eb7c82f27 100644
--- a/detections/endpoint/kerberos_user_enumeration.yml
+++ b/detections/endpoint/kerberos_user_enumeration.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects an unusual number of Kerberos Ticket Granting Ticket (TGT) requests for non-existing users from a single source endpoint. It leverages Event ID 4768 and identifies anomalies using the 3-sigma statistical rule. This behavior is significant as it may indicate an adversary performing a user enumeration attack against Active Directory. If confirmed malicious, the attacker could validate a list of usernames, potentially leading to further attacks such as brute force or credential stuffing, compromising the security of the environment.
 data_source:
     - Windows Event Log Security 4768
-search: |-
+search: |
     `wineventlog_security` EventCode=4768 Status=0x6 TargetUserName!="*$"
       | bucket span=2m _time
       | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts values(dest) as dest
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src_ip
diff --git a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml
index 17c85eab557..c192bfcada9 100644
--- a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml
+++ b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml
@@ -9,20 +9,8 @@ type: Anomaly
 description: The following analytic detects the deletion of SSH keys on a Linux machine. It leverages filesystem event logs to identify when files within "/etc/ssh/*" or "~/.ssh/*" are deleted. This activity is significant because attackers may delete or modify SSH keys to evade security measures or as part of a destructive payload, similar to the AcidRain malware. If confirmed malicious, this behavior could lead to impaired security features, hindered forensic investigations, or further unauthorized access, necessitating immediate investigation to identify the responsible process and user.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.action=deleted
-        AND
-        Filesystem.file_path IN ("/etc/ssh/*", "~/.ssh/*")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_account_manipulation_of_ssh_config_and_keys_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("/etc/ssh/*", "~/.ssh/*") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_account_manipulation_of_ssh_config_and_keys_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -35,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml
index df602d8f1ec..5d171c61f80 100644
--- a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml
+++ b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects unauthorized file creation in known crontab directories on Unix-based systems. It leverages filesystem data to identify new files in directories such as /etc/cron* and /var/spool/cron/*. This activity is significant as it may indicate an attempt by threat actors or malware to establish persistence on a compromised host. If confirmed malicious, this could allow attackers to execute arbitrary code at scheduled intervals, potentially leading to further system compromise and unauthorized access to sensitive information.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.file_path IN ("*/etc/cron*", "*/var/spool/cron/*")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(lastTime)`
-    | `security_content_ctime(firstTime)`
-    | `linux_add_files_in_known_crontab_directories_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/cron*", "*/var/spool/cron/*") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_add_files_in_known_crontab_directories_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: Administrator or network operator can create file in crontab folders for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml
index c15a28e179e..f4fb8ed81f9 100644
--- a/detections/endpoint/linux_add_user_account.yml
+++ b/detections/endpoint/linux_add_user_account.yml
@@ -10,22 +10,8 @@ description: The following analytic detects the creation of new user accounts on
 data_source:
     - Sysmon for Linux EventID 1
     - Cisco Isovalent Process Exec
-search: |-
-    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN ("useradd", "adduser")
-        OR
-        Processes.process IN ("*useradd *", "*adduser *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_add_user_account_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*useradd", "*adduser") OR Processes.process IN ("*useradd *", "*adduser *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_add_user_account_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml b/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml
index 903cb6d04e0..4a3f902de02 100644
--- a/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml
+++ b/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml
@@ -9,23 +9,8 @@ type: TTP
 description: The following analytic detects aa-exec being used to launch a binary under the trinity, chrome, or flatpak AppArmor profiles where the executed target is not the legitimate application those profiles are intended to confine. This behavior is consistent with abuse of userns,-carrying AppArmor profiles to bypass Ubuntu's unprivileged user namespace restrictions as seen in the CVE-2026-46331 privilege escalation exploit. The analytic flags execution when the target command following -- is invoked via a relative path, resolves outside standard trusted  install directories for these applications, or shares the same binary name as the calling parent process. Adversaries and red teams may abuse this technique to escalate privileges by tricking aa-exec into granting a namespace-creation capability to an arbitrary binary rather than the trusted application the profile was written for.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
-    from datamodel=Endpoint.Processes where
-        Processes.process_name="*aa-exec"
-        AND Processes.process="* -p *"
-        AND Processes.process="*--*"
-        AND Processes.process IN ("*trinity*","*chrome*","*flatpak*")
-        AND NOT Processes.process IN ("/user*","/opt*","/snap*","/var/lib/flatpak*")
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
-    Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-    Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
-    Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id
-    Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_apparmor_bypass_via_aaexec_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*aa-exec" Processes.process="* -p *" Processes.process="*--*" Processes.process IN ("*trinity*", "*chrome*", "*flatpak*") NOT (Processes.process IN ("/user*", "/opt*", "/snap*", "/var/lib/flatpak*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_apparmor_bypass_via_aaexec_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Chrome, Flatpak, and the trinity profile are never legitimately re-executed with extraneious arguments from a non-browser binary path
 references:
@@ -39,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: AppArmor bypass leveraging aa-exec was observed on $dest$.
     entity:
diff --git a/detections/endpoint/linux_apt_privilege_escalation.yml b/detections/endpoint/linux_apt_privilege_escalation.yml
index ce942e3cda6..9d493a8d9ad 100644
--- a/detections/endpoint/linux_apt_privilege_escalation.yml
+++ b/detections/endpoint/linux_apt_privilege_escalation.yml
@@ -10,7 +10,8 @@ description: The following analytic detects the use of the Advanced Package Tool
 data_source:
     - Sysmon for Linux EventID 1
     - Cisco Isovalent Process Exec
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*apt*" AND Processes.process="*APT::Update::Pre-Invoke::*" AND Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_apt_privilege_escalation_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*apt*" Processes.process="*APT::Update::Pre-Invoke::*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_apt_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_at_allow_config_file_creation.yml b/detections/endpoint/linux_at_allow_config_file_creation.yml
index 2a19e118b05..107c8314442 100644
--- a/detections/endpoint/linux_at_allow_config_file_creation.yml
+++ b/detections/endpoint/linux_at_allow_config_file_creation.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of the /etc/at.allow or /etc/at.deny configuration files in Linux. It leverages file creation events from the Endpoint datamodel to identify when these files are created. This activity is significant as these files control user permissions for the "at" scheduling application and can be abused by attackers to establish persistence. If confirmed malicious, this could allow unauthorized execution of malicious code, leading to potential data theft or further system compromise. Analysts should review the file path, creation time, and associated processes to assess the threat.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.file_path IN ("*/etc/at.allow", "*/etc/at.deny")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(lastTime)`
-    | `security_content_ctime(firstTime)`
-    | `linux_at_allow_config_file_creation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/at.allow", "*/etc/at.deny") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_at_allow_config_file_creation_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints into the Endpoint datamodel. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: Administrator or network operator can create this file for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml
index 0311793793b..01c614a898c 100644
--- a/detections/endpoint/linux_at_application_execution.yml
+++ b/detections/endpoint/linux_at_application_execution.yml
@@ -9,22 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the "At" application in Linux, which can be used by attackers to create persistence entries on a compromised host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent process names associated with "at" or "atd". This activity is significant because the "At" application can be exploited to maintain unauthorized access or deliver additional malicious payloads. If confirmed malicious, this behavior could lead to data theft, ransomware attacks, or other severe consequences. Immediate investigation is required to determine the legitimacy of the execution and mitigate potential risks.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN ("at", "atd")
-        OR
-        Processes.parent_process_name IN ("at", "atd")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_at_application_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*at", "*atd") OR Processes.parent_process_name IN ("at", "atd") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -39,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml
index cd965ede127..4c430924d4a 100644
--- a/detections/endpoint/linux_auditd_add_user_account.yml
+++ b/detections/endpoint/linux_auditd_add_user_account.yml
@@ -9,14 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries often create new user accounts to establish persistence on compromised hosts. If confirmed malicious, this could allow attackers to maintain access, escalate privileges, and further compromise the system, posing a severe security risk.
 data_source:
     - Linux Auditd Proctitle
-search: |-
-    `linux_auditd` proctitle IN ("*useradd*", "*adduser*")
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY proctitle dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_add_user_account_filter`
+search: |
+    `linux_auditd` type=PROCTITLE proctitle IN ("*useradd*", "*adduser*") | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_add_user_account_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -30,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_add_user_account_type.yml b/detections/endpoint/linux_auditd_add_user_account_type.yml
index 34776e67bdd..3a5b1dd1217 100644
--- a/detections/endpoint/linux_auditd_add_user_account_type.yml
+++ b/detections/endpoint/linux_auditd_add_user_account_type.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the suspicious add user account type. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
 data_source:
     - Linux Auditd Add User
-search: |-
+search: |
     `linux_auditd` type=ADD_USER
       | rename host as dest
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_ai_cli_permission_override_activated.yml b/detections/endpoint/linux_auditd_ai_cli_permission_override_activated.yml
index 3be96d9edbf..9c7f37369b0 100644
--- a/detections/endpoint/linux_auditd_ai_cli_permission_override_activated.yml
+++ b/detections/endpoint/linux_auditd_ai_cli_permission_override_activated.yml
@@ -6,21 +6,17 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    This detection identifies when an AI command-line tool is launched in an unsafe mode that bypasses normal safety checks and user approvals.
+description: 'This detection identifies when an AI command-line tool is launched in an unsafe mode that bypasses normal safety checks and user approvals.
+
     For instance, running claude --dangerously-skip-permissions skips all safety restrictions, allowing the tool to operate freely, while gemini --yolo automatically approves all actions without prompting the user.
+
     These modes, often called permission overrides or YOLO mode, let the AI execute commands, modify files, or perform tasks without confirmation.
-    Detecting their use is important to prevent unintended or potentially harmful operations.
+
+    Detecting their use is important to prevent unintended or potentially harmful operations.'
 data_source:
     - Linux Auditd Proctitle
-search: |-
-    `linux_auditd` (proctitle = "*gemini*" AND proctitle IN ("*--yolo*", "*-y *")) OR
-    (proctitle = "*claude*" AND proctitle= "*--dangerously-skip-permissions*")
-    | rename host as dest
-    | stats count min(_time) as firstTime max(_time) as lastTime
-      BY proctitle dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)` | `linux_auditd_ai_cli_permission_override_activated_filter`
+search: |
+    `linux_auditd` type=PROCTITLE (proctitle="*gemini*" proctitle IN ("*--yolo*", "*-y *")) OR (proctitle="*claude*" proctitle="*--dangerously-skip-permissions*") | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_ai_cli_permission_override_activated_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: An administrator or network operator might execute this command legitimately. Please apply the necessary filters to tune that activity.
 references:
@@ -33,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml
index 72ffa9b3c4a..98c5fe52a53 100644
--- a/detections/endpoint/linux_auditd_at_application_execution.yml
+++ b/detections/endpoint/linux_auditd_at_application_execution.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the "At" application in Linux, which can be used by attackers to create persistence entries on a compromised host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent process names associated with "at" or "atd". This activity is significant because the "At" application can be exploited to maintain unauthorized access or deliver additional malicious payloads. If confirmed malicious, this behavior could lead to data theft, ransomware attacks, or other severe consequences. Immediate investigation is required to determine the legitimacy of the execution and mitigate potential risks.
 data_source:
     - Linux Auditd Syscall
-search: |-
-    `linux_auditd` type=SYSCALL comm IN ("at", "atd") OR exe IN ("/usr/bin/at","/usr/bin/atd") AND NOT (uid IN ("daemon"))
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY comm exe syscall
-           uid ppid pid
-           dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_at_application_execution_filter`
+search: |
+    `linux_auditd` (type="SYSCALL" comm IN ("at", "atd")) OR (exe IN ("/usr/bin/at", "/usr/bin/atd") NOT uid="daemon") | stats count min(_time) as firstTime max(_time) as lastTime by comm exe syscall uid ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_at_application_execution_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_auditd_daemon_abort.yml b/detections/endpoint/linux_auditd_auditd_daemon_abort.yml
index d9387eb4081..11facda9bf8 100644
--- a/detections/endpoint/linux_auditd_auditd_daemon_abort.yml
+++ b/detections/endpoint/linux_auditd_auditd_daemon_abort.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the abnormal termination of the Linux audit daemon (auditd) by identifying DAEMON_ABORT events in audit logs. These terminations suggest a serious failure of the auditing subsystem, potentially due to resource exhaustion, corruption, or malicious interference. Unlike a clean shutdown, DAEMON_ABORT implies that audit logging may have been disabled without system administrator intent. Alerts should be generated on detection and correlated with DAEMON_START, DAEMON_END, and system logs to determine root cause. If no DAEMON_START follows soon after, or this pattern repeats, it indicates a high-severity issue that impacts log integrity and should be immediately investigated.
 data_source:
     - Linux Auditd Daemon Abort
-search: |-
+search: |
     `linux_auditd` type=DAEMON_ABORT
       | rename host as dest
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_auditd_daemon_shutdown.yml b/detections/endpoint/linux_auditd_auditd_daemon_shutdown.yml
index 977b4baaa4e..b74aab87367 100644
--- a/detections/endpoint/linux_auditd_auditd_daemon_shutdown.yml
+++ b/detections/endpoint/linux_auditd_auditd_daemon_shutdown.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the unexpected termination of the Linux Audit daemon (auditd) by monitoring for log entries of type DAEMON_END. This event signifies that the audit logging service has stopped, either due to a legitimate system shutdown, manual administrative action, or potentially malicious tampering. Since auditd is responsible for recording critical security events, its sudden stoppage may indicate an attempt to disable security monitoring or evade detection during an attack. This detection should be correlated with system logs to determine whether the shutdown was part of routine maintenance or an anomaly. If confirmed as malicious, this could lead to a compromised system where security events are no longer being logged, allowing attackers to operate undetected. Therefore, monitoring and alerting on auditd shutdown events is crucial for maintaining the integrity of system security monitoring.
 data_source:
     - Linux Auditd Daemon End
-search: |-
+search: |
     `linux_auditd` type=DAEMON_END
       | rename host as dest
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_auditd_daemon_start.yml b/detections/endpoint/linux_auditd_auditd_daemon_start.yml
index 57aadc96696..50e031f7528 100644
--- a/detections/endpoint/linux_auditd_auditd_daemon_start.yml
+++ b/detections/endpoint/linux_auditd_auditd_daemon_start.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the (re)initialization of the Linux audit daemon (auditd) by identifying log entries of type DAEMON_START. This event indicates that the audit subsystem has resumed logging after being stopped or has started during system boot. While DAEMON_START may be expected during reboots or legitimate configuration changes, it can also signal attempts to re-enable audit logging after evasion, or restarts with modified or reduced rule sets. Monitoring this event in correlation with DAEMON_END, DAEMON_ABORT, and auditctl activity provides visibility into the continuity and integrity of audit logs. Frequent or unexplained DAEMON_START events should be investigated, especially if they are not accompanied by valid administrative or system activity.
 data_source:
     - Linux Auditd Daemon Start
-search: |-
+search: |
     `linux_auditd` type=DAEMON_START
       | rename host as dest
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml
index 27045659cb0..56bc1f632df 100644
--- a/detections/endpoint/linux_auditd_auditd_service_stop.yml
+++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml
@@ -9,15 +9,8 @@ type: Anomaly
 description: The following analytic detects the suspicious auditd service stop. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
 data_source:
     - Linux Auditd Service Stop
-search: |-
-    `linux_auditd` type=SERVICE_STOP unit IN ("auditd")
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY type pid comm
-           exe unit dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_auditd_service_stop_filter`
+search: |
+    `linux_auditd` type=SERVICE_STOP unit="auditd" | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by unit | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_auditd_service_stop_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -30,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_base64_decode_files.yml b/detections/endpoint/linux_auditd_base64_decode_files.yml
index 6bc464a90d3..2a2f3c5bbd3 100644
--- a/detections/endpoint/linux_auditd_base64_decode_files.yml
+++ b/detections/endpoint/linux_auditd_base64_decode_files.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. Base64 is commonly used to encode data for safe transmission, but attackers may abuse it to conceal malicious payloads. This detection focuses on identifying unusual or unexpected Base64 decoding processes, particularly when associated with critical files or directories. By monitoring these activities, the analytic helps uncover potential threats, enabling security teams to respond promptly and mitigate risks associated with encoded malware or unauthorized data access.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd` execve_command = "*base64*" AND execve_command IN ("*-d*", "* --d*")
-      | rename host as dest
-      | rename comm as process_name
-      | rename exe as process
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY argc execve_command dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_base64_decode_files_filter`
+search: |
+    `linux_auditd` type=EXECVE execve_command="*base64*" execve_command IN ("*-d*", "* --d*") | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by execve_command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_base64_decode_files_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml
index 07c82d55350..ecbc01868a8 100644
--- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml
+++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml
@@ -9,14 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of the 'chown' command to change a file owner to 'root' on a Linux system. It leverages Linux Auditd telemetry, specifically monitoring command-line executions and process details. This activity is significant as it may indicate an attempt to escalate privileges by adversaries, malware, or red teamers. If confirmed malicious, this action could allow an attacker to gain root-level access, leading to full control over the compromised host and potential persistence within the environment.
 data_source:
     - Linux Auditd Proctitle
-search: |-
-    `linux_auditd` proctitle = "*chown *root*"
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY proctitle dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_change_file_owner_to_root_filter`
+search: |
+    `linux_auditd` type=PROCTITLE proctitle="*chown *root*" | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_change_file_owner_to_root_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -30,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml
index 79d77ca293a..208610410c6 100644
--- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml
+++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of the Linux 'xclip' command to copy data from the clipboard. It leverages Linux Auditd telemetry, focusing on process names and command-line arguments related to clipboard operations. This activity is significant because adversaries can exploit clipboard data to capture sensitive information such as passwords or IP addresses. If confirmed malicious, this technique could lead to unauthorized data exfiltration, compromising sensitive information and potentially aiding further attacks within the environment.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd` execve_command IN ("*xclip*", "*clipboard*") AND execve_command IN ("*-o*", "*-selection *", "*-sel *" )
-      | rename host as dest
-      | rename comm as process_name
-      | rename exe as process
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY argc execve_command dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_clipboard_data_copy_filter`
+search: |
+    `linux_auditd` type=EXECVE execve_command IN ("*xclip*", "*clipboard*") execve_command IN ("*-o*", "*-selection *", "*-sel *") | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by execve_command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_clipboard_data_copy_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: False positives may be present on Linux desktop as it may commonly be used by administrators or end users. Filter as needed.
 references:
@@ -33,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_copy_fail_privilege_escalation.yml b/detections/endpoint/linux_auditd_copy_fail_privilege_escalation.yml
index 16dfd97f8ca..24abacc8f96 100644
--- a/detections/endpoint/linux_auditd_copy_fail_privilege_escalation.yml
+++ b/detections/endpoint/linux_auditd_copy_fail_privilege_escalation.yml
@@ -6,86 +6,20 @@ modification_date: '2026-05-13'
 author: Raven Tait, Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |-
-    Detects the exploitation pattern associated with Copy Fail.
-    Copy Fail (CVE-2026-31431) is a logic bug in the Linux kernel's authentication cryptographic template.
+description: 'Detects the exploitation pattern associated with Copy Fail.
+
+    Copy Fail (CVE-2026-31431) is a logic bug in the Linux kernel''s authentication cryptographic template.
+
     It lets an unprivileged local user trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system.
+
     A single 732-byte Python script can edit a setuid binary and obtain root on essentially all Linux distributions shipped since 2017.
-    This search relies on the auditd configuration linked in the references section. If you are using a custom configuration, make sure the Key names are the same or adapt the search accordingly.
+
+    This search relies on the auditd configuration linked in the references section. If you are using a custom configuration, make sure the Key names are the same or adapt the search accordingly.'
 data_source:
     - Linux Auditd Syscall
-search: |-
-    `linux_auditd`
-    type=SYSCALL
-    key IN (
-        "af_alg",
-        "process_creation",
-        "splice_user"
-    )
-    | eval setuid_binary = case(
-        name IN (
-            "/usr/bin/chfn",
-            "/usr/bin/chsh",
-            "/usr/bin/fusermount3",
-            "/usr/bin/gpasswd",
-            "/usr/bin/mount",
-            "/usr/bin/newgrp",
-            "/usr/bin/passwd",
-            "/usr/bin/su",
-            "/usr/bin/sudo",
-            "/usr/bin/umount",
-            "/usr/lib/dbus-1.0/dbus-daemon-launch-helper",
-            "/usr/lib/landscape/apt-update",
-            "/usr/lib/openssh/ssh-keysign",
-            "/usr/lib/polkit-1/polkit-agent-helper-1"
-        ), name,
-        exe IN (
-            "/usr/bin/chfn",
-            "/usr/bin/chsh",
-            "/usr/bin/fusermount3",
-            "/usr/bin/gpasswd",
-            "/usr/bin/mount",
-            "/usr/bin/newgrp",
-            "/usr/bin/passwd",
-            "/usr/bin/su",
-            "/usr/bin/sudo",
-            "/usr/bin/umount",
-            "/usr/lib/dbus-1.0/dbus-daemon-launch-helper",
-            "/usr/lib/landscape/apt-update",
-            "/usr/lib/openssh/ssh-keysign",
-            "/usr/lib/polkit-1/polkit-agent-helper-1"
-        ), exe,
-        true(), null()
-    )
-    | eval indicator = case(
-        key="af_alg",        "AF_ALG socket",
-        key="splice_user",   "splice syscall",
-        isnotnull(setuid_binary), "setuid_exec:" . setuid_binary,
-        true(),              null()
-    )
-    | where isnotnull(indicator)
-    | stats
-        dc(indicator) as unique_signals
-        max(_time) as lastTime
-        min(_time) as firstTime
-        values(comm) as comm
-        values(exe) as exe
-        values(name) as name
-        values(host) as dest
-        values(indicator) as signals
-        values(setuid_binary) as setuid_binaries
-        values(pid) as pid
-        values(ppid) as ppid
-        values(uid) as uid
-        by auid
-    | where unique_signals >= 3
-    | eval risk_score_factor = unique_signals * 25
-    | sort - risk_score_factor
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_auditd_copy_fail_privilege_escalation_filter`
-how_to_implement: |-
-    To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. Ensure specifically that AF_ALG socket creation and splice syscall is being monitored. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
+search: |
+    `linux_auditd` type="SYSCALL" key IN ("af_alg", "process_creation", "splice_user") | stats count min(_time) as firstTime max(_time) as lastTime by comm exe syscall uid ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_copy_fail_privilege_escalation_filter`
+how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. Ensure specifically that AF_ALG socket creation and splice syscall is being monitored. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
 known_false_positives: No false positives have been identified at this time.
 references:
     - https://xint.io/blog/copy-fail-linux-distributions
@@ -99,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Privilege escalation attempt leveraging the Copy Fail vulnerability was observed on $dest$.
     entity:
diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml
index 8c2d156c60a..854dd9748f7 100644
--- a/detections/endpoint/linux_auditd_data_destruction_command.yml
+++ b/detections/endpoint/linux_auditd_data_destruction_command.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. It leverages data from Linux Auditd, focusing on the 'rm' command with force recursive deletion and the '--no-preserve-root' option. This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred. If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. Immediate investigation and response are crucial to mitigate potential damage.
 data_source:
     - Linux Auditd Proctitle
-search: |-
-    `linux_auditd`  (proctitle = "*rm *" AND proctitle = "*-rf *" AND proctitle = "*--no-preserve-root*")
-      | rename host as dest
-      | rename comm as process_name
-      | rename exe as process
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY proctitle dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_data_destruction_command_filter`
+search: |
+    `linux_auditd` type=PROCTITLE proctitle="*rm *" proctitle="*-rf *" proctitle="*--no-preserve-root*" | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_data_destruction_command_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A [$proctitle$] event occurred on host - [$dest$] to destroy data.
     entity:
diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml
index c2d8ea92f2d..1138152394f 100644
--- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml
+++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious data transfer activities that involve the use of the `split` syscall, potentially indicating an attempt to evade detection by breaking large files into smaller parts. Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd` execve_command = "*split*" AND execve_command = "*-b *"
-      | rename host as dest
-      | rename comm as process_name
-      | rename exe as process
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY argc execve_command dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_data_transfer_size_limits_via_split_filter`
+search: |
+    `linux_auditd` type=EXECVE execve_command="*split*" execve_command="*-b *" | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by execve_command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_data_transfer_size_limits_via_split_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml
index 1bd61fc9415..af64843d20b 100644
--- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml
+++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious data transfer activities that involve the use of the `split` syscall, potentially indicating an attempt to evade detection by breaking large files into smaller parts. Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network.
 data_source:
     - Linux Auditd Syscall
-search: |-
-    `linux_auditd` type=SYSCALL comm=split OR exe= "*/split"
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY comm exe syscall
-           uid ppid pid
-           success dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_data_transfer_size_limits_via_split_syscall_filter`
+search: |
+    `linux_auditd` (type="SYSCALL" comm="split") OR exe="*/split" | stats count min(_time) as firstTime max(_time) as lastTime by comm exe syscall uid ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_data_transfer_size_limits_via_split_syscall_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml
index f6338fefa2d..8b8da781a8a 100644
--- a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml
+++ b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious database file and directory discovery activities, which may signal an attacker attempt to locate and assess critical database assets on a compromised system. This behavior is often a precursor to data theft, unauthorized access, or privilege escalation, as attackers seek to identify valuable information stored in databases. By monitoring for unusual or unauthorized attempts to locate database files and directories, this analytic aids in early detection of potential reconnaissance or data breach efforts, enabling security teams to respond swiftly and mitigate the risk of further compromise.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd` execve_command IN ("*find*", "*grep*") AND execve_command IN("*.db*", "*.sql*", "*.sqlite*", "*.mdb*", "*.accdb*", "*.mdf*", "*.ndf*", "*.ldf*", "*.frm*", "*.myd*", "*.myi*", "*.dbf*", "*.db2*", "*.dbc*", "*.fpt*", "*.ora*")
-      | rename host as dest
-      | rename comm as process_name
-      | rename exe as process
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY argc execve_command dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_database_file_and_directory_discovery_filter`
+search: |
+    `linux_auditd` type=EXECVE execve_command IN ("*find*", "*grep*") execve_command IN ("*.db*", "*.sql*", "*.sqlite*", "*.mdb*", "*.accdb*", "*.mdf*", "*.ndf*", "*.ldf*", "*.frm*", "*.myd*", "*.myi*", "*.dbf*", "*.db2*", "*.dbc*", "*.fpt*", "*.ora*") | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by execve_command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_database_file_and_directory_discovery_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml
index 068bfe8ecad..008a914ce9f 100644
--- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml
+++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml
@@ -9,14 +9,8 @@ type: TTP
 description: The following analytic detects the use of the 'dd' command to overwrite files on a Linux system. It leverages data from Linux Auditd telemetry, focusing on process execution logs that include command-line details. This activity is significant because adversaries often use the 'dd' command to destroy or irreversibly overwrite files, disrupting system availability and services. If confirmed malicious, this behavior could lead to data destruction, making recovery difficult and potentially causing significant operational disruptions.
 data_source:
     - Linux Auditd Proctitle
-search: |-
-    `linux_auditd` proctitle = "*dd *" AND proctitle = "*of=*" AND proctitle = "*if=/dev/zero*"
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY proctitle dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_dd_file_overwrite_filter`
+search: |
+    `linux_auditd` type=PROCTITLE proctitle="*dd *" proctitle="*of=*" proctitle="*if=/dev/zero*" | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_dd_file_overwrite_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -31,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A [$proctitle$] event occurred on host - [$dest$].
     entity:
diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml
index a7970538ff0..0cc1d90f823 100644
--- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml
+++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml
@@ -9,15 +9,8 @@ type: Anomaly
 description: The following analytic detects the suspicious disable or modify system firewall. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
 data_source:
     - Linux Auditd Service Stop
-search: |-
-    `linux_auditd` type=SERVICE_STOP unit IN ("firewalld", "ufw")
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY type pid comm
-           exe unit dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_disable_or_modify_system_firewall_filter`
+search: |
+    `linux_auditd` type=SERVICE_STOP unit IN ("firewalld", "ufw") | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by unit | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_disable_or_modify_system_firewall_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -30,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml
index e394c641332..905313bac4e 100644
--- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml
+++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml
@@ -6,11 +6,13 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects the creation of the doas.conf file on a Linux host.
+description: 'The following analytic detects the creation of the doas.conf file on a Linux host.
+
     This file is used by the doas utility to allow standard users to perform tasks as root, similar to sudo.
+
     The detection leverages Linux Auditd data, focusing on the creation of the doas.conf file.
-    This activity is significant because it can indicate an attempt to gain elevated privileges, potentially by an adversary. If confirmed malicious, this could allow an attacker to execute commands with root commands with root privileges, leading to full system compromise.
+
+    This activity is significant because it can indicate an attempt to gain elevated privileges, potentially by an adversary. If confirmed malicious, this could allow an attacker to execute commands with root commands with root privileges, leading to full system compromise.'
 data_source:
     - Linux Auditd Path
     - Linux Auditd Cwd
@@ -52,19 +54,26 @@ search: |
     | `security_content_ctime(lastTime)`
     | table nametype current_working_directory reconstructed_path dest audit_id match_count firstTime lastTime
     | `linux_auditd_doas_conf_file_creation_filter`
-how_to_implement: |
-    To implement this detection, the process begins by ingesting auditd
+how_to_implement: 'To implement this detection, the process begins by ingesting auditd
+
     data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
+
     executions and process details on Unix/Linux systems. These logs should be ingested
+
     and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
+
     which is essential for correctly parsing and categorizing the data. The next step
+
     involves normalizing the field names  to match the field names set by the Splunk
+
     Common Information Model (CIM) to ensure consistency across different data sources
+
     and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
-    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
-known_false_positives: |
-    Administrator or network operator can execute this command.
-    Please update the filter macros to remove false positives.
+
+    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.'
+known_false_positives: 'Administrator or network operator can execute this command.
+
+    Please update the filter macros to remove false positives.'
 references:
     - https://wiki.gentoo.org/wiki/Doas
     - https://www.makeuseof.com/how-to-install-and-use-doas/
@@ -76,7 +85,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A $reconstructed_path$ file was created on host - [$dest$]
     entity:
diff --git a/detections/endpoint/linux_auditd_doas_tool_execution.yml b/detections/endpoint/linux_auditd_doas_tool_execution.yml
index df78fa19312..cdcfc4e1849 100644
--- a/detections/endpoint/linux_auditd_doas_tool_execution.yml
+++ b/detections/endpoint/linux_auditd_doas_tool_execution.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the 'doas' tool on a Linux host. This tool allows standard users to perform tasks with root privileges, similar to 'sudo'. The detection leverages data from Linux Auditd, focusing on process names and command-line executions. This activity is significant as 'doas' can be exploited by adversaries to gain elevated privileges on a compromised host. If confirmed malicious, this could lead to unauthorized administrative access, potentially compromising the entire system.
 data_source:
     - Linux Auditd Syscall
-search: |-
-    `linux_auditd` type=SYSCALL comm=doas
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY comm exe syscall
-           uid ppid pid
-           success dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_doas_tool_execution_filter`
+search: |
+    `linux_auditd` type="SYSCALL" comm="doas" | stats count min(_time) as firstTime max(_time) as lastTime by comm exe syscall uid ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_doas_tool_execution_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml
index 4f99245008c..e7853420559 100644
--- a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml
+++ b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects the suspicious editing of cron jobs in Linux using the crontab command-line parameter (-e). It identifies this activity by monitoring command-line executions involving 'crontab' and the edit parameter. This behavior is significant for a SOC as cron job manipulations can indicate unauthorized persistence attempts or scheduled malicious actions. If confirmed malicious, this activity could lead to system compromise, unauthorized access, or broader network compromise.
 data_source:
     - Linux Auditd Syscall
-search: |-
-    `linux_auditd` type=SYSCALL syscall IN ("rename", "execve") (comm IN ("crontab") OR exe IN ("*/crontab")) success=yes AND NOT (UID IN("daemon"))
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY comm exe syscall
-           uid ppid pid
-           dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_edit_cron_table_parameter_filter`
+search: |
+    `linux_auditd` type="SYSCALL" syscall IN ("rename", "execve") comm="crontab" OR exe="*/crontab" success="yes" NOT UID="daemon" | stats count min(_time) as firstTime max(_time) as lastTime by comm exe syscall uid ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_edit_cron_table_parameter_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml
index 31443e42291..b8aea3e87b5 100644
--- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml
+++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious file and directory discovery activities, which may indicate an attacker's effort to locate sensitive documents and files on a compromised system. This behavior often precedes data exfiltration, as adversaries seek to identify valuable or confidential information for theft. By identifying unusual or unauthorized attempts to browse or enumerate files and directories, this analytic helps security teams detect potential reconnaissance or preparatory actions by an attacker, enabling timely intervention to prevent data breaches or unauthorized access.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd`  execve_command IN ("*grep*", "*find*") AND execve_command IN ("*.tif*", "*.tiff*", "*.gif*", "*.jpeg*", "*.jpg*", "*.jif*", "*.jfif*", "*.jp2*", "*.jpx*", "*.j2k*", "*.j2c*", "*.fpx*", "*.pcd*", "*.png*", "*.flv*", "*.pdf*", "*.mp4*", "*.mp3*", "*.gifv*", "*.avi*", "*.mov*", "*.mpeg*", "*.wav*", "*.doc*", "*.docx*", "*.xls*", "*.xlsx*", "*.svg*")
-      | rename host as dest
-      | rename comm as process_name
-      | rename exe as process
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY argc execve_command dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_file_and_directory_discovery_filter`
+search: |
+    `linux_auditd` type=EXECVE execve_command IN ("*grep*", "*find*") execve_command IN ("*.tif*", "*.tiff*", "*.gif*", "*.jpeg*", "*.jpg*", "*.jif*", "*.jfif*", "*.jp2*", "*.jpx*", "*.j2k*", "*.j2c*", "*.fpx*", "*.pcd*", "*.png*", "*.flv*", "*.pdf*", "*.mp4*", "*.mp3*", "*.gifv*", "*.avi*", "*.mov*", "*.mpeg*", "*.wav*", "*.doc*", "*.docx*", "*.xls*", "*.xlsx*", "*.svg*") | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by execve_command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_file_and_directory_discovery_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -33,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml
index d5e8fcf95ef..7024304d96f 100644
--- a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml
+++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml
@@ -3,13 +3,14 @@ id: 5f1d2ea7-eec0-4790-8b24-6875312ad492
 version: 15
 creation_date: '2024-08-12'
 modification_date: '2026-05-13'
-author: "Teoderick Contreras, Splunk, Ivar Nygård"
+author: Teoderick Contreras, Splunk, Ivar Nygård
 status: production
 type: Anomaly
 description: The following analytic detects suspicious file permission modifications using the `chmod` command, which may indicate an attacker attempting to alter access controls on critical files or directories. Such modifications can be used to grant unauthorized users elevated privileges or to conceal malicious activities by restricting legitimate access. By monitoring for unusual or unauthorized `chmod` usage, this analytic helps identify potential security breaches, allowing security teams to respond promptly to prevent privilege escalation, data tampering, or other unauthorized actions on the system.
 data_source:
     - Linux Auditd Proctitle
-search: "`linux_auditd` proctitle=\"*chmod*\" AND proctitle IN (\"* 777 *\", \"* 755 *\", \"*+*x*\", \"* 754 *\")\n  | rename host as dest\n  | stats count min(_time) as firstTime max(_time) as lastTime\n    BY proctitle dest\n  | `security_content_ctime(firstTime)`\n  | `security_content_ctime(lastTime)`\n  | `linux_auditd_file_permission_modification_via_chmod_filter`"
+search: |
+    `linux_auditd` type=PROCTITLE proctitle="*chmod*" proctitle IN ("* 777 *", "* 755 *", "*+*x*", "* 754 *") | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_file_permission_modification_via_chmod_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml
index 855cce089db..d4b740248d0 100644
--- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml
+++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml
@@ -9,14 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious file permissions modifications using the chattr command, which may indicate an attacker attempting to manipulate file attributes to evade detection or prevent alteration. The chattr command can be used to make files immutable or restrict deletion, which can be leveraged to protect malicious files or disrupt system operations. By monitoring for unusual or unauthorized chattr usage, this analytic helps identify potential tampering with critical files, enabling security teams to quickly respond to and mitigate threats associated with unauthorized file attribute changes.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd` proctitle = "*chattr *" AND proctitle = "* -i*"
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY proctitle dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_file_permissions_modification_via_chattr_filter`
+search: |
+    `linux_auditd` type=EXECVE proctitle="*chattr *" proctitle="* -i*" | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_file_permissions_modification_via_chattr_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -29,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml
index 4ae37a11109..f3b34ba4a9f 100644
--- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml
+++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects suspicious attempts to find credentials stored in password managers, which may indicate an attacker's effort to retrieve sensitive login information. Password managers are often targeted by adversaries seeking to access stored passwords for further compromise or lateral movement within a network. By monitoring for unusual or unauthorized access to password manager files or processes, this analytic helps identify potential credential theft attempts, enabling security teams to respond quickly to protect critical accounts and prevent further unauthorized access.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd` execve_command IN ("*find*", "*grep*") AND execve_command IN ("*.kdbx*", "*KeePass*", "*.enforced*", "*.lpdb*", "*.opvault*", "*.agilekeychain*", "*.dashlane*", "*.rfx*", "*passbolt*", "*.spdb*", "*StickyPassword*", "*.walletx*", "*enpass*", "*vault*", "*.kdb*")
-      | rename host as dest
-      | rename comm as process_name
-      | rename exe as process
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY argc execve_command dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_find_credentials_from_password_managers_filter`
+search: |
+    `linux_auditd` type=EXECVE execve_command IN ("*find*", "*grep*") execve_command IN ("*.kdbx*", "*KeePass*", "*.enforced*", "*.lpdb*", "*.opvault*", "*.agilekeychain*", "*.dashlane*", "*.rfx*", "*passbolt*", "*.spdb*", "*StickyPassword*", "*.walletx*", "*enpass*", "*vault*", "*.kdb*") | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by execve_command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_find_credentials_from_password_managers_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A [$execve_command$] event occurred on host - [$dest$] to find credentials stored in password managers.
     entity:
diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml
index 37724d5e27a..3dced80c58a 100644
--- a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml
+++ b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd` execve_command IN ("*find*", "*grep*") AND execve_command IN ("*password*", "*pass *", "*credential*", "*creds*")
-      | rename host as dest
-      | rename comm as process_name
-      | rename exe as process
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY argc execve_command dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_find_credentials_from_password_stores_filter`
+search: |
+    `linux_auditd` type=EXECVE execve_command IN ("*find*", "*grep*") execve_command IN ("*password*", "*pass *", "*credential*", "*creds*") | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by execve_command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_find_credentials_from_password_stores_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A [$execve_command$] event occurred on host - [$dest$] to find credentials stored in password managers.
     entity:
diff --git a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml
index 55d4b410978..769c1dafec2 100644
--- a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml
+++ b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious attempts to find SSH private keys, which may indicate an attacker's effort to compromise secure access to systems. SSH private keys are essential for secure authentication, and unauthorized access to these keys can enable attackers to gain unauthorized access to servers and other critical infrastructure. By monitoring for unusual or unauthorized searches for SSH private keys, this analytic helps identify potential threats to network security, allowing security teams to quickly respond and safeguard against unauthorized access and potential breaches.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd` execve_command IN ("*find*", "*grep*") AND execve_command IN ("*id_rsa*", "*id_dsa*", "*.key*", "*ssh_key*", "*authorized_keys*")
-      | rename host as dest
-      | rename comm as process_name
-      | rename exe as process
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY argc execve_command dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_find_ssh_private_keys_filter`
+search: |
+    `linux_auditd` type=EXECVE execve_command IN ("*find*", "*grep*") execve_command IN ("*id_rsa*", "*id_dsa*", "*.key*", "*ssh_key*", "*authorized_keys*") | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by execve_command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_find_ssh_private_keys_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml
index ca5d1e2b8ac..2d6affef897 100644
--- a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml
+++ b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml
@@ -9,14 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the "swapoff" command, which disables the swapping of paging devices on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because disabling swap can be a tactic used by malware, such as Awfulshred, to evade detection and hinder forensic analysis. If confirmed malicious, this action could allow an attacker to manipulate system memory management, potentially leading to data corruption, system instability, or evasion of memory-based detection mechanisms.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd` proctitle = "*swapoff*" AND proctitle = "*-a*"
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY proctitle dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_hardware_addition_swapoff_filter`
+search: |
+    `linux_auditd` type=EXECVE proctitle="*swapoff*" proctitle="*-a*" | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_hardware_addition_swapoff_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: administrator may disable swapping of devices in a linux host. Filter is needed.
 references:
@@ -29,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml
index ef45e20c71e..4fed5cebf6f 100644
--- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml
+++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd` execve_command IN ("*touch *", "*mkdir *", "*vim *", "*vi *", "*nano *") AND execve_command IN ("* ./.*", "* .*", "*/.*")
-      | rename host as dest
-      | rename comm as process_name
-      | rename exe as process
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY argc execve_command dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_hidden_files_and_directories_creation_filter`
+search: |
+    `linux_auditd` type=EXECVE execve_command IN ("*touch *", "*mkdir *", "*vim *", "*vi *", "*nano *") execve_command IN ("* ./.*", "* .*", "*/.*") | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by execve_command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_hidden_files_and_directories_creation_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml
index d47d541e842..cf00700c56b 100644
--- a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml
+++ b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects the insertion of a Linux kernel module using the insmod utility. It leverages data from Linux Auditd, focusing on process execution logs that include process names and command-line details. This activity is significant as it may indicate the installation of a rootkit or malicious kernel module, potentially allowing an attacker to gain elevated privileges and bypass security detections. If confirmed malicious, this could lead to unauthorized code execution, persistent access, and severe compromise of the affected system.
 data_source:
     - Linux Auditd Syscall
-search: |-
-    `linux_auditd` type=SYSCALL comm=insmod
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY comm exe syscall
-           uid ppid pid
-           success dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_insert_kernel_module_using_insmod_utility_filter`
+search: |
+    `linux_auditd` type="SYSCALL" comm="insmod" | stats count min(_time) as firstTime max(_time) as lastTime by comm exe syscall uid ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_insert_kernel_module_using_insmod_utility_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -34,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml
index c4cf17e455d..7fa512f19a1 100644
--- a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml
+++ b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects the installation of a Linux kernel module using the modprobe utility. It leverages data from Linux Auditd, focusing on process names and command-line executions. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security.
 data_source:
     - Linux Auditd Syscall
-search: |-
-    `linux_auditd` type=SYSCALL comm=modprobe
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY comm exe syscall
-           uid ppid pid
-           success dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_install_kernel_module_using_modprobe_utility_filter`
+search: |
+    `linux_auditd` type="SYSCALL" comm="modprobe" | stats count min(_time) as firstTime max(_time) as lastTime by comm exe syscall uid ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_install_kernel_module_using_modprobe_utility_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -33,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml
index 088a1b0797b..b80beac951b 100644
--- a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml
+++ b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. This detection leverages data from Linux Auditd, focusing on process names and command-line executions. While listing kernel modules is not inherently malicious, it can be a precursor to loading unauthorized modules using 'insmod'. If confirmed malicious, this activity could allow an attacker to load kernel modules, potentially leading to privilege escalation, persistence, or other malicious actions within the system.
 data_source:
     - Linux Auditd Syscall
-search: |-
-    `linux_auditd` type=SYSCALL comm=lsmod
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY comm exe syscall
-           uid ppid pid
-           success dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_kernel_module_enumeration_filter`
+search: |
+    `linux_auditd` type="SYSCALL" comm="lsmod" | stats count min(_time) as firstTime max(_time) as lastTime by comm exe syscall uid ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_kernel_module_enumeration_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml
index 7f51a51a4ff..eb8c522d293 100644
--- a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml
+++ b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects suspicious use of the `rmmod` utility for kernel module removal, which may indicate an attacker attempt to unload critical or security-related kernel modules. The `rmmod` command is used to remove modules from the Linux kernel, and unauthorized use can be a tactic to disable security features, conceal malicious activities, or disrupt system operations. By monitoring for unusual or unauthorized `rmmod` activity, this analytic helps identify potential tampering with kernel modules, enabling security teams to take proactive measures to protect system integrity and security.
 data_source:
     - Linux Auditd Syscall
-search: |-
-    `linux_auditd` type=SYSCALL comm=rmmod
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY comm exe syscall
-           uid ppid pid
-           success dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_kernel_module_using_rmmod_utility_filter`
+search: |
+    `linux_auditd` type="SYSCALL" comm="rmmod" | stats count min(_time) as firstTime max(_time) as lastTime by comm exe syscall uid ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_kernel_module_using_rmmod_utility_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A SYSCALL - [$comm$] event was executed on host - [$dest$] to remove a Linux kernel module using the rmmod utility.
     entity:
diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml
index 86f12f9cfd5..294482e1976 100644
--- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml
+++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml
@@ -9,14 +9,8 @@ type: Anomaly
 description: The following analytic detects the addition of NOPASSWD entries to the /etc/sudoers file on Linux systems. It leverages Linux Auditd data to identify command lines containing "NOPASSWD:". This activity is significant because it allows users to execute commands with elevated privileges without requiring a password, which can be exploited by adversaries to maintain persistent, privileged access. If confirmed malicious, this could lead to unauthorized privilege escalation, persistent access, and potential compromise of sensitive data and system integrity.
 data_source:
     - Linux Auditd Proctitle
-search: |-
-    `linux_auditd` proctitle = "*NOPASSWD*"
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY proctitle dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_nopasswd_entry_in_sudoers_file_filter`
+search: |
+    `linux_auditd` type=PROCTITLE proctitle="*NOPASSWD*" | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_nopasswd_entry_in_sudoers_file_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -30,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml
index f37077de4e0..a858c7a044c 100644
--- a/detections/endpoint/linux_auditd_osquery_service_stop.yml
+++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml
@@ -9,15 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious stopping of the `osquery` service, which may indicate an attempt to disable monitoring and evade detection. `Osquery` is a powerful tool used for querying system information and detecting anomalies, and stopping its service can be a sign that an attacker is trying to disrupt security monitoring or hide malicious activities. By monitoring for unusual or unauthorized stops of the `osquery` service, this analytic helps identify potential efforts to bypass security controls, enabling security teams to investigate and respond to possible threats effectively.
 data_source:
     - Linux Auditd Service Stop
-search: |-
-    `linux_auditd` type=SERVICE_STOP unit IN ("osqueryd")
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY type pid comm
-           exe unit dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_osquery_service_stop_filter`
+search: |
+    `linux_auditd` type=SERVICE_STOP unit="osqueryd" | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by unit | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_osquery_service_stop_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -30,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml
index 542179da1d5..dd3460d730d 100644
--- a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml
+++ b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml
@@ -6,12 +6,15 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects access, deletion or modification of the ssh_config file on Linux systems.
+description: 'The following analytic detects access, deletion or modification of the ssh_config file on Linux systems.
+
     It leverages data from Linux Auditd, focusing on events of type PATH with a nametype of ("NORMAL", "CREATE", "DELETE").
+
     This activity could be significant because unauthorized changes to ssh_config can allow threat actors to redirect port connections or use unauthorized keys, potentially compromising the system.
+
     Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
-    If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent backdoor access, posing a severe security risk.
+
+    If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent backdoor access, posing a severe security risk.'
 data_source:
     - Linux Auditd Path
     - Linux Auditd Cwd
@@ -52,19 +55,26 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     |  `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`
-how_to_implement: |
-    To implement this detection, the process begins by ingesting auditd
+how_to_implement: 'To implement this detection, the process begins by ingesting auditd
+
     data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
+
     executions and process details on Unix/Linux systems. These logs should be ingested
+
     and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
+
     which is essential for correctly parsing and categorizing the data. The next step
+
     involves normalizing the field names  to match the field names set by the Splunk
+
     Common Information Model (CIM) to ensure consistency across different data sources
+
     and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
-    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
-known_false_positives: |
-    Administrator or network operator can use this commandline for automation purposes.
-    Please update the filter macros to remove false positives.
+
+    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.'
+known_false_positives: 'Administrator or network operator can use this commandline for automation purposes.
+
+    Please update the filter macros to remove false positives.'
 references:
     - https://www.hackingarticles.in/ssh-penetration-testing-port-22/
     - https://attack.mitre.org/techniques/T1098/004/
@@ -76,7 +86,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml
index 03d5a7c4cae..a91760ba822 100644
--- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml
+++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects attempts to access or dump the contents of /etc/passwd and /etc/shadow files on Linux systems. It leverages data from Linux Auditd, focusing on processes like 'cat', 'nano', 'vim', and 'vi' accessing these files. This activity is significant as it may indicate credential dumping, a technique used by adversaries to gain persistence or escalate privileges. If confirmed malicious, privileges. If confirmed malicious, attackers could obtain hashed passwords for offline cracking, leading to unauthorized access and potential system compromise.
 data_source:
     - Linux Auditd Proctitle
-search: "`linux_auditd`  proctitle IN (\"*shadow*\", \"*passwd*\") AND proctitle IN (\"*cat *\", \"*nano *\", \"*vim *\", \"*vi *\")\n  | rename host as dest\n  | stats count min(_time) as firstTime max(_time) as lastTime\n    BY proctitle dest\n  | `security_content_ctime(firstTime)`\n  | `security_content_ctime(lastTime)`\n  | `linux_auditd_possible_access_to_credential_files_filter`"
+search: |
+    `linux_auditd` type=PROCTITLE proctitle IN ("*shadow*", "*passwd*") proctitle IN ("*cat *", "*nano *", "*vim *", "*vi *") | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_possible_access_to_credential_files_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml
index ed0238241a5..8dd9010a8d4 100644
--- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml
+++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml
@@ -6,12 +6,15 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects potential access or modification of the /etc/sudoers file on a Linux system.
+description: 'The following analytic detects potential access or modification of the /etc/sudoers file on a Linux system.
+
     It leverages data from Linux Auditd, focusing on events of type PATH or CWD.
+
     This activity could be significant because the sudoers file controls user permissions for executing commands with elevated privileges.
+
     Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
-    If confirmed malicious, an attacker could gain persistence or escalate privileges, compromising the security of the targeted host.
+
+    If confirmed malicious, an attacker could gain persistence or escalate privileges, compromising the security of the targeted host.'
 data_source:
     - Linux Auditd Path
     - Linux Auditd Cwd
@@ -48,19 +51,26 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `linux_auditd_possible_access_to_sudoers_file_filter`
-how_to_implement: |
-    To implement this detection, the process begins by ingesting auditd
+how_to_implement: 'To implement this detection, the process begins by ingesting auditd
+
     data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
+
     executions and process details on Unix/Linux systems. These logs should be ingested
+
     and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
+
     which is essential for correctly parsing and categorizing the data. The next step
+
     involves normalizing the field names  to match the field names set by the Splunk
+
     Common Information Model (CIM) to ensure consistency across different data sources
+
     and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
-    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
-known_false_positives: |
-    Administrator or network operator can execute this command.
-    Please update the filter macros to remove false positives.
+
+    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.'
+known_false_positives: 'Administrator or network operator can execute this command.
+
+    Please update the filter macros to remove false positives.'
 references:
     - https://attack.mitre.org/techniques/T1548/003/
     - https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf
@@ -72,7 +82,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml
index e69e9c675e8..7139536450b 100644
--- a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml
+++ b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml
@@ -6,12 +6,15 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
-description: |
-    The following analytic detects potential tampering with cronjob files on a Linux system.
+description: 'The following analytic detects potential tampering with cronjob files on a Linux system.
+
     It leverages logs from Linux Auditd, focusing on events of type PATH or CWD.
+
     This activity could be significant because adversaries often use it for persistence or privilege escalation.
+
     Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
-    If confirmed malicious, this could allow attackers to execute unauthorized code automatically, leading to system compromises and unauthorized data access, thereby impacting business operations and data integrity.
+
+    If confirmed malicious, this could allow attackers to execute unauthorized code automatically, leading to system compromises and unauthorized data access, thereby impacting business operations and data integrity.'
 data_source:
     - Linux Auditd Path
     - Linux Auditd Cwd
@@ -47,19 +50,26 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`
-how_to_implement: |
-    To implement this detection, the process begins by ingesting auditd
+how_to_implement: 'To implement this detection, the process begins by ingesting auditd
+
     data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
+
     executions and process details on Unix/Linux systems. These logs should be ingested
+
     and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
+
     which is essential for correctly parsing and categorizing the data. The next step
+
     involves normalizing the field names  to match the field names set by the Splunk
+
     Common Information Model (CIM) to ensure consistency across different data sources
+
     and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
-    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
-known_false_positives: |
-    False positives may arise from legitimate actions by administrators or network operators who may use these commands for automation purposes.
-    Therefore, it's recommended to adjust filter macros to eliminate such false positives.
+
+    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.'
+known_false_positives: 'False positives may arise from legitimate actions by administrators or network operators who may use these commands for automation purposes.
+
+    Therefore, it''s recommended to adjust filter macros to eliminate such false positives.'
 references:
     - https://attack.mitre.org/techniques/T1053/003/
     - https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability
diff --git a/detections/endpoint/linux_auditd_possible_setuid_execve_privesc.yml b/detections/endpoint/linux_auditd_possible_setuid_execve_privesc.yml
index 0b55d776075..ef06861bca0 100644
--- a/detections/endpoint/linux_auditd_possible_setuid_execve_privesc.yml
+++ b/detections/endpoint/linux_auditd_possible_setuid_execve_privesc.yml
@@ -9,31 +9,8 @@ type: Anomaly
 description: The following detects privilege escalation via execve (syscall 59) where a process transitions from a non-root uid to euid=0 without a corresponding successful PAM authentication event (USER_AUTH, USER_ACCT, or CRED_ACQ) in the same audit session. Legitimate privilege elevation mechanisms such as sudo, su, and pkexec authenticate through PAM and generate these audit records tied to the session ID before granting elevated privileges. The absence of a matching successful PAM event alongside an effective UID change to root is anomalous and may indicate exploitation of a setuid binary, a kernel vulnerability, or another mechanism used to escalate privileges outside the normal authentication flow.
 data_source:
     - Linux Auditd Execve
-search: >-
-    `linux_auditd` (
-    (type=SYSCALL syscall="59" uid!="0" euid="0")
-    OR
-    (type IN ("USER_AUTH","USER_ACCT","CRED_ACQ") res="success")
-    )
-    | eval is_suspicious_exec=if(type="SYSCALL" AND syscall="59" AND uid!="0" AND euid="0", 1, 0)
-    | eval is_successful_auth=if(type IN ("USER_AUTH","USER_ACCT","CRED_ACQ") AND res="success", 1, 0)
-    | stats
-        count(eval(is_suspicious_exec=1)) as exec_count
-        max(eval(if(is_suspicious_exec=1, _time, null()))) as lastTime
-        max(is_successful_auth) as has_successful_auth
-        min(eval(if(is_suspicious_exec=1, _time, null()))) as firstTime
-        values(eval(if(is_suspicious_exec=1, comm, null()))) as process_name
-        values(eval(if(is_suspicious_exec=1, euid, null()))) as euid
-        values(eval(if(is_suspicious_exec=1, exe, null()))) as process_path
-        values(eval(if(is_suspicious_exec=1, pid, null()))) as pid
-        values(eval(if(is_suspicious_exec=1, ppid, null()))) as ppid
-        values(eval(if(is_suspicious_exec=1, uid, null()))) as uid
-        by host ses
-    | where exec_count > 0 AND has_successful_auth != 1
-    | rename host as dest, ses as session_id
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_auditd_possible_setuid_execve_privesc_filter`
+search: |
+    `linux_auditd` type=EXECVE (type="SYSCALL" syscall="59" NOT uid="0" euid="0") OR (type IN ("USER_AUTH", "USER_ACCT", "CRED_ACQ") res="success") | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by type syscall uid euid res | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_possible_setuid_execve_privesc_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
 known_false_positives: Processes with an unset audit session, such as cron jobs, that legitimately drop and reacquire root privileges outside of PAM, may trigger this detection and require filtering.
 references:
@@ -47,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml
index 2916473fae0..51e606a96e0 100644
--- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml
+++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects the use of the LD_PRELOAD environment variable to hijack or hook library functions on a Linux platform. It leverages data from Linux Auditd, focusing on process execution logs that include command-line details. This activity is significant because adversaries, malware authors, and red teamers commonly use this technique to gain elevated privileges and establish persistence on a compromised machine. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, and maintain long-term access to the system.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd` execve_command = "*LD_PRELOAD*"
-      | rename host as dest
-      | rename comm as process_name
-      | rename exe as process
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY argc execve_command dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_preload_hijack_library_calls_filter`
+search: |
+    `linux_auditd` type=EXECVE execve_command="*LD_PRELOAD*" | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by execve_command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_preload_hijack_library_calls_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A [$execve_command$] event occurred on host - [$dest$] to hijack or hook library functions using the LD_PRELOAD environment variable.
     entity:
diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml
index c679c44fbb7..7d2e363a9ec 100644
--- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml
+++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml
@@ -6,11 +6,13 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects suspicious preload hijacking via the `preload` file, which may indicate an attacker's attempt to intercept or manipulate library loading processes.
+description: 'The following analytic detects suspicious preload hijacking via the `preload` file, which may indicate an attacker''s attempt to intercept or manipulate library loading processes.
+
     The `preload` file can be used to force the loading of specific libraries before others, potentially allowing malicious code to execute or alter application behavior.
+
     By monitoring for unusual or unauthorized modifications to the `preload` file, this analytic helps identify attempts to hijack preload mechanisms, enabling security teams to investigate and address potential threats to system integrity and security.
-    Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
+
+    Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.'
 data_source:
     - Linux Auditd Path
     - Linux Auditd Cwd
@@ -47,19 +49,26 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `linux_auditd_preload_hijack_via_preload_file_filter`
-how_to_implement: |
-    To implement this detection, the process begins by ingesting auditd
+how_to_implement: 'To implement this detection, the process begins by ingesting auditd
+
     data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
+
     executions and process details on Unix/Linux systems. These logs should be ingested
+
     and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
+
     which is essential for correctly parsing and categorizing the data. The next step
+
     involves normalizing the field names  to match the field names set by the Splunk
+
     Common Information Model (CIM) to ensure consistency across different data sources
+
     and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
-    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
-known_false_positives: |
-    Administrator or network operator can use this application for automation purposes.
-    Please update the filter macros to remove false positives.
+
+    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.'
+known_false_positives: 'Administrator or network operator can use this application for automation purposes.
+
+    Please update the filter macros to remove false positives.'
 references:
     - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
 drilldown_searches:
@@ -70,7 +79,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A [$nametype$] event has occurred on host - [$dest$] to modify the preload file.
     entity:
diff --git a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml
index 8c435ee330a..f8427808108 100644
--- a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml
+++ b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious attempts to find private keys, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and identity theft. By monitoring for unusual or unauthorized searches for private keys, this analytic helps identify potential threats to cryptographic security, enabling security teams to take swift action to protect the integrity and confidentiality of encrypted information.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd` execve_command IN ("*find*", "*grep*") AND execve_command IN ("*.pem*", "*.cer*", "*.crt*", "*.pgp*", "*.key*", "*.gpg*", "*.ppk*", "*.p12*", "*.pfx*", "*.p7b*")
-      | rename host as dest
-      | rename comm as process_name
-      | rename exe as process
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY argc execve_command dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_private_keys_and_certificate_enumeration_filter`
+search: |
+    `linux_auditd` type=EXECVE execve_command IN ("*find*", "*grep*") execve_command IN ("*.pem*", "*.cer*", "*.crt*", "*.pgp*", "*.key*", "*.gpg*", "*.ppk*", "*.p12*", "*.pfx*", "*.p7b*") | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by execve_command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_private_keys_and_certificate_enumeration_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_service_restarted.yml b/detections/endpoint/linux_auditd_service_restarted.yml
index aa5a03a0e50..3d7158b1fcd 100644
--- a/detections/endpoint/linux_auditd_service_restarted.yml
+++ b/detections/endpoint/linux_auditd_service_restarted.yml
@@ -9,14 +9,8 @@ type: Anomaly
 description: The following analytic detects the restarting or re-enabling of services on Linux systems using the `systemctl` or `service` commands. It leverages data from Linux Auditd, focusing on process and command-line execution logs. This activity is significant as adversaries may use it to maintain persistence or execute unauthorized actions. If confirmed malicious, this behavior could lead to repeated execution of malicious payloads, unauthorized access, or data destruction. Security analysts should investigate these events to mitigate risks and prevent further compromise.
 data_source:
     - Linux Auditd Proctitle
-search: |-
-    `linux_auditd`  proctitle IN ("*systemctl *", "*service *") AND proctitle IN ("*restart*", "*reenable*", "*reload*")
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY proctitle dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_service_restarted_filter`
+search: |
+    `linux_auditd` type=PROCTITLE proctitle IN ("*systemctl *", "*service *") proctitle IN ("*restart*", "*reenable*", "*reload*") | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_service_restarted_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -29,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml
index f279e04f61e..555973e14eb 100644
--- a/detections/endpoint/linux_auditd_service_started.yml
+++ b/detections/endpoint/linux_auditd_service_started.yml
@@ -9,14 +9,8 @@ type: Anomaly
 description: The following analytic detects the suspicious service started. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
 data_source:
     - Linux Auditd Proctitle
-search: |-
-    `linux_auditd`  proctitle IN ("*systemctl *", "*service *") AND proctitle IN ("* start*", "* enable*")
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY proctitle dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_service_started_filter`
+search: |
+    `linux_auditd` type=PROCTITLE proctitle IN ("*systemctl *", "*service *") proctitle IN ("* start*", "* enable*") | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_service_started_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -29,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml
index 686f58eb004..dbaf74ede22 100644
--- a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml
+++ b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml
@@ -9,14 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the chmod utility to set the SUID or SGID bit on files, which can allow users to temporarily gain root or group-level access. This detection leverages data from Linux Auditd, focusing on process names and command-line arguments related to chmod. This activity is significant as it can indicate an attempt to escalate privileges or maintain persistence on a system. If confirmed malicious, an attacker could gain elevated access, potentially compromising sensitive data or critical system functions.
 data_source:
     - Linux Auditd Proctitle
-search: |-
-    `linux_auditd`  proctitle IN ("*chmod *")  AND proctitle IN ("* u+s *", "* g+s *", "* 4777 *", "* 4577 *")
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY proctitle dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_setuid_using_chmod_utility_filter`
+search: |
+    `linux_auditd` type=PROCTITLE proctitle="*chmod *" proctitle IN ("* u+s *", "* g+s *", "* 4777 *", "* 4577 *") | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_setuid_using_chmod_utility_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -29,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml
index fa36fafedb3..b1bd1a31442 100644
--- a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml
+++ b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the 'setcap' utility to enable the SUID bit on Linux systems. It leverages Linux Auditd data, focusing on process names and command-line arguments that indicate the use of 'setcap' with specific capabilities. This activity is significant because setting the SUID bit allows a user to temporarily gain root access, posing a substantial security risk. If confirmed malicious, an attacker could escalate privileges, execute arbitrary commands with elevated permissions, and potentially compromise the entire system.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd` execve_command IN ("*setcap *")  AND execve_command IN ("*cap_setuid+ep*", "*cap_setuid=ep*", "*cap_net_bind_service+p*", "*cap_net_raw+ep*", "*cap_dac_read_search+ep*")
-      | rename host as dest
-      | rename comm as process_name
-      | rename exe as process
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY argc execve_command dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_setuid_using_setcap_utility_filter`
+search: |
+    `linux_auditd` type=EXECVE execve_command="*setcap *" execve_command IN ("*cap_setuid+ep*", "*cap_setuid=ep*", "*cap_net_bind_service+p*", "*cap_net_raw+ep*", "*cap_dac_read_search+ep*") | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by execve_command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_setuid_using_setcap_utility_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A [$execve_command$] event occurred on host - [$dest$] to set the SUID or SGID bit on files using the setcap utility.
     entity:
diff --git a/detections/endpoint/linux_auditd_shred_overwrite_command.yml b/detections/endpoint/linux_auditd_shred_overwrite_command.yml
index 762eebb6689..4e1528b9a71 100644
--- a/detections/endpoint/linux_auditd_shred_overwrite_command.yml
+++ b/detections/endpoint/linux_auditd_shred_overwrite_command.yml
@@ -9,14 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. It leverages data from Linux Auditd, focusing on process names and command-line arguments. This activity is significant because the 'shred' command can be used in destructive attacks, such as those seen in the Industroyer2 malware targeting energy facilities. If confirmed malicious, this activity could lead to the permanent destruction of critical files, severely impacting system integrity and data availability.
 data_source:
     - Linux Auditd Proctitle
-search: |-
-    `linux_auditd`  proctitle IN ("*shred*")  AND proctitle IN ("*-n*", "*-z*", "*-u*", "*-s*")
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY proctitle dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_shred_overwrite_command_filter`
+search: |
+    `linux_auditd` type=PROCTITLE proctitle="*shred*" proctitle IN ("*-n*", "*-z*", "*-u*", "*-s*") | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_shred_overwrite_command_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -30,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A [$proctitle$] event occurred on host - [$dest$] to overwrite files using the shred utility.
     entity:
diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml
index 096dc9401e6..f827dbaaa06 100644
--- a/detections/endpoint/linux_auditd_stop_services.yml
+++ b/detections/endpoint/linux_auditd_stop_services.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic detects attempts to stop a service on Linux systems. It leverages data from Linux Auditd. This activity is significant as adversaries often stop or terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, allowing attackers to persist, escalate privileges, or deploy destructive payloads, severely impacting system integrity and availability.
 data_source:
     - Linux Auditd Service Stop
-search: |-
+search: |
     `linux_auditd` type=SERVICE_STOP
       | rename host as dest
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 analytic_story:
     - Industroyer2
     - Data Destruction
diff --git a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml
index 1a417a27cbf..110fddcf8bf 100644
--- a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml
+++ b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml
@@ -9,14 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the "sudo" or "su" command on a Linux operating system. It leverages data from Linux Auditd, focusing on process names and parent process names. This activity is significant because "sudo" and "su" commands are commonly used by adversaries to elevate privileges, potentially leading to unauthorized access or control over the system. If confirmed malicious, this activity could allow attackers to execute commands with root privileges, leading to severe security breaches, data exfiltration, or further system compromise.
 data_source:
     - Linux Auditd Proctitle
-search: |-
-    `linux_auditd`  proctitle IN ("*sudo *", "*su *")
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY proctitle dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_sudo_or_su_execution_filter`
+search: |
+    `linux_auditd` type=PROCTITLE proctitle IN ("*sudo *", "*su *") | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by proctitle | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_sudo_or_su_execution_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -29,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml
index 0b137a571fb..03693161d22 100644
--- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml
+++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml
@@ -9,15 +9,8 @@ type: Anomaly
 description: The following analytic detects the suspicious sysmon service stop. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
 data_source:
     - Linux Auditd Service Stop
-search: |-
-    `linux_auditd` type=SERVICE_STOP unit IN ("sysmon")
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY type pid comm
-           exe unit dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_sysmon_service_stop_filter`
+search: |
+    `linux_auditd` type=SERVICE_STOP unit="sysmon" | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by unit | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_sysmon_service_stop_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -30,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml
index 0935ded19f5..733d615eec5 100644
--- a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml
+++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects suspicious system network configuration discovery activities, which may indicate an adversary's attempt to gather information about the network environment. Such actions typically involve commands or tools used to identify network interfaces, routing tables, and active connections. Detecting these activities is crucial, as they often precede more targeted attacks like lateral movement or data exfiltration. By identifying unusual or unauthorized network discovery efforts, this analytic helps security teams to swiftly detect and respond to potential reconnaissance operations, mitigating the risk of further compromise.
 data_source:
     - Linux Auditd Syscall
-search: |-
+search: |
     `linux_auditd` type=SYSCALL comm IN ("arp", "ifconfig", "ip", "netstat", "firewall-cmd", "ufw", "iptables", "ss", "route")
       | bucket _time span=15m
       | rename host as dest
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml
index 0a7ed99af8b..5afe10b08db 100644
--- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml
+++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml
@@ -6,12 +6,15 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects suspicious access or modifications to Unix shell configuration files, which may indicate an attempt to alter system behavior or gain unauthorized access.
+description: 'The following analytic detects suspicious access or modifications to Unix shell configuration files, which may indicate an attempt to alter system behavior or gain unauthorized access.
+
     Unix shell configuration files, such as `.bashrc` or `.profile`, control user environment settings and command execution.
+
     Unauthorized changes to these files can be used to execute malicious commands, escalate privileges, or hide malicious activities.
+
     By monitoring for unusual or unauthorized modifications to shell configuration files, this analytic helps identify potential security threats, allowing security teams to respond quickly and mitigate risks.
-    Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
+
+    Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.'
 data_source:
     - Linux Auditd Path
     - Linux Auditd Cwd
@@ -48,19 +51,26 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `linux_auditd_unix_shell_configuration_modification_filter`
-how_to_implement: |
-    To implement this detection, the process begins by ingesting auditd
+how_to_implement: 'To implement this detection, the process begins by ingesting auditd
+
     data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
+
     executions and process details on Unix/Linux systems. These logs should be ingested
+
     and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
+
     which is essential for correctly parsing and categorizing the data. The next step
+
     involves normalizing the field names  to match the field names set by the Splunk
+
     Common Information Model (CIM) to ensure consistency across different data sources
+
     and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
-    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
-known_false_positives: |
-    Administrator or network operator can use this application for automation purposes.
-    Please update the filter macros to remove false positives.
+
+    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.'
+known_false_positives: 'Administrator or network operator can use this application for automation purposes.
+
+    Please update the filter macros to remove false positives.'
 references:
     - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
     - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS
@@ -72,7 +82,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A [$nametype$] event occurred on host - [$dest$] to modify the unix shell configuration file.
     entity:
diff --git a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml
index 978e2f9675d..0bb4e4e4ecf 100644
--- a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml
+++ b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects suspicious use of the `modprobe` command to unload kernel modules, which may indicate an attempt to disable critical system components or evade detection. The `modprobe` utility manages kernel modules, and unauthorized unloading of modules can disrupt system security features, remove logging capabilities, or conceal malicious activities. By monitoring for unusual or unauthorized `modprobe` operations involving module unloading, this analytic helps identify potential tampering with kernel functionality, enabling security teams to investigate and address possible threats to system integrity.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd` execve_command = "*modprobe*" AND execve_command = "*-r *"
-      | rename host as dest
-      | rename comm as process_name
-      | rename exe as process
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY argc execve_command dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_unload_module_via_modprobe_filter`
+search: |
+    `linux_auditd` type=EXECVE execve_command="*modprobe*" execve_command="*-r *" | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by execve_command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_unload_module_via_modprobe_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A [$execve_command$] event occurred on host - [$dest$] to unload a kernel module via the modprobe command.
     entity:
diff --git a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml
index d6396a402c1..600b431e924 100644
--- a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml
+++ b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious discovery of virtual disk files and directories, which may indicate an attacker's attempt to locate and access virtualized storage environments. Virtual disks can contain sensitive data or critical system configurations, and unauthorized discovery attempts could signify preparatory actions for data exfiltration or further compromise. By monitoring for unusual or unauthorized searches for virtual disk files and directories, this analytic helps identify potential reconnaissance activities, enabling security teams to respond promptly and safeguard against unauthorized access and data breaches.
 data_source:
     - Linux Auditd Execve
-search: |-
-    `linux_auditd` execve_command IN ("*find*", "*grep*")  AND execve_command IN ("*.vhd*", "*.vhdx*", "*.vmdk*")
-      | rename host as dest
-      | rename comm as process_name
-      | rename exe as process
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY argc execve_command dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_virtual_disk_file_and_directory_discovery_filter`
+search: |
+    `linux_auditd` type=EXECVE execve_command IN ("*find*", "*grep*") execve_command IN ("*.vhd*", "*.vhdx*", "*.vmdk*") | eval dest=host, process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by execve_command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_virtual_disk_file_and_directory_discovery_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml
index 99c021d2f88..ffebe67bfc5 100644
--- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml
+++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects the suspicious use of the whoami command, which may indicate an attacker trying to gather information about the current user account on a compromised system. The whoami command is commonly used to verify user privileges and identity, especially during initial stages of an attack to assess the level of access. By monitoring for unusual or unauthorized executions of whoami, this analytic helps in identifying potential reconnaissance activities, enabling security teams to take action before the attacker escalates privileges or conducts further malicious operations.
 data_source:
     - Linux Auditd Syscall
-search: |-
-    `linux_auditd` type=SYSCALL comm=whoami OR exe= "*/whoami"
-      | rename host as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY comm exe syscall
-           uid ppid pid
-           dest success
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `linux_auditd_whoami_user_discovery_filter`
+search: |
+    `linux_auditd` (type="SYSCALL" comm="whoami") OR exe="*/whoami" | stats count min(_time) as firstTime max(_time) as lastTime by comm exe syscall uid ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_whoami_user_discovery_filter`
 how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -33,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_awk_privilege_escalation.yml b/detections/endpoint/linux_awk_privilege_escalation.yml
index 39bb5b50492..59bce6fcb1d 100644
--- a/detections/endpoint/linux_awk_privilege_escalation.yml
+++ b/detections/endpoint/linux_awk_privilege_escalation.yml
@@ -9,24 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of the AWK command with elevated privileges to execute system commands. It leverages Endpoint Detection and Response (EDR) telemetry, specifically monitoring processes that include "sudo," "awk," and "BEGIN*system" in their command lines. This activity is significant because it indicates a potential privilege escalation attempt, where a user could gain root access by executing commands as the root user. If confirmed malicious, this could allow an attacker to fully compromise the system, execute arbitrary commands, and maintain persistent control over the affected endpoint.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*sudo*"
-        AND
-        Processes.process="*awk*"
-        AND
-        Processes.process="*BEGIN*system*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_awk_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*sudo*" Processes.process="*awk*" Processes.process="*BEGIN*system*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_awk_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
 references:
@@ -39,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml b/detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml
index d8207546a9d..c4e62877ed9 100644
--- a/detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml
+++ b/detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml
@@ -6,39 +6,13 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies the execution of a binary by root from Linux shared memory directories (/dev/shm/ and /run/shm/). Threat actors place executables in these directories to persist on high-uptime servers as system backdoors. Both /dev/shm and /run/shm are tmpfs-backed directories that exist only in virtual memory with no persistent storage, making them attractive for staging fileless or semi-fileless malware while avoiding disk forensics.
+description: The following analytic identifies the execution of a binary by root from Linux shared memory directories (/dev/shm/ and /run/shm/). Threat actors place executables in these directories to persist on high-uptime servers as system backdoors. Both /dev/shm and /run/shm are tmpfs-backed directories that exist only in virtual memory with no persistent storage, making them attractive for staging fileless or semi-fileless malware while avoiding disk forensics.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_path IN (
-        "/dev/shm/*",
-        "/run/shm/*"
-    )
-    Processes.user=root
-
-    by Processes.process Processes.process_path Processes.process_name Processes.user
-       Processes.user_id Processes.process_hash Processes.parent_process_name
-       Processes.parent_process_path Processes.parent_process Processes.parent_process_guid
-       Processes.parent_process_id Processes.process_guid Processes.process_id
-       Processes.vendor_product Processes.action Processes.dest
-       Processes.process_current_directory Processes.process_integrity_level
-       Processes.original_file_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_binary_executed_from_shared_memory_directory_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate applications may use shared memory directories for temporary file storage or inter-process communication. Verify any flagged activity against known software behavior and filter accordingly.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path IN ("/dev/shm/*", "/run/shm/*") Processes.user="root" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_binary_executed_from_shared_memory_directory_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate applications may use shared memory directories for temporary file storage or inter-process communication. Verify any flagged activity against known software behavior and filter accordingly.
 references:
     - https://linuxsecurity.com/features/fileless-malware-on-linux
     - https://twitter.com/GossiTheDog/status/1522964028284411907
@@ -83,8 +57,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_binary_launched_process_with_null_argv.yml b/detections/endpoint/linux_binary_launched_process_with_null_argv.yml
index 9dec0940f7d..464c24292dc 100644
--- a/detections/endpoint/linux_binary_launched_process_with_null_argv.yml
+++ b/detections/endpoint/linux_binary_launched_process_with_null_argv.yml
@@ -6,8 +6,7 @@ modification_date: '2026-07-17'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects kernel-level events where a setuid binary launches a shell or interpreter with a NULL argument vector, which occurs when a privilege escalation exploit gains root and executes a process via execve() without constructing a legitimate argument array.
+description: The following analytic detects kernel-level events where a setuid binary launches a shell or interpreter with a NULL argument vector, which occurs when a privilege escalation exploit gains root and executes a process via execve() without constructing a legitimate argument array.
 data_source:
     - Linux Messages Syslog
 search: |
@@ -38,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Binary spawned process with NULL argv on $dest$ indicating possible privilege escalation.
     entity:
diff --git a/detections/endpoint/linux_busybox_privilege_escalation.yml b/detections/endpoint/linux_busybox_privilege_escalation.yml
index 02ae0a01999..588b8719748 100644
--- a/detections/endpoint/linux_busybox_privilege_escalation.yml
+++ b/detections/endpoint/linux_busybox_privilege_escalation.yml
@@ -9,24 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of BusyBox with sudo privileges, which can lead to privilege escalation on Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where BusyBox is executed with both 'sh' and 'sudo' commands. This activity is significant because it indicates a user may be attempting to gain root access, bypassing standard security controls. If confirmed malicious, this could allow an attacker to execute arbitrary commands as root, leading to full system compromise and potential persistence within the environment.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*busybox*"
-        AND
-        Processes.process="*sh*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_busybox_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*busybox*" Processes.process="*sh*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_busybox_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -40,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_c89_privilege_escalation.yml b/detections/endpoint/linux_c89_privilege_escalation.yml
index 76d3cac9dcd..794b9bf02c9 100644
--- a/detections/endpoint/linux_c89_privilege_escalation.yml
+++ b/detections/endpoint/linux_c89_privilege_escalation.yml
@@ -9,24 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the 'c89' command with elevated privileges, which can be used to compile and execute C programs as root. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events that include command-line arguments. This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute arbitrary commands as root. If confirmed malicious, this could lead to full system compromise, enabling the attacker to gain root access and execute any command with elevated privileges.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*c89*"
-        AND
-        Processes.process="*-wrapper*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_c89_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*c89*" Processes.process="*-wrapper*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_c89_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -40,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_c99_privilege_escalation.yml b/detections/endpoint/linux_c99_privilege_escalation.yml
index 558a0813c0e..4a9e51d4609 100644
--- a/detections/endpoint/linux_c99_privilege_escalation.yml
+++ b/detections/endpoint/linux_c99_privilege_escalation.yml
@@ -9,24 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the c99 utility with sudo privileges, which can lead to privilege escalation on Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it indicates a potential misuse of the c99 utility to gain root access, which is critical for maintaining system security. If confirmed malicious, this could allow an attacker to execute commands as root, potentially compromising the entire system and accessing sensitive information.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*c99*"
-        AND
-        Processes.process="*-wrapper*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_c99_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*c99*" Processes.process="*-wrapper*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_c99_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -40,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_change_file_owner_to_root.yml b/detections/endpoint/linux_change_file_owner_to_root.yml
index eecf6d4a6ca..eb0285475da 100644
--- a/detections/endpoint/linux_change_file_owner_to_root.yml
+++ b/detections/endpoint/linux_change_file_owner_to_root.yml
@@ -9,25 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of the 'chown' command to change a file owner to 'root' on a Linux system. It leverages Endpoint Detection and Response (EDR) telemetry, specifically monitoring command-line executions and process details. This activity is significant as it may indicate an attempt to escalate privileges by adversaries, malware, or red teamers. If confirmed malicious, this action could allow an attacker to gain root-level access, leading to full control over the compromised host and potential persistence within the environment.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name = chown
-            OR
-            Processes.process = "*chown *"
-        )
-        AND Processes.process = "* root *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_change_file_owner_to_root_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*chown" OR Processes.process="*chown *" Processes.process="* root *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_change_file_owner_to_root_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -41,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_clipboard_data_copy.yml b/detections/endpoint/linux_clipboard_data_copy.yml
index ff3d0c76b84..c028d9152d2 100644
--- a/detections/endpoint/linux_clipboard_data_copy.yml
+++ b/detections/endpoint/linux_clipboard_data_copy.yml
@@ -9,20 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of the Linux 'xclip' command to copy data from the clipboard. It leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line arguments related to clipboard operations. This activity is significant because adversaries can exploit clipboard data to capture sensitive information such as passwords or IP addresses. If confirmed malicious, this technique could lead to unauthorized data exfiltration, compromising sensitive information and potentially aiding further attacks within the environment.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=xclip Processes.process IN ("*-o *", "*-sel *", "*-selection *", "*clip *","*clipboard*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_clipboard_data_copy_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*xclip" Processes.process IN ("*-o *", "*-sel *", "*-selection *", "*clip *", "*clipboard*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_clipboard_data_copy_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present on Linux desktop as it may commonly be used by administrators or end users. Filter as needed.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml
index 6e626b9f65e..89d9c5919a5 100644
--- a/detections/endpoint/linux_common_process_for_elevation_control.yml
+++ b/detections/endpoint/linux_common_process_for_elevation_control.yml
@@ -9,22 +9,8 @@ type: Hunting
 description: The following analytic identifies the execution of common Linux processes used for elevation control, such as `chmod`, `chown`, and `setuid`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because these processes are often abused by adversaries to gain persistence or escalate privileges on compromised hosts. If confirmed malicious, this behavior could allow attackers to modify file attributes, change file ownership, or set user IDs, potentially leading to unauthorized access and control over critical system resources.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN ("chmod", "chown", "fchmod", "fchmodat", "fchown", "fchownat", "fremovexattr", "fsetxattr", "lchown", "lremovexattr", "lsetxattr", "removexattr", "setuid", "setgid", "setreuid", "setregid", "chattr")
-        OR
-        Processes.process IN ("*chmod *", "*chown *", "*fchmod *", "*fchmodat *", "*fchown *", "*fchownat *", "*fremovexattr *", "*fsetxattr *", "*lchown *", "*lremovexattr *", "*lsetxattr *", "*removexattr *", "*setuid *", "*setgid *", "*setreuid *", "*setregid *", "*setcap *", "*chattr *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_common_process_for_elevation_control_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*chmod", "*chown", "*fchmod", "*fchmodat", "*fchown", "*fchownat", "*fremovexattr", "*fsetxattr", "*lchown", "*lremovexattr", "*lsetxattr", "*removexattr", "*setuid", "*setgid", "*setreuid", "*setregid", "*chattr") OR Processes.process IN ("*chmod *", "*chown *", "*fchmod *", "*fchmodat *", "*fchown *", "*fchownat *", "*fremovexattr *", "*fsetxattr *", "*lchown *", "*lremovexattr *", "*lsetxattr *", "*removexattr *", "*setuid *", "*setgid *", "*setreuid *", "*setregid *", "*setcap *", "*chattr *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_common_process_for_elevation_control_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_composer_privilege_escalation.yml b/detections/endpoint/linux_composer_privilege_escalation.yml
index 40b480528b3..59445a5b681 100644
--- a/detections/endpoint/linux_composer_privilege_escalation.yml
+++ b/detections/endpoint/linux_composer_privilege_escalation.yml
@@ -9,24 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the Composer tool with elevated privileges on a Linux system. It identifies instances where Composer is run with the 'sudo' command, allowing the user to execute system commands as root. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because it can indicate an attempt to escalate privileges, potentially leading to unauthorized root access. If confirmed malicious, an attacker could gain full control over the system, execute arbitrary commands, and compromise sensitive data.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*composer*"
-        AND
-        Processes.process="*run-script*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_composer_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*composer*" Processes.process="*run-script*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_composer_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -40,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_cpulimit_privilege_escalation.yml b/detections/endpoint/linux_cpulimit_privilege_escalation.yml
index 6a81c07b714..9ee2a743cc6 100644
--- a/detections/endpoint/linux_cpulimit_privilege_escalation.yml
+++ b/detections/endpoint/linux_cpulimit_privilege_escalation.yml
@@ -9,26 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of the 'cpulimit' command with specific flags ('-l', '-f') executed with 'sudo' privileges. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line arguments and execution details. This activity is significant because if 'cpulimit' is granted sudo rights, a user can potentially execute system commands as root, leading to privilege escalation. If confirmed malicious, this could allow an attacker to gain root access, execute arbitrary commands, and fully compromise the affected system.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*cpulimit*"
-        AND
-        Processes.process="*-l*"
-        AND
-        Processes.process="*-f*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_cpulimit_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*cpulimit*" Processes.process="*-l*" Processes.process="*-f*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_cpulimit_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -42,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_crontab_enumeration.yml b/detections/endpoint/linux_crontab_enumeration.yml
index fbbe3ecedd9..c9d906b6b0a 100644
--- a/detections/endpoint/linux_crontab_enumeration.yml
+++ b/detections/endpoint/linux_crontab_enumeration.yml
@@ -6,39 +6,18 @@ modification_date: '2026-09-03'
 author: Teoderick Contreras, Bhavin Patel, Onur Mustafa Erdogan, Splunk
 status: production
 type: Hunting
-description: |-
-    The following analytic detects the use of the crontab command with the list parameter (-l) to enumerate scheduled tasks configured in the invoking user's crontab on Linux systems.
+description: 'The following analytic detects the use of the crontab command with the list parameter (-l) to enumerate scheduled tasks configured in the invoking user''s crontab on Linux systems.
+
     Adversaries may use this information to identify persistence mechanisms, scheduled execution, or potential privilege escalation opportunities.
-    The use of crontab -l is also common administrative activity and may require tuning based on the executing user, parent process, and environment.
+
+    The use of crontab -l is also common administrative activity and may require tuning based on the executing user, parent process, and environment.'
 data_source:
     - Sysmon for Linux EventID 1
     - Cisco Isovalent Process Exec
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    Processes.process_name = "crontab"
-    Processes.process= "* -l*"
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_crontab_enumeration_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*crontab" Processes.process="* -l*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_crontab_enumeration_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
     - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
     - https://cert.gov.ua/article/39518
diff --git a/detections/endpoint/linux_csvtool_privilege_escalation.yml b/detections/endpoint/linux_csvtool_privilege_escalation.yml
index 91a1474a5af..e6f9a457eab 100644
--- a/detections/endpoint/linux_csvtool_privilege_escalation.yml
+++ b/detections/endpoint/linux_csvtool_privilege_escalation.yml
@@ -9,24 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the 'csvtool' command with 'sudo' privileges, which can allow a user to run system commands as root. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it indicates a potential privilege escalation attempt, where a user could gain unauthorized root access. If confirmed malicious, this could lead to full system compromise, allowing an attacker to execute arbitrary commands, escalate privileges, and maintain persistent access.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*csvtool*"
-        AND
-        Processes.process="*call*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_csvtool_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*csvtool*" Processes.process="*call*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_csvtool_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -39,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_curl_upload_file.yml b/detections/endpoint/linux_curl_upload_file.yml
index 52c42cdbf09..fc3110f2fa6 100644
--- a/detections/endpoint/linux_curl_upload_file.yml
+++ b/detections/endpoint/linux_curl_upload_file.yml
@@ -10,7 +10,7 @@ description: The following analytic detects the use of the curl command with spe
 data_source:
     - Sysmon for Linux EventID 1
     - Cisco Isovalent Process Exec
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
       WHERE Processes.process_name=curl Processes.process IN ("*-F *", "*--form *","*--upload-file *","*-T *","*-d *","*--data *","*--data-raw *", "*-I *", "*--head *")
         AND
@@ -41,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ attempting to upload important files to a remote destination.
     entity:
diff --git a/detections/endpoint/linux_data_destruction_command.yml b/detections/endpoint/linux_data_destruction_command.yml
index ba11f557e11..5a62f33a7ad 100644
--- a/detections/endpoint/linux_data_destruction_command.yml
+++ b/detections/endpoint/linux_data_destruction_command.yml
@@ -6,43 +6,32 @@ modification_date: '2026-09-01'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host.
-    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the 'rm' command with the '--no-preserve-root' option.
+description: 'The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host.
+
+    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the ''rm'' command with the ''--no-preserve-root'' option.
+
     This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred.
+
     If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host.
-    Immediate investigation and response are crucial to mitigate potential damage.
+
+    Immediate investigation and response are crucial to mitigate potential damage.'
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    Processes.process_name = "rm"
-    Processes.process = "* --no-preserve-root*"
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rm" Processes.process="* --no-preserve-root*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_data_destruction_command_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
 
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `linux_data_destruction_command_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
     These agents are designed to provide security-related telemetry from the endpoints where the agent is installed.
+
     To implement this search, you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions.
+
     These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product.
+
     The logs must also be mapped to the `Processes` node of the `Endpoint` data model.
-    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+
+    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.'
 known_false_positives: No false positives have been identified at this time.
 references:
     - https://cert.gov.ua/article/3718487
@@ -55,7 +44,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml
index 3db2e4903f9..bf41550f4cd 100644
--- a/detections/endpoint/linux_dd_file_overwrite.yml
+++ b/detections/endpoint/linux_dd_file_overwrite.yml
@@ -9,22 +9,8 @@ type: TTP
 description: The following analytic detects the use of the 'dd' command to overwrite files on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because adversaries often use the 'dd' command to destroy or irreversibly overwrite files, disrupting system availability and services. If confirmed malicious, this behavior could lead to data destruction, making recovery difficult and potentially causing significant operational disruptions.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "dd"
-        AND
-        Processes.process = "*of=*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_dd_file_overwrite_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*dd" Processes.process="*of=*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_dd_file_overwrite_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -39,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A commandline $process$ executed on $dest$
     entity:
diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml
index 500697152f3..4853749cd77 100644
--- a/detections/endpoint/linux_decode_base64_to_shell.yml
+++ b/detections/endpoint/linux_decode_base64_to_shell.yml
@@ -10,7 +10,7 @@ description: The following analytic detects the behavior of decoding base64-enco
 data_source:
     - Sysmon for Linux EventID 1
     - Cisco Isovalent Process Exec
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
     from datamodel=Endpoint.Processes where
     Processes.process="*|*"
@@ -42,7 +42,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ decoding base64 and passing it to a shell.
     entity:
diff --git a/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml b/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml
index c418b87af30..8b6c928664f 100644
--- a/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml
+++ b/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml
@@ -9,24 +9,8 @@ type: TTP
 description: The following analytic detects the deletion of critical directories on a Linux machine using the `rm` command with argument rf. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions targeting directories like /boot, /var/log, /etc, and /dev. This activity is significant because deleting these directories can severely disrupt system operations and is often associated with destructive campaigns like Industroyer2. If confirmed malicious, this action could lead to system instability, data loss, and potential downtime, making it crucial for immediate investigation and response.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name =rm
-        AND
-        Processes.process= "* -rf *"
-        AND
-        Processes.process IN ("*/boot/*", "*/var/log/*", "*/etc/*", "*/dev/*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_deleting_critical_directory_using_rm_command_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rm" Processes.process="* -rf *" Processes.process IN ("*/boot/*", "*/var/log/*", "*/etc/*", "*/dev/*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_deleting_critical_directory_using_rm_command_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -40,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A deletion in known critical list of folder using rm command $process$ executed on $dest$
     entity:
diff --git a/detections/endpoint/linux_deletion_of_cron_jobs.yml b/detections/endpoint/linux_deletion_of_cron_jobs.yml
index 5843561a3ab..2a264680fd9 100644
--- a/detections/endpoint/linux_deletion_of_cron_jobs.yml
+++ b/detections/endpoint/linux_deletion_of_cron_jobs.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the deletion of cron jobs on a Linux machine. It leverages filesystem event logs to identify when files within the "/etc/cron.*" directory are deleted. This activity is significant because attackers or malware may delete cron jobs to disable scheduled security tasks or evade detection mechanisms. If confirmed malicious, this action could allow an attacker to disrupt system operations, evade security measures, or facilitate further malicious activities such as data wiping, as seen with the acidrain malware.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.action=deleted Filesystem.file_path="/etc/cron.*"
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_deletion_of_cron_jobs_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="/etc/cron.*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_deletion_of_cron_jobs_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml
index 5ba45586567..c3af6b34d3d 100644
--- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml
+++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the deletion of init daemon scripts on a Linux machine. It leverages filesystem event logs to identify when files within the /etc/init.d/ directory are deleted. This activity is significant because init daemon scripts control the start and stop of critical services, and their deletion can indicate an attempt to impair security features or evade defenses. If confirmed malicious, this behavior could allow an attacker to disrupt essential services, execute destructive payloads, or persist undetected in the environment.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.action=deleted Filesystem.file_path IN ( "/etc/init.d/*")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_deletion_of_init_daemon_script_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="/etc/init.d/*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_deletion_of_init_daemon_script_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Init daemon script deleted on host $dest$ by process GUID- $process_guid$
     entity:
diff --git a/detections/endpoint/linux_deletion_of_services.yml b/detections/endpoint/linux_deletion_of_services.yml
index f2a6239304d..e1700f09912 100644
--- a/detections/endpoint/linux_deletion_of_services.yml
+++ b/detections/endpoint/linux_deletion_of_services.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the deletion of services on a Linux machine. It leverages filesystem event logs to identify when service files within system directories (e.g., /etc/systemd/, /lib/systemd/, /run/systemd/) are deleted. This activity is significant because attackers may delete or modify services to disable security features or evade defenses. If confirmed malicious, this behavior could indicate an attempt to impair system functionality or execute a destructive payload, potentially leading to system instability or data loss. Immediate investigation is required to determine the responsible process and user.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.action=deleted Filesystem.file_path IN ( "/etc/systemd/*", "*/lib/systemd/*", "*/run/systemd/*") Filesystem.file_path = "*.service"
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_deletion_of_services_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("/etc/systemd/*", "/lib/systemd/*", "/run/systemd/*") Filesystem.file_path="*.service" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_deletion_of_services_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A services file $file_name$ deteted on host $dest$ by process GUID -  $process_guid$
     entity:
diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml
index af1160bc30a..08a10ef9339 100644
--- a/detections/endpoint/linux_deletion_of_ssl_certificate.yml
+++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the deletion of SSL certificates on a Linux machine. It leverages filesystem event logs to identify when files with extensions .pem or .crt are deleted from the /etc/ssl/certs/ directory. This activity is significant because attackers may delete or modify SSL certificates to disable security features or evade defenses on a compromised system. If confirmed malicious, this behavior could indicate an attempt to disrupt secure communications, evade detection, or execute a destructive payload, potentially leading to significant security breaches and data loss.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.action=deleted Filesystem.file_path = "/etc/ssl/certs/*" Filesystem.file_path IN ("*.pem", "*.crt")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_deletion_of_ssl_certificate_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="/etc/ssl/certs/*" Filesystem.file_path IN ("*.pem", "*.crt") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_deletion_of_ssl_certificate_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_dirty_frag_kernel_privilege_escalation.yml b/detections/endpoint/linux_dirty_frag_kernel_privilege_escalation.yml
index b9fb02f1f2a..c5220fd842c 100644
--- a/detections/endpoint/linux_dirty_frag_kernel_privilege_escalation.yml
+++ b/detections/endpoint/linux_dirty_frag_kernel_privilege_escalation.yml
@@ -6,13 +6,14 @@ modification_date: '2026-07-06'
 author: Axsel Riando Soplanit, Alexander Wijaya, Matthew Roytua, Muhammad Rafdi Aufar Ahmad, Brian Stevan Ambarita, Ensign Infosecurity
 status: production
 type: TTP
-description: |-
-    The following analytic detects exploitation of Dirty Frag (CVE-2026-43284 and CVE-2026-43500), a Linux kernel local privilege escalation vulnerability.
+description: 'The following analytic detects exploitation of Dirty Frag (CVE-2026-43284 and CVE-2026-43500), a Linux kernel local privilege escalation vulnerability.
+
     The exploit corrupts the kernel page cache via the IPsec ESP or RxRPC subsystems using a high-frequency splice() syscall loop, followed by a privilege transition to root in the same audit session.
-    This analytic anchors on the exploit-specific behavioral signature, a sustained splice() spray (50 or more calls within a 60-second window) from an unprivileged process executing from a user-writable path (/home, /tmp, /dev/shm, /var/tmp, /run/user, /root), followed within 5 minutes by execution of a set-uid binary in the same auditd session.
+
+    This analytic anchors on the exploit-specific behavioral signature, a sustained splice() spray (50 or more calls within a 60-second window) from an unprivileged process executing from a user-writable path (/home, /tmp, /dev/shm, /var/tmp, /run/user, /root), followed within 5 minutes by execution of a set-uid binary in the same auditd session.'
 data_source:
     - Linux Auditd Syscall
-search: |-
+search: |
     `linux_auditd`
     type=SYSCALL
     key=splice_user
@@ -80,38 +81,57 @@ search: |-
             privesc_comm privesc_ppid privesc_time window_secs
 
     | `linux_dirty_frag_kernel_privilege_escalation_filter`
-how_to_implement: |-
-    This analytic requires Linux auditd telemetry forwarded to Splunk
+how_to_implement: 'This analytic requires Linux auditd telemetry forwarded to Splunk
+
     via the Splunk_TA_nix add-on with the linux_audit sourcetype (referenced through
+
     the linux_auditd macro).
 
+
     The detection depends on two audit rule keys, both of which
+
     are standard in the Neo23x0 recommended ruleset (https://github.com/Neo23x0/auditd)
+
     and the existing ESCU Copy Fail analytic (Linux Auditd Copy Fail Privilege Escalation),
+
     so no detection-specific custom keys are introduced.
 
 
+
     PREREQUISITE 1; splice_user key.
 
+
     -a always,exit -F arch=b64 -S splice -S vmsplice -F success=1 -F auid>=1000 -F auid!=unset
+
     -k splice_user
+
     -a always,exit -F arch=b32 -S splice -S vmsplice -F success=1 -F auid>=1000 -F auid!=unset
+
     -k splice_user
 
+
     Operators should baseline splice volume in their environment before enabling.
+
     Hosts running heavy zero-copy I/O workloads (specific: web servers, mail transfer agents, container runtimes) may need additional filtering.
 
+
     PREREQUISITE 2; process_creation key.
 
+
     -a always,exit -F arch=b64 -S execve -S execveat -F auid>=1000 -F auid!=unset -k
+
     process_creation
+
     -a always,exit -F arch=b32 -S execve -S execveat -F auid>=1000 -F auid!=unset -k
-    process_creation
-known_false_positives: |-
-    The splice volume threshold (50 calls per 60 seconds from a single process in a user-writable path) is calibrated against the V4bel public PoC, which produces 100-460 splice calls in 90 seconds depending on system state.
+
+    process_creation'
+known_false_positives: 'The splice volume threshold (50 calls per 60 seconds from a single process in a user-writable path) is calibrated against the V4bel public PoC, which produces 100-460 splice calls in 90 seconds depending on system state.
+
     Legitimate user-mode workloads that may produce splice() calls (web servers, mail transfer agents, language runtimes) typically execute from system paths (/usr/sbin, /usr/bin, /usr/lib) and are excluded by the user-writable path filter.
+
     Custom-compiled applications, developer test binaries, or container runtimes executing from /home or /tmp could theoretically reach the volume threshold during legitimate I/O-heavy workloads (large file copies, log rotation, archive operations).
-    Operators should baseline splice volume in their environment before enabling as a notable event. If false positives occur, add an allowlist of trusted binary paths via the linux_dirty_frag_kernel_privilege_escalation_filter macro, or raise the splice_count threshold based on observed legitimate-workload baseline.
+
+    Operators should baseline splice volume in their environment before enabling as a notable event. If false positives occur, add an allowlist of trusted binary paths via the linux_dirty_frag_kernel_privilege_escalation_filter macro, or raise the splice_count threshold based on observed legitimate-workload baseline.'
 references:
     - https://www.cve.org/CVERecord?id=CVE-2026-43284
     - https://www.cve.org/CVERecord?id=CVE-2026-43500
@@ -129,7 +149,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Local privilege escalation attempt detected on $dest$ executed by $user$ using $spray_binary$
     entity:
diff --git a/detections/endpoint/linux_disable_services.yml b/detections/endpoint/linux_disable_services.yml
index cf32f3b51fe..b5b9324d00a 100644
--- a/detections/endpoint/linux_disable_services.yml
+++ b/detections/endpoint/linux_disable_services.yml
@@ -9,20 +9,8 @@ type: TTP
 description: The following analytic detects attempts to disable a service on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes like "systemctl," "service," and "svcadm" with commands containing "disable." This activity is significant as adversaries may disable security or critical services to evade detection and facilitate further malicious actions, such as deploying destructive payloads. If confirmed malicious, this could lead to the termination of essential security services, allowing attackers to persist undetected and potentially cause significant damage to the system.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN ("systemctl", "service", "svcadm")  Processes.process = "* disable*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_disable_services_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*systemctl", "*service", "*svcadm") Processes.process="* disable*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_disable_services_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -36,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable services on endpoint $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/linux_doas_conf_file_creation.yml b/detections/endpoint/linux_doas_conf_file_creation.yml
index 78856b3308d..b1967206a13 100644
--- a/detections/endpoint/linux_doas_conf_file_creation.yml
+++ b/detections/endpoint/linux_doas_conf_file_creation.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of the doas.conf file on a Linux host. This file is used by the doas utility to allow standard users to perform tasks as root, similar to sudo. The detection leverages filesystem data from the Endpoint data model, focusing on the creation of the doas.conf file. This activity is significant because it can indicate an attempt to gain elevated privileges, potentially by an adversary. If confirmed malicious, this could allow an attacker to execute commands with root privileges, leading to full system compromise.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.file_path IN ("*/etc/doas.conf")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(lastTime)`
-    | `security_content_ctime(firstTime)`
-    | `linux_doas_conf_file_creation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*/etc/doas.conf" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_doas_conf_file_creation_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_doas_tool_execution.yml b/detections/endpoint/linux_doas_tool_execution.yml
index f38802fafd4..5a4b6ba6538 100644
--- a/detections/endpoint/linux_doas_tool_execution.yml
+++ b/detections/endpoint/linux_doas_tool_execution.yml
@@ -9,20 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the 'doas' tool on a Linux host. This tool allows standard users to perform tasks with root privileges, similar to 'sudo'. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as 'doas' can be exploited by adversaries to gain elevated privileges on a compromised host. If confirmed malicious, this could lead to unauthorized administrative access, potentially compromising the entire system.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "doas"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_doas_tool_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*doas" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_doas_tool_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -36,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_docker_root_directory_mount.yml b/detections/endpoint/linux_docker_root_directory_mount.yml
index e5e94296a05..4924031dc46 100644
--- a/detections/endpoint/linux_docker_root_directory_mount.yml
+++ b/detections/endpoint/linux_docker_root_directory_mount.yml
@@ -6,37 +6,16 @@ modification_date: '2026-10-02'
 author: Gowthamaraj Rajendran, Splunk, Emil Elsetrønning
 status: production
 type: TTP
-description: |
-    This detection identifies Docker containers that mount the host's root directory into the container filesystem.
+description: 'This detection identifies Docker containers that mount the host''s root directory into the container filesystem.
+
     Mounting the entire host root directory into a container effectively grants the container visibility and potential write access to all files on the host system.
-    If the container is running as root or with elevated capabilities (e.g., --privileged), the risk is significantly increased.
+
+    If the container is running as root or with elevated capabilities (e.g., --privileged), the risk is significantly increased.'
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    from datamodel=Endpoint.Processes where
-    Processes.process_name=docker*
-    Processes.process IN (
-      "* -v *",
-      "* --volume *"
-    )
-    Processes.process="* /:/*"
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_docker_root_directory_mount_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path="docker*" Processes.process IN ("* -v *", "* --volume *") Processes.process="* /:/*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_docker_root_directory_mount_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
 references:
     - https://docs.docker.com/engine/storage/volumes/
@@ -50,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $process_name$ spawned by $user$ on endpoint $dest$, tried to mount the root directory via the command $process$
     entity:
diff --git a/detections/endpoint/linux_docker_shell_execution.yml b/detections/endpoint/linux_docker_shell_execution.yml
index 24f111109c6..7fa69910a24 100644
--- a/detections/endpoint/linux_docker_shell_execution.yml
+++ b/detections/endpoint/linux_docker_shell_execution.yml
@@ -6,58 +6,35 @@ modification_date: '2026-05-13'
 author: Gowthamaraj Rajendran, Splunk, Emil Elsetrønning
 status: production
 type: Anomaly
-description: |
-    This detection identifies shell execution activity associated with Docker containers on Linux systems.
+description: 'This detection identifies shell execution activity associated with Docker containers on Linux systems.
+
     Specifically, it monitors for interactive or non-interactive shell processes (e.g., `/bin/bash`, `/bin/sh`, `/bin/zsh`) launched via Docker commands such as `docker exec`,  or through container entrypoint overrides.
+
     Shell execution inside a container may indicate administrative troubleshooting activity.
-    However, it can also represent post-exploitation behavior, where an attacker gains access to a container and spawns a shell to execute arbitrary commands, establish persistence, or pivot to the host.
+
+    However, it can also represent post-exploitation behavior, where an attacker gains access to a container and spawns a shell to execute arbitrary commands, establish persistence, or pivot to the host.'
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    from datamodel=Endpoint.Processes where
-    Processes.process_name=docker*
-    Processes.process="* exec *"
-    Processes.process IN (
-      "* /bin/bash *",
-      "* /bin/dash *",
-      "* /bin/sh *",
-      "* /bin/zsh *",
-      "* bash *",
-      "* bash",
-      "* dash *",
-      "* dash",
-      "* sh *",
-      "* sh",
-      "* zsh *",
-      "* zsh"
-    )
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_docker_shell_execution_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path="docker*" Processes.process="* exec *" Processes.process IN ("* /bin/bash *", "* /bin/dash *", "* /bin/sh *", "* /bin/zsh *", "* bash *", "* bash*", "* dash *", "* dash*", "* sh *", "* sh*", "* zsh *", "* zsh*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_docker_shell_execution_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    False positives are present based on automated tooling or system administrative usage. Filter as needed.
+
+    names and speed up the data modeling process.'
+known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
 references:
     - https://docs.docker.com/reference/cli/docker/container/exec/
     - https://gtfobins.github.io/gtfobins/docker/
@@ -69,7 +46,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml
index b0527946145..5bf877e4663 100644
--- a/detections/endpoint/linux_edit_cron_table_parameter.yml
+++ b/detections/endpoint/linux_edit_cron_table_parameter.yml
@@ -9,20 +9,8 @@ type: Hunting
 description: The following analytic detects the suspicious editing of cron jobs in Linux using the crontab command-line parameter (-e). It identifies this activity by monitoring command-line executions involving 'crontab' and the edit parameter. This behavior is significant for a SOC as cron job manipulations can indicate unauthorized persistence attempts or scheduled malicious actions. If confirmed malicious, this activity could lead to system compromise, unauthorized access, or broader network compromise.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = crontab Processes.process = "*crontab *" Processes.process = "* -e*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_edit_cron_table_parameter_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*crontab" Processes.process="*crontab *" Processes.process="* -e*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_edit_cron_table_parameter_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_efi_bootloader_file_deletion.yml b/detections/endpoint/linux_efi_bootloader_file_deletion.yml
index 347040e3bad..e2ff30c7afc 100644
--- a/detections/endpoint/linux_efi_bootloader_file_deletion.yml
+++ b/detections/endpoint/linux_efi_bootloader_file_deletion.yml
@@ -6,32 +6,13 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects file deletions in the EFI boot directory. These files are responsible for initializing the Boot Manager during system startup. Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process.
+description: The following analytic detects file deletions in the EFI boot directory. These files are responsible for initializing the Boot Manager during system startup. Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.action="deleted"
-    Filesystem.file_path="/boot/efi/EFI/BOOT/*"
-    Filesystem.file_name="*.efi*"
-
-    by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest
-       Filesystem.action Filesystem.process_guid Filesystem.process_id
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_efi_bootloader_file_deletion_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file deletion events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate system administrators or package managers may delete or replace EFI bootloader files during system updates or OS reinstallation. Filter for known maintenance windows and authorized administrative activity.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="/boot/efi/EFI/BOOT/*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_efi_bootloader_file_deletion_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file deletion events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate system administrators or package managers may delete or replace EFI bootloader files during system updates or OS reinstallation. Filter for known maintenance windows and authorized administrative activity.
 references:
     - https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/
     - https://www.bleepingcomputer.com/news/security/new-hybridpetya-ransomware-can-bypass-uefi-secure-boot/
@@ -71,8 +52,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_emacs_privilege_escalation.yml b/detections/endpoint/linux_emacs_privilege_escalation.yml
index 60c6776582c..e75337ede32 100644
--- a/detections/endpoint/linux_emacs_privilege_escalation.yml
+++ b/detections/endpoint/linux_emacs_privilege_escalation.yml
@@ -9,24 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of Emacs with elevated privileges using the `sudo` command and the `--eval` option. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line arguments. This activity is significant because it indicates a potential privilege escalation attempt, where a user could gain root access by running Emacs with elevated permissions. If confirmed malicious, this could allow an attacker to execute arbitrary commands as root, leading to full system compromise and unauthorized access to sensitive information.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*emacs*"
-        AND
-        Processes.process="*--eval*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_emacs_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*emacs*" Processes.process="*--eval*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_emacs_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -40,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
index 1110b16d122..cc864188170 100644
--- a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
+++ b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of files in the Linux kernel/driver directory. It leverages filesystem data to identify new files in this critical directory. This activity is significant because the kernel/driver directory is typically reserved for kernel modules, and unauthorized file creation here can indicate a rootkit installation. If confirmed malicious, this could allow an attacker to gain high-level privileges, potentially compromising the entire system by executing code at the kernel level.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.file_path IN ("*/kernel/drivers/*")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(lastTime)`
-    | `security_content_ctime(firstTime)`
-    | `linux_file_created_in_kernel_driver_directory_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*/kernel/drivers/*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_file_created_in_kernel_driver_directory_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: Administrator or network operator can create file in this folders for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml
index 824ec505b08..32e955d97f3 100644
--- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml
+++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml
@@ -6,40 +6,17 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the creation of files in Linux init boot directories, which are used for automatic execution upon system startup.
+description: 'The following analytic detects the creation of files in Linux init boot directories, which are used for automatic execution upon system startup.
+
     It leverages file system logs to identify new files in directories such as /etc/init.d/ and /etc/rc.d/. This activity is significant as it is a common persistence technique used by adversaries, malware authors, and red teamers.
-    If confirmed malicious, this could allow an attacker to maintain persistence on the compromised host, potentially leading to further exploitation and unauthorized control over the system.
+
+    If confirmed malicious, this could allow an attacker to maintain persistence on the compromised host, potentially leading to further exploitation and unauthorized control over the system.'
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Filesystem WHERE
-
-    Filesystem.action = "created"
-    Filesystem.file_path IN (
-        "*/etc/init.d/*",
-        "*/etc/rc.d/*",
-        "*/etc/rc.local*",
-        "*/sbin/init.d/*"
-    )
-    BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-       Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-       Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-       Filesystem.user Filesystem.vendor_product
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(lastTime)`
-    | `security_content_ctime(firstTime)`
-    | `linux_file_creation_in_init_boot_directory_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase
-known_false_positives: |-
-    Administrator or network operator can create file in this folders for automation purposes. Please update the filter macros to remove false positives.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/init.d/*", "*/etc/rc.d/*", "*/etc/rc.local*", "*/sbin/init.d/*") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_file_creation_in_init_boot_directory_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase
+known_false_positives: Administrator or network operator can create file in this folders for automation purposes. Please update the filter macros to remove false positives.
 references:
     - https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
 drilldown_searches:
@@ -50,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_file_creation_in_profile_directory.yml b/detections/endpoint/linux_file_creation_in_profile_directory.yml
index 318f7d60012..04ba34e0d94 100644
--- a/detections/endpoint/linux_file_creation_in_profile_directory.yml
+++ b/detections/endpoint/linux_file_creation_in_profile_directory.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of files in the /etc/profile.d directory on Linux systems. It leverages filesystem data to identify new files in this directory, which is often used by adversaries for persistence by executing scripts upon system boot. This activity is significant as it may indicate an attempt to maintain long-term access to the compromised host. If confirmed malicious, this could allow attackers to execute arbitrary code with elevated privileges each time the system boots, potentially leading to further compromise and data exfiltration.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.file_path IN ("*/etc/profile.d/*")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(lastTime)`
-    | `security_content_ctime(firstTime)`
-    | `linux_file_creation_in_profile_directory_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*/etc/profile.d/*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_file_creation_in_profile_directory_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: Administrator or network operator can create file in profile.d folders for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_file_creation_in_system_generator_directory.yml b/detections/endpoint/linux_file_creation_in_system_generator_directory.yml
index 0cde3fae987..349448444f9 100644
--- a/detections/endpoint/linux_file_creation_in_system_generator_directory.yml
+++ b/detections/endpoint/linux_file_creation_in_system_generator_directory.yml
@@ -6,33 +6,17 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects potential persistence using a systemd generator on Linux, which involves creating a malicious script or binary that is typically executed during the system's boot process.
+description: 'The following analytic detects potential persistence using a systemd generator on Linux, which involves creating a malicious script or binary that is typically executed during the system''s boot process.
+
     Systemd generators are typically placed in directories like /lib/systemd/system-generators/, where they are run early in the boot sequence to dynamically generate or modify unit files that control system services.
-    By placing a custom generator in this directory, an attacker can ensure their code is executed each time the system starts, allowing them to maintain access or control even after reboots.
+
+    By placing a custom generator in this directory, an attacker can ensure their code is executed each time the system starts, allowing them to maintain access or control even after reboots.'
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.action IN ("created", "modified")
-    Filesystem.file_path="*/lib/systemd/system-generators/*"
-
-    by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest
-       Filesystem.action Filesystem.process_guid Filesystem.process_id
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_file_creation_in_system_generator_directory_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate system administrators or software packages may place custom generators in systemd generator directories during system configuration or application deployment. Filter based on known software installations and verified administrative activity.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*/lib/systemd/system-generators/*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_file_creation_in_system_generator_directory_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate system administrators or software packages may place custom generators in systemd generator directories during system configuration or application deployment. Filter based on known software installations and verified administrative activity.
 references:
     - https://github.com/Aegrah/PANIX
 drilldown_searches:
@@ -67,8 +51,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_find_privilege_escalation.yml b/detections/endpoint/linux_find_privilege_escalation.yml
index 904b7970529..797e42dd6c4 100644
--- a/detections/endpoint/linux_find_privilege_escalation.yml
+++ b/detections/endpoint/linux_find_privilege_escalation.yml
@@ -9,24 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of the 'find' command with 'sudo' and '-exec' options, which can indicate an attempt to escalate privileges on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line arguments. This activity is significant because it can allow a user to execute system commands as root, potentially leading to a root shell. If confirmed malicious, this could enable an attacker to gain full control over the system, leading to severe security breaches and unauthorized access to sensitive data.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*find*"
-        AND
-        Processes.process="*-exec*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_find_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*find*" Processes.process="*-exec*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_find_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
 references:
@@ -40,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_gdb_privilege_escalation.yml b/detections/endpoint/linux_gdb_privilege_escalation.yml
index 5f01b751e5e..0dbedae9bec 100644
--- a/detections/endpoint/linux_gdb_privilege_escalation.yml
+++ b/detections/endpoint/linux_gdb_privilege_escalation.yml
@@ -9,26 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the GNU Debugger (GDB) with specific flags that indicate an attempt to escalate privileges on a Linux system. It leverages Endpoint Detection and Response (EDR) telemetry to identify processes where GDB is run with the `-nx`, `-ex`, and `sudo` flags. This activity is significant because it can allow a user to execute system commands as root, potentially leading to a root shell. If confirmed malicious, this could result in full system compromise, allowing an attacker to gain complete control over the affected endpoint.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*gdb*"
-        AND
-        Processes.process="*-nx*"
-        AND
-        Processes.process="*-ex*!*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_gdb_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*gdb*" Processes.process="*-nx*" Processes.process="*-ex*!*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_gdb_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -41,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_gdrive_binary_activity.yml b/detections/endpoint/linux_gdrive_binary_activity.yml
index 7c836ddbd1b..f7c6f2ea5d2 100644
--- a/detections/endpoint/linux_gdrive_binary_activity.yml
+++ b/detections/endpoint/linux_gdrive_binary_activity.yml
@@ -9,20 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the 'gdrive' tool on a Linux host. This tool allows standard users to perform tasks associated with Google Drive via the command line. This is used by actors to stage tools as well as exfiltrate data. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. If confirmed malicious, this could lead to compromise of systems or sensitive data being stolen.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name="gdrive" Processes.process IN  ("* download *", "* upload *", "* list*", "* update *", "* sync *", "* share *", "* account add*", "* drives *", "* files *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_gdrive_binary_activity_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*gdrive" Processes.process IN ("* download *", "* upload *", "* list*", "* update *", "* sync *", "* share *", "* account add*", "* drives *", "* files *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_gdrive_binary_activity_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -35,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $process_name$ was identified attempting to interact with Google Drive on endpoint $dest$ by $user$.
     entity:
@@ -57,6 +45,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/gdrive/gdrive_linux.log
-          sourcetype: sysmon:linux
           source: Syslog:Linux-Sysmon/Operational
+          sourcetype: sysmon:linux
       test_type: unit
diff --git a/detections/endpoint/linux_gem_privilege_escalation.yml b/detections/endpoint/linux_gem_privilege_escalation.yml
index 23263b471ef..e801c423051 100644
--- a/detections/endpoint/linux_gem_privilege_escalation.yml
+++ b/detections/endpoint/linux_gem_privilege_escalation.yml
@@ -9,24 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the RubyGems utility with elevated privileges, specifically when it is used to run system commands as root. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include "gem open -e" and "sudo". This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute commands as the root user. If confirmed malicious, this could lead to full system compromise, enabling the attacker to gain root access and execute arbitrary commands with elevated privileges.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*gem*open*-e*"
-        AND
-        Processes.process="*-c*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_gem_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*gem*open*-e*" Processes.process="*-c*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_gem_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -40,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_ghostscript_exploitation.yml b/detections/endpoint/linux_ghostscript_exploitation.yml
index a3c7d729290..4ed5726a412 100644
--- a/detections/endpoint/linux_ghostscript_exploitation.yml
+++ b/detections/endpoint/linux_ghostscript_exploitation.yml
@@ -6,42 +6,15 @@ modification_date: '2026-09-01'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects exploitation of Ghostscript causing command execution.
-    This can be used by attackers to abuse file conversion services or embedded LibreOffice documents.
+description: 'The following analytic detects exploitation of Ghostscript causing command execution.
+
+    This can be used by attackers to abuse file conversion services or embedded LibreOffice documents.'
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.parent_process_path IN (
-        "*/gs",
-        "*/ghostscript"
-    )
-    Processes.process="*sh -c*"
-
-    by Processes.process Processes.vendor_product Processes.user_id
-       Processes.process_hash Processes.parent_process_name
-       Processes.parent_process_exec Processes.action Processes.dest
-       Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name
-       Processes.parent_process Processes.parent_process_path
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user
-       Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_ghostscript_exploitation_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate use of Ghostscript for document processing or file conversion tasks may trigger this rule. Filter based on known authorized applications that rely on Ghostscript for routine document handling.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*sh -c*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_ghostscript_exploitation_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate use of Ghostscript for document processing or file conversion tasks may trigger this rule. Filter based on known authorized applications that rely on Ghostscript for routine document handling.
 references:
     - https://www.bleepingcomputer.com/news/security/rce-bug-in-widely-used-ghostscript-library-now-exploited-in-attacks/
     - https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/
@@ -86,8 +59,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml
index 75bac5ebf67..40cf7322b69 100644
--- a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml
+++ b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml
@@ -9,23 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the 'gawk' command with elevated privileges on a Linux system. It leverages Endpoint Detection and Response (EDR) telemetry to identify command-line executions where 'gawk' is used with 'sudo' and 'BEGIN{system' patterns. This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute system commands as root. If confirmed malicious, this could lead to full root access, enabling the attacker to control the system, modify critical files, and maintain persistent access.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*gawk*"
-        AND
-        Processes.process="*BEGIN*{system*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `linux_gnu_awk_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*gawk*" Processes.process="*BEGIN*{system*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_gnu_awk_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -39,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_hardware_addition_swapoff.yml b/detections/endpoint/linux_hardware_addition_swapoff.yml
index 527493c5f8e..23a56725456 100644
--- a/detections/endpoint/linux_hardware_addition_swapoff.yml
+++ b/detections/endpoint/linux_hardware_addition_swapoff.yml
@@ -9,19 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the "swapoff" command, which disables the swapping of paging devices on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because disabling swap can be a tactic used by malware, such as Awfulshred, to evade detection and hinder forensic analysis. If confirmed malicious, this action could allow an attacker to manipulate system memory management, potentially leading to data corruption, system instability, or evasion of memory-based detection mechanisms.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "swapoff"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `linux_hardware_addition_swapoff_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*swapoff" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_hardware_addition_swapoff_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: administrator may disable swapping of devices in a linux host. Filter is needed.
 references:
@@ -34,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml
index b928f0dacc0..fc9fb2d95b8 100644
--- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml
+++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects a high frequency of file deletions in the /boot/ folder on Linux systems. It leverages filesystem event logs to identify when 200 or more files are deleted within an hour by the same process. This behavior is significant as it may indicate the presence of wiper malware, such as Industroyer2, which targets critical system directories. If confirmed malicious, this activity could lead to system instability or failure, hindering the boot process and potentially causing a complete system compromise.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` values(Filesystem.file_access_time) as file_access_time values(Filesystem.file_create_time) as file_create_time values(Filesystem.file_hash) as file_hash values(Filesystem.file_modify_time) as file_modify_time values(Filesystem.file_name) as file_name values(Filesystem.file_path) as file_path  values(Filesystem.file_acl) as file_acl values(Filesystem.file_size) as file_size values(Filesystem.process_id) as process_id values(Filesystem.user) as user values(Filesystem.vendor_product) as vendor_product dc(Filesystem.file_path) as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.action=deleted Filesystem.file_path = "/boot/*"
-      BY _time span=1h Filesystem.dest
-         Filesystem.process_guid Filesystem.action
-    | `drop_dm_object_name(Filesystem)`
-    | where  numOfDelFilePath >= 200
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_high_frequency_of_file_deletion_in_boot_folder_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="/boot/*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_high_frequency_of_file_deletion_in_boot_folder_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: linux package installer/uninstaller may cause this event. Please update you filter macro to remove false positives.
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Multiple files detection in /boot/ folder on $dest$ by process GUID -  $process_guid$
     entity:
diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml
index dc90f9db820..eef9be51963 100644
--- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml
+++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects a high frequency of file deletions in the /etc/ folder on Linux systems. It leverages the Endpoint.Filesystem data model to identify instances where 200 or more files are deleted within an hour, grouped by process name and process ID. This behavior is significant as it may indicate the presence of wiper malware, such as AcidRain, which aims to delete critical system files. If confirmed malicious, this activity could lead to severe system instability, data loss, and potential disruption of services.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` values(Filesystem.file_access_time) as file_access_time values(Filesystem.file_create_time) as file_create_time values(Filesystem.file_hash) as file_hash values(Filesystem.file_modify_time) as file_modify_time values(Filesystem.file_name) as file_name values(Filesystem.file_path) as file_path  values(Filesystem.file_acl) as file_acl values(Filesystem.file_size) as file_size values(Filesystem.process_id) as process_id values(Filesystem.user) as user dc(Filesystem.file_path) as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.action=deleted Filesystem.file_path = "/etc/*"
-      BY _time span=1h Filesystem.dest
-         Filesystem.process_guid Filesystem.action Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | where  numOfDelFilePath >= 200
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_high_frequency_of_file_deletion_in_etc_folder_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="/etc/*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_high_frequency_of_file_deletion_in_etc_folder_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: linux package installer/uninstaller may cause this event. Please update you filter macro to remove false positives.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_impair_defenses_process_kill.yml b/detections/endpoint/linux_impair_defenses_process_kill.yml
index 7e9967ae1d1..87d845cbf3d 100644
--- a/detections/endpoint/linux_impair_defenses_process_kill.yml
+++ b/detections/endpoint/linux_impair_defenses_process_kill.yml
@@ -9,19 +9,8 @@ type: Hunting
 description: The following analytic identifies the execution of the 'pkill' command, which is used to terminate processes on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because threat actors often use 'pkill' to disable security defenses or terminate critical processes, facilitating further malicious actions. If confirmed malicious, this behavior could lead to the disruption of security applications, enabling attackers to evade detection and potentially corrupt or destroy files on the targeted system.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN ( "pgrep", "pkill") Processes.process = "*pkill *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `linux_impair_defenses_process_kill_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pgrep", "*pkill") Processes.process="*pkill *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_impair_defenses_process_kill_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network admin can terminate a process using this linux command. Filter is needed.
 references:
diff --git a/detections/endpoint/linux_indicator_removal_clear_cache.yml b/detections/endpoint/linux_indicator_removal_clear_cache.yml
index 7b0c7dfaf45..9a5e1915fc3 100644
--- a/detections/endpoint/linux_indicator_removal_clear_cache.yml
+++ b/detections/endpoint/linux_indicator_removal_clear_cache.yml
@@ -9,23 +9,8 @@ type: TTP
 description: The following analytic detects processes that clear or free page cache on a Linux system. It leverages Endpoint Detection and Response (EDR) data, focusing on specific command-line executions involving the kernel system request `drop_caches`. This activity is significant as it may indicate an attempt to delete forensic evidence or the presence of wiper malware like Awfulshred. If confirmed malicious, this behavior could allow an attacker to cover their tracks, making it difficult to investigate other malicious activities or system compromises.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN ("dash", "sudo", "bash")
-        AND
-        Processes.process  IN("* echo 3 &gt; *", "* echo 2 &gt; *","* echo 1 &gt; *")
-        AND
-        Processes.process = "*/proc/sys/vm/drop_caches"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `linux_indicator_removal_clear_cache_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*dash", "*sudo", "*bash") Processes.process IN ("* echo 3 &gt; *", "* echo 2 &gt; *", "* echo 1 &gt; *") Processes.process="*/proc/sys/vm/drop_caches" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_indicator_removal_clear_cache_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -39,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: a $process_name$ clear cache using kernel drop cache system request in $dest$
     entity:
diff --git a/detections/endpoint/linux_indicator_removal_service_file_deletion.yml b/detections/endpoint/linux_indicator_removal_service_file_deletion.yml
index 6381c4a2606..b7ce8d7fd99 100644
--- a/detections/endpoint/linux_indicator_removal_service_file_deletion.yml
+++ b/detections/endpoint/linux_indicator_removal_service_file_deletion.yml
@@ -9,23 +9,8 @@ type: Anomaly
 description: The following analytic detects the deletion of Linux service unit configuration files by suspicious processes. It leverages Endpoint Detection and Response (EDR) telemetry, focusing on processes executing the 'rm' command targeting '.service' files. This activity is significant as it may indicate malware attempting to disable critical services or security products, a common defense evasion tactic. If confirmed malicious, this behavior could lead to service disruption, security tool incapacitation, or complete system compromise, severely impacting the integrity and availability of the affected Linux host.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "rm"
-        AND
-        Processes.process = "*rm *"
-        AND
-        Processes.process = "*.service"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `linux_indicator_removal_service_file_deletion_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rm" Processes.process="*rm *" Processes.process="*.service" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_indicator_removal_service_file_deletion_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network admin can delete services unit configuration file as part of normal software installation. Filter is needed.
 references:
@@ -39,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml
index c117c573c21..1c043d18ca1 100644
--- a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml
+++ b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml
@@ -9,24 +9,8 @@ type: Hunting
 description: The following analytic detects the use of 'curl' and 'wget' commands within a Linux environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, user information, and command-line executions. This activity is significant as 'curl' and 'wget' are commonly used for downloading files, which can indicate potential ingress of malicious tools. If confirmed malicious, this activity could lead to unauthorized code execution, data exfiltration, or further compromise of the system. Monitoring and tuning this detection helps identify and differentiate between normal and potentially harmful usage.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=curl
-            OR
-            Processes.process_name=wget
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_ingress_tool_transfer_hunting_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*curl", "*wget") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_ingress_tool_transfer_hunting_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives will be present. This query is meant to help tune other curl and wget analytics.
 references:
diff --git a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml
index de6be1e2157..0bdff5cfa86 100644
--- a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml
+++ b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml
@@ -10,28 +10,7 @@ description: The following analytic detects the use of the curl command with spe
 data_source:
     - Sysmon for Linux EventID 1
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_name=curl
-    Processes.process IN ("*-O*","*-sO*","*-ksO*","*--output*")
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user Processes.user_id
-       Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | where match(process, "(?i)(-O|-sO|-ksO|--output)")
-    | `linux_ingress_tool_transfer_with_curl_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*curl" Processes.process IN ("*-O*", "*-sO*", "*-ksO*", "*--output*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_ingress_tool_transfer_with_curl_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives will be present. Tune and then change type to TTP.
 references:
@@ -48,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
index 47e497dcdb3..497deaecda1 100644
--- a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
+++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
@@ -9,22 +9,8 @@ type: Anomaly
 description: The following analytic detects the insertion of a Linux kernel module using the insmod utility. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include process names and command-line details. This activity is significant as it may indicate the installation of a rootkit or malicious kernel module, potentially allowing an attacker to gain elevated privileges and bypass security detections. If confirmed malicious, this could lead to unauthorized code execution, persistent access, and severe compromise of the affected system.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN("kmod", "sudo")
-        AND
-        Processes.process = *insmod*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_insert_kernel_module_using_insmod_utility_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*kmod", "*sudo") Processes.process="*insmod*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_insert_kernel_module_using_insmod_utility_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -40,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
index 01e2ac584cc..b836e7896ca 100644
--- a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
+++ b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
@@ -9,22 +9,8 @@ type: Anomaly
 description: The following analytic detects the installation of a Linux kernel module using the modprobe utility. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN("kmod", "sudo")
-        AND
-        Processes.process = *modprobe*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_install_kernel_module_using_modprobe_utility_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*kmod", "*sudo") Processes.process="*modprobe*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_install_kernel_module_using_modprobe_utility_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -39,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml
index c40497742c1..405cc8b3a85 100644
--- a/detections/endpoint/linux_iptables_firewall_modification.yml
+++ b/detections/endpoint/linux_iptables_firewall_modification.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects suspicious command-line activity that modifies the iptables firewall settings on a Linux machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command patterns that alter firewall rules to accept traffic on certain TCP ports. This activity is significant as it can indicate malware, such as CyclopsBlink, modifying firewall settings to allow communication with a Command and Control (C2) server. If confirmed malicious, this could enable attackers to maintain persistent access and exfiltrate data, posing a severe security risk.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
     from datamodel=Endpoint.Processes where
 
@@ -54,7 +54,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_kernel_module_enumeration.yml b/detections/endpoint/linux_kernel_module_enumeration.yml
index 87223e336ec..1a61339157d 100644
--- a/detections/endpoint/linux_kernel_module_enumeration.yml
+++ b/detections/endpoint/linux_kernel_module_enumeration.yml
@@ -9,20 +9,8 @@ type: Anomaly
 description: The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. While listing kernel modules is not inherently malicious, it can be a precursor to loading unauthorized modules using 'insmod'. If confirmed malicious, this activity could allow an attacker to load kernel modules, potentially leading to privilege escalation, persistence, or other malicious actions within the system.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=kmod Processes.process IN ("*lsmod*", "*list*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_kernel_module_enumeration_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*kmod" Processes.process IN ("*lsmod*", "*list*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_kernel_module_enumeration_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
 references:
@@ -36,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml
index bfa9a67e1bd..1b5c67c4555 100644
--- a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml
+++ b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml
@@ -9,20 +9,8 @@ type: Hunting
 description: The following analytic detects the execution of a kworker process with a command line in writable directories such as /home/, /var/log, and /tmp on a Linux machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process paths. This activity is significant as kworker processes are typically kernel threads, and their presence in writable directories is unusual and indicative of potential malware, such as CyclopsBlink. If confirmed malicious, this could allow attackers to blend malicious processes with legitimate ones, leading to persistent access and further system compromise.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process = "*[kworker/*" Processes.parent_process_path IN ("/home/*", "/tmp/*", "/var/log/*") Processes.process="*iptables*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_kworker_process_in_writable_process_path_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process="*[kworker/*" Processes.process="*iptables*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_kworker_process_in_writable_process_path_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/endpoint/linux_magic_sysrq_key_abuse.yml b/detections/endpoint/linux_magic_sysrq_key_abuse.yml
index 72e51baaa80..bb81b2d7473 100644
--- a/detections/endpoint/linux_magic_sysrq_key_abuse.yml
+++ b/detections/endpoint/linux_magic_sysrq_key_abuse.yml
@@ -6,11 +6,13 @@ modification_date: '2026-10-02'
 author: Milad Cheraghi
 status: production
 type: TTP
-description: |
-    Detects potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to manipulate or destabilize a system.
+description: 'Detects potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to manipulate or destabilize a system.
+
     Writing to /proc/sysrq-trigger can crash the system, kill processes, or bypass standard logging.
+
     Monitoring SysRq abuse helps detect stealthy post-exploitation activity.
-    Correlate with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
+
+    Correlate with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.'
 data_source:
     - Linux Auditd Path
     - Linux Auditd Cwd
@@ -47,17 +49,10 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `linux_magic_sysrq_key_abuse_filter`
-how_to_implement: |
-    To implement this detection, ensure auditd is configured to watch:
-      - /proc/sysrq-trigger
-      - /proc/sys/kernel/sysrq
-      - /etc/sysctl.conf
-    with write and attribute changes (`-p wa`) and key `sysrq`. Make sure the type=CWD record type is activate in your auditd configuration and
-    Use the Splunk Add-on for Unix and Linux for proper ingestion and CIM normalization.
-    This enables effective monitoring of Linux endpoints for SysRq abuse.
-known_false_positives: |
-    Legitimate administrative activity modifying SysRq for debugging or recovery.
-    Please update the filter macros to remove false positives.
+how_to_implement: "To implement this detection, ensure auditd is configured to watch:\n  - /proc/sysrq-trigger\n  - /proc/sys/kernel/sysrq\n  - /etc/sysctl.conf\nwith write and attribute changes (`-p wa`) and key `sysrq`. Make sure the type=CWD record type is activate in your auditd configuration and\nUse the Splunk Add-on for Unix and Linux for proper ingestion and CIM normalization.\nThis enables effective monitoring of Linux endpoints for SysRq abuse."
+known_false_positives: 'Legitimate administrative activity modifying SysRq for debugging or recovery.
+
+    Please update the filter macros to remove false positives.'
 references:
     - https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt
     - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel
@@ -72,7 +67,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Abuse of the Linux Magic System Request key detected on host - [$dest$]
     entity:
diff --git a/detections/endpoint/linux_make_privilege_escalation.yml b/detections/endpoint/linux_make_privilege_escalation.yml
index 4f87b645716..de076a9dc91 100644
--- a/detections/endpoint/linux_make_privilege_escalation.yml
+++ b/detections/endpoint/linux_make_privilege_escalation.yml
@@ -9,24 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of the 'make' command with elevated privileges to execute system commands as root, potentially leading to a root shell. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include 'make', '--eval', and 'sudo'. This activity is significant because it indicates a possible privilege escalation attempt, allowing a user to gain root access. If confirmed malicious, an attacker could achieve full control over the system, execute arbitrary commands, and compromise the entire environment.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*make*-s*"
-        AND
-        Processes.process="*--eval*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_make_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*make*-s*" Processes.process="*--eval*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_make_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -40,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_malformed_auth_entry.yml b/detections/endpoint/linux_malformed_auth_entry.yml
index 79a8ec4f7f8..0ddf47c5473 100644
--- a/detections/endpoint/linux_malformed_auth_entry.yml
+++ b/detections/endpoint/linux_malformed_auth_entry.yml
@@ -6,13 +6,17 @@ modification_date: '2026-05-06'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects when su runs from a page-cache-corrupted binary.
+description: 'The following analytic detects when su runs from a page-cache-corrupted binary.
+
     When this happens a partial corruption of its runtime state can prevent it from resolving the identity of the calling user.
+
     Under normal conditions, su logs both the target account and the invoking user.
+
     When exploitation has occurred via this path, the invoking username field is absent.
+
     This activity is significant because it indicates a possible privilege escalation attempt, allowing a user to gain root access.
-    If confirmed malicious, an attacker could achieve full control over the system, execute arbitrary commands, and compromise the entire environment.
+
+    If confirmed malicious, an attacker could achieve full control over the system, execute arbitrary commands, and compromise the entire environment.'
 data_source:
     - Linux Secure
 search: |
@@ -30,8 +34,7 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `linux_malformed_auth_entry_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to have relevant authentication logs ingested with the Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833).
+how_to_implement: To successfully implement this search, you need to have relevant authentication logs ingested with the Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833).
 known_false_positives: No false positives have been identified at this time.
 references:
     - https://xint.io/blog/copy-fail-linux-distributions
@@ -45,7 +48,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_medusa_rootkit.yml b/detections/endpoint/linux_medusa_rootkit.yml
index 789e1e517c2..ad05ba56496 100644
--- a/detections/endpoint/linux_medusa_rootkit.yml
+++ b/detections/endpoint/linux_medusa_rootkit.yml
@@ -9,18 +9,8 @@ type: TTP
 description: This detection identifies file creation events associated with the installation of the Medusa rootkit, a userland LD_PRELOAD-based rootkit known for deploying shared objects, loader binaries, and configuration files into specific system directories. These files typically facilitate process hiding, credential theft, and backdoor access. Monitoring for such file creation patterns enables early detection of rootkit deployment before full compromise.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.file_path IN ("*/lib/libseconf", "*.backup_ld.so", "*.boot.sh", "*.logpam", "*sshpass.txt", "*sshpass2.txt", "*/lib/libdsx.so", "*rkload", "*/lib/libseconf/local.txt", "*/lib/locate/local.txt", "*/var/log/remote.txt", "*/lib/libseconf/.pts", "*/lib/locate /.pts", "*/libseconf/.ports")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(lastTime)`
-    | `security_content_ctime(firstTime)`
-    | `linux_medusa_rootkit_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/lib/libseconf", "*.backup_ld.so", "*.boot.sh", "*.logpam", "*sshpass.txt", "*sshpass2.txt", "*/lib/libdsx.so", "*rkload", "*/lib/libseconf/local.txt", "*/lib/locate/local.txt", "*/var/log/remote.txt", "*/lib/libseconf/.pts", "*/lib/locate /.pts", "*/libseconf/.ports") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_medusa_rootkit_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Little to no false positives in most environments. Tune as needed.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Medusa rootkit files were identified on endpoint $dest$.
     entity:
diff --git a/detections/endpoint/linux_motd_script_added.yml b/detections/endpoint/linux_motd_script_added.yml
index 262b5ce7aad..6ed5efdf73a 100644
--- a/detections/endpoint/linux_motd_script_added.yml
+++ b/detections/endpoint/linux_motd_script_added.yml
@@ -6,35 +6,17 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the creation of a file within the /etc/update-motd.d directory.
+description: 'The following analytic detects the creation of a file within the /etc/update-motd.d directory.
+
     This is used to add scripts that run with Message of the Day (MOTD) when a user logs in.
-    This can be used by attackers for persistence if it contains malicious code.
+
+    This can be used by attackers for persistence if it contains malicious code.'
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.file_path="/etc/update-motd.d/*"
-    Filesystem.action IN ("created", "modified")
-
-    by Filesystem.file_path Filesystem.file_name
-       Filesystem.user Filesystem.dest
-       Filesystem.action Filesystem.process_guid
-       Filesystem.process_id
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_motd_script_added_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate system administrators may add or modify MOTD scripts for valid operational purposes such as displaying system information or login banners. Filter based on known administrative activity and authorized users.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="/etc/update-motd.d/*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_motd_script_added_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate system administrators may add or modify MOTD scripts for valid operational purposes such as displaying system information or login banners. Filter based on known administrative activity and authorized users.
 references:
     - https://github.com/Aegrah/PANIX
 drilldown_searches:
@@ -71,8 +53,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547/linux_motd_script_added/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_mysql_privilege_escalation.yml b/detections/endpoint/linux_mysql_privilege_escalation.yml
index a70b9edee00..b9fa805f12f 100644
--- a/detections/endpoint/linux_mysql_privilege_escalation.yml
+++ b/detections/endpoint/linux_mysql_privilege_escalation.yml
@@ -9,24 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of MySQL commands with elevated privileges using sudo, which can lead to privilege escalation. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it indicates a potential misuse of MySQL to execute system commands as root, which could allow an attacker to gain root shell access. If confirmed malicious, this could result in full control over the affected system, leading to severe security breaches and unauthorized access to sensitive data.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*mysql*-e*"
-        AND
-        Processes.process="*\!**"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_mysql_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*mysql*-e*" Processes.process="*!*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_mysql_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
 references:
@@ -39,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_netcat_outbound_connection.yml b/detections/endpoint/linux_netcat_outbound_connection.yml
index 272fd23a1e6..29a4487d632 100644
--- a/detections/endpoint/linux_netcat_outbound_connection.yml
+++ b/detections/endpoint/linux_netcat_outbound_connection.yml
@@ -6,14 +6,16 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects outbound network connections originating from Netcat or Netcat-like binaries on Linux systems.
+description: 'The following analytic detects outbound network connections originating from Netcat or Netcat-like binaries on Linux systems.
+
     Netcat is a versatile networking utility that, while legitimate in some contexts, is frequently abused by attackers to establish reverse shells, exfiltrate data, or create persistent backdoor connections to remote systems.
+
     This activity is significant because outbound connections from these binaries often indicate an active compromise, where an attacker may be maintaining command-and-control communication or tunneling malicious traffic.
-    If confirmed malicious, this could lead to unauthorized data exfiltration, lateral movement, or persistent remote access to the compromised system.
+
+    If confirmed malicious, this could lead to unauthorized data exfiltration, lateral movement, or persistent remote access to the compromised system.'
 data_source:
     - Sysmon for Linux EventID 3
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -34,10 +36,9 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `linux_netcat_outbound_connection_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain network connection events including the source, destination, port, and process context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Network_Traffic` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate system administrators or developers may use netcat for troubleshooting, port scanning, or testing network connectivity. Filter based on known administrative activity or authorized users.
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain network connection events including the source, destination, port, and process context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Network_Traffic` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate system administrators or developers may use netcat for troubleshooting, port scanning, or testing network connectivity. Filter based on known administrative activity or authorized users.
+references: []
 drilldown_searches:
     - earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
@@ -72,8 +73,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml b/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml
index 2cf1671a4d1..b6437c937f9 100644
--- a/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml
+++ b/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml
@@ -9,20 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of Ngrok on a Linux operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments associated with Ngrok. This activity is significant because Ngrok can be used by adversaries to establish reverse proxies, potentially bypassing network defenses. If confirmed malicious, this could allow attackers to create persistent, unauthorized access channels, facilitating data exfiltration or further exploitation of the compromised system.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=ngrok Processes.process IN ("*start*", "*--config*","*http*","*authtoken*", "*http*", "*tcp*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_ngrok_reverse_proxy_usage_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*ngrok" Processes.process IN ("*start*", "*--config*", "*http*", "*authtoken*", "*tcp*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_ngrok_reverse_proxy_usage_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present if Ngrok is an authorized utility. Filter as needed.
 references:
@@ -36,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/linux_node_privilege_escalation.yml b/detections/endpoint/linux_node_privilege_escalation.yml
index 62ea08f348f..c2f02e6637a 100644
--- a/detections/endpoint/linux_node_privilege_escalation.yml
+++ b/detections/endpoint/linux_node_privilege_escalation.yml
@@ -9,26 +9,8 @@ type: Anomaly
 description: The following analytic identifies the execution of Node.js with elevated privileges using sudo, specifically when spawning child processes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include specific Node.js commands. This activity is significant because running Node.js as a superuser without dropping privileges can allow unauthorized access to the file system and potential privilege escalation. If confirmed malicious, this could enable an attacker to maintain privileged access, execute arbitrary code, and compromise sensitive data within the environment.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*sudo*node*"
-        AND
-        Processes.process="*-e*"
-        AND
-        Processes.process="*child_process.spawn*"
-        AND
-        Processes.process="*stdio*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_node_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*sudo*node*" Processes.process="*-e*" Processes.process="*child_process.spawn*" Processes.process="*stdio*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_node_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
 references:
@@ -42,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
index 9729d216d64..fe0011b94ef 100644
--- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
+++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
@@ -9,20 +9,8 @@ type: Anomaly
 description: The following analytic detects the addition of NOPASSWD entries to the /etc/sudoers file on Linux systems. It leverages Endpoint Detection and Response (EDR) telemetry to identify command lines containing "NOPASSWD:". This activity is significant because it allows users to execute commands with elevated privileges without requiring a password, which can be exploited by adversaries to maintain persistent, privileged access. If confirmed malicious, this could lead to unauthorized privilege escalation, persistent access, and potential compromise of sensitive data and system integrity.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process = "*NOPASSWD:*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_nopasswd_entry_in_sudoers_file_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*NOPASSWD:*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_nopasswd_entry_in_sudoers_file_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -36,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml
index 3d698d7a8c0..0977087832d 100644
--- a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml
+++ b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml
@@ -9,20 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of the base64 decode command on Linux systems, which is often used to deobfuscate files. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include "base64 -d" or "base64 --decode". This activity is significant as it may indicate an attempt to hide malicious payloads or scripts. If confirmed malicious, an attacker could use this technique to execute hidden code, potentially leading to unauthorized access, data exfiltration, or further system compromise.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_path="*/base64" Processes.process="*-d*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_obfuscated_files_or_information_base64_decode_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path="*/base64" Processes.process="*-d*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_obfuscated_files_or_information_base64_decode_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present and will require some tuning based on processes. Filter as needed.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/linux_octave_privilege_escalation.yml b/detections/endpoint/linux_octave_privilege_escalation.yml
index dc7427057d0..f3e5ff62a7d 100644
--- a/detections/endpoint/linux_octave_privilege_escalation.yml
+++ b/detections/endpoint/linux_octave_privilege_escalation.yml
@@ -9,26 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of GNU Octave with elevated privileges, specifically when it runs system commands via sudo. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line arguments that include "octave-cli," "--eval," "system," and "sudo." This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute commands as root. If confirmed malicious, this could lead to full system compromise, enabling an attacker to gain root access and execute arbitrary commands, severely impacting system security and integrity.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*octave-cli*"
-        AND
-        Processes.process="*--eval*"
-        AND
-        Processes.process="*system*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_octave_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*octave-cli*" Processes.process="*--eval*" Processes.process="*system*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_octave_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -42,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_openvpn_privilege_escalation.yml b/detections/endpoint/linux_openvpn_privilege_escalation.yml
index 2d11ca713cd..3b8023860a1 100644
--- a/detections/endpoint/linux_openvpn_privilege_escalation.yml
+++ b/detections/endpoint/linux_openvpn_privilege_escalation.yml
@@ -9,28 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of OpenVPN with elevated privileges, specifically when combined with the `--dev`, `--script-security`, `--up`, and `sudo` options. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line arguments and execution details. This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute system commands as root. If confirmed malicious, this could lead to full system compromise, enabling an attacker to gain root access and execute arbitrary commands with elevated privileges.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*openvpn*"
-        AND
-        Processes.process="*--dev*"
-        AND
-        Processes.process="*--script-security*"
-        AND
-        Processes.process="*--up*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_openvpn_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*openvpn*" Processes.process="*--dev*" Processes.process="*--script-security*" Processes.process="*--up*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_openvpn_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -44,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_pedit_offset_out_of_bounds.yml b/detections/endpoint/linux_pedit_offset_out_of_bounds.yml
index b295103b10f..56bc8369fcf 100644
--- a/detections/endpoint/linux_pedit_offset_out_of_bounds.yml
+++ b/detections/endpoint/linux_pedit_offset_out_of_bounds.yml
@@ -9,13 +9,8 @@ type: TTP
 description: The following detects a Linux kernel warning message containing "tc action pedit offset" and "out of bounds" logged to syslog, which indicates the act_pedit attempted to write past the bounds of an allocated packet buffer. This condition is associated with CVE-2026-46331, a kernel vulnerability that can be exploited via crafted pedit netlink configurations combined with page cache poisoning to achieve privilege escalation. The presence of this message on a host is a strong indicator that exploitation of this vulnerability, or triggering of the underlying vulnerable code path, has occurred.
 data_source:
     - Linux Messages Syslog
-search: >-
-    `linux_syslog` "*tc action pedit offset*" "*out of bounds*"
-    | rename host as dest
-    | stats count min(_time) as firstTime max(_time) as lastTime by dest _raw
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_pedit_offset_out_of_bounds_filter`
+search: |
+    `linux_syslog` "*tc action pedit offset*" "*out of bounds*" | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by dest _raw | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_pedit_offset_out_of_bounds_filter`
 how_to_implement: To successfully implement this search, you need to have relevant kernel logs ingested with the Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833).
 known_false_positives: This is generated only when the kernel's act_pedit module encounters a write outside the writable SKB region. This never occurs in normal tc pedit usage.
 references:
@@ -29,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Out-of-bounds write by act_pedit on $dest$ indicating possible privilege escalation.
     entity:
diff --git a/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml b/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml
index 3dbd5fc8dc1..76af193fbf8 100644
--- a/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml
+++ b/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml
@@ -8,7 +8,7 @@ status: production
 type: Correlation
 description: The following analytic identifies potential Linux persistence and privilege escalation activities. It leverages risk scores and event counts from various Linux-related data sources, focusing on tactics associated with persistence and privilege escalation. This activity is significant for a SOC because it highlights behaviors that could allow an attacker to maintain access or gain elevated privileges on a Linux system. If confirmed malicious, this activity could enable an attacker to execute code with higher privileges, persist in the environment, and potentially access sensitive information, posing a severe security risk.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
       WHERE (
             All_Risk.analyticstories IN ("Linux Privilege Escalation", "Linux Persistence Techniques")
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$risk_object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Linux Persistence and Privilege Escalation Risk Behavior - $risk_object$
     entity:
diff --git a/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml b/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml
index 9350c9df39f..00d30b24a8e 100644
--- a/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml
+++ b/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml
@@ -6,9 +6,9 @@ modification_date: '2026-07-17'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects when the AF_ALG kernel crypto socket interface being loaded more than 300 seconds after system boot, which is a primary kernel-level indicator of Copy Fail (CVE-2026-31431) exploitation activity on Debian and Ubuntu family systems.
-    The AF_ALG interface is required by the exploit to access the vulnerable authencesn crypto code path, and on systems where it is not auto-loaded at boot, its on-demand registration by an unprivileged process is a strong indicator of exploitation in progress.
+description: 'The following analytic detects when the AF_ALG kernel crypto socket interface being loaded more than 300 seconds after system boot, which is a primary kernel-level indicator of Copy Fail (CVE-2026-31431) exploitation activity on Debian and Ubuntu family systems.
+
+    The AF_ALG interface is required by the exploit to access the vulnerable authencesn crypto code path, and on systems where it is not auto-loaded at boot, its on-demand registration by an unprivileged process is a strong indicator of exploitation in progress.'
 data_source:
     - Linux Messages Syslog
 search: |
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: AF_ALG instantiated after boot on $dest$ indicating possible privilege escalation.
     entity:
diff --git a/detections/endpoint/linux_php_privilege_escalation.yml b/detections/endpoint/linux_php_privilege_escalation.yml
index 23bc9c120dc..e98e3cb9804 100644
--- a/detections/endpoint/linux_php_privilege_escalation.yml
+++ b/detections/endpoint/linux_php_privilege_escalation.yml
@@ -9,24 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of PHP commands with elevated privileges on a Linux system. It identifies instances where PHP is used in conjunction with 'sudo' and 'system' commands, indicating an attempt to run system commands as the root user. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line arguments. This activity is significant because it can indicate an attempt to escalate privileges, potentially leading to full root access. If confirmed malicious, this could allow an attacker to execute arbitrary commands with root privileges, compromising the entire system.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*php*-r*"
-        AND
-        Processes.process="*system*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_php_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*php*-r*" Processes.process="*system*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_php_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -40,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_pkexec_privilege_escalation.yml b/detections/endpoint/linux_pkexec_privilege_escalation.yml
index d788f480a41..205007d8ac9 100644
--- a/detections/endpoint/linux_pkexec_privilege_escalation.yml
+++ b/detections/endpoint/linux_pkexec_privilege_escalation.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the execution of `pkexec` without any command-line arguments. This behavior leverages data from Endpoint Detection and Response (EDR) agents, focusing on process telemetry. The significance lies in the fact that this pattern is associated with the exploitation of CVE-2021-4034 (PwnKit), a critical vulnerability in Polkit's pkexec component. If confirmed malicious, this activity could allow an attacker to gain full root privileges on the affected Linux system, leading to complete system compromise and potential unauthorized access to sensitive information.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
+search: |
     | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
       WHERE Processes.process_name=pkexec
       BY Processes.action Processes.dest Processes.original_file_name
@@ -39,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to a local privilege escalation in polkit pkexec.
     entity:
diff --git a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
index 43a66c23429..4044a425cb6 100644
--- a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
+++ b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
@@ -9,22 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious access or modification of the sshd_config file on Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving processes like "cat," "nano," "vim," and "vi" accessing the sshd_config file. This activity is significant because unauthorized changes to sshd_config can allow threat actors to redirect port connections or use unauthorized keys, potentially compromising the system. If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent backdoor access, posing a severe security risk.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN("cat", "nano*","vim*", "vi*")
-        AND
-        Processes.process IN("*/etc/ssh/sshd_config")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_possible_access_or_modification_of_sshd_config_file_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*cat", "*nano", "*vim", "*vi") Processes.process="*/etc/ssh/sshd_config" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_or_modification_of_sshd_config_file_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -38,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml
index f96bb4b170f..9c37630c557 100644
--- a/detections/endpoint/linux_possible_access_to_credential_files.yml
+++ b/detections/endpoint/linux_possible_access_to_credential_files.yml
@@ -9,22 +9,8 @@ type: Anomaly
 description: The following analytic detects attempts to access or dump the contents of /etc/passwd and /etc/shadow files on Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes like 'cat', 'nano', 'vim', and 'vi' accessing these files. This activity is significant as it may indicate credential dumping, a technique used by adversaries to gain persistence or escalate privileges. If confirmed malicious, attackers could obtain hashed passwords for offline cracking, leading to unauthorized access and potential system compromise.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN("cat", "nano*","vim*", "vi*")
-        AND
-        Processes.process IN("*/etc/shadow*", "*/etc/passwd*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_possible_access_to_credential_files_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*cat", "*nano", "*vim", "*vi") Processes.process IN ("*/etc/shadow*", "*/etc/passwd*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_credential_files_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -38,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml
index 8198aaf8032..183c13cd613 100644
--- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml
+++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml
@@ -9,22 +9,8 @@ type: Anomaly
 description: The following analytic detects potential access or modification of the /etc/sudoers file on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes like "cat," "nano," "vim," and "vi" accessing the /etc/sudoers file. This activity is significant because the sudoers file controls user permissions for executing commands with elevated privileges. If confirmed malicious, an attacker could gain persistence or escalate privileges, compromising the security of the targeted host.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN("cat", "nano*","vim*", "vi*")
-        AND
-        Processes.process IN("*/etc/sudoers*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_possible_access_to_sudoers_file_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*cat", "*nano", "*vim", "*vi") Processes.process="*/etc/sudoers*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_sudoers_file_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -38,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml
index 7540dc0f047..a17e198aa5f 100644
--- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml
+++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml
@@ -9,22 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious command lines that append user entries to /etc/at.allow or /etc/at.deny files. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving these files. This activity is significant because altering these configuration files can allow attackers to schedule tasks with elevated permissions, facilitating persistence on a compromised Linux host. If confirmed malicious, this could enable attackers to execute arbitrary code at scheduled intervals, potentially leading to further system compromise and unauthorized access to sensitive information.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-      WHERE Processes.process = "*echo*"
-        AND
-        Processes.process IN("*/etc/at.allow", "*/etc/at.deny")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_possible_append_command_to_at_allow_config_file_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*echo*" Processes.process IN ("*/etc/at.allow", "*/etc/at.deny") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_append_command_to_at_allow_config_file_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -38,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
index cd3a8eca4cd..e5e7246af6c 100644
--- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
+++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
@@ -6,56 +6,17 @@ modification_date: '2026-08-12'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects suspicious command-lines that modify user profile files to automatically execute scripts or executables upon system reboot.
+description: 'The following analytic detects suspicious command-lines that modify user profile files to automatically execute scripts or executables upon system reboot.
+
     It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile.
+
     This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts.
-    If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation.
+
+    If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation.'
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    Processes.process = "*echo*"
-    (
-        Processes.process IN ("*/home/*", "*~/*", "*/etc/*")
-        Processes.process IN (
-            "*/.bash_login*",
-            "*/.bash_logout*",
-            "*/.bash_profile*",
-            "*/.bashrc*",
-            "*/.profile*",
-            "*/profile*"
-        )
-        OR
-        (
-            Processes.process_current_directory = "/home/*"
-            Processes.process IN (
-                "*.bash_login*",
-                "*.bash_logout*",
-                "*.bash_profile*",
-                "*.bashrc*",
-                "*.profile*",
-                "* profile*"
-            )
-        )
-    )
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process_current_directory Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_possible_append_command_to_profile_config_file_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*echo*" (Processes.process IN ("*/home/*", "*~/*", "*/etc/*") Processes.process IN ("*/.bash_login*", "*/.bash_logout*", "*/.bash_profile*", "*/.bashrc*", "*/.profile*", "*/profile*")) OR (Processes.process_current_directory="/home/*" Processes.process IN ("*.bash_login*", "*.bash_logout*", "*.bash_profile*", "*.bashrc*", "*.profile*", "* profile*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_append_command_to_profile_config_file_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -69,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
index 03eccdfd272..d5e62737571 100644
--- a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
+++ b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
@@ -9,22 +9,8 @@ type: Hunting
 description: The following analytic detects potential tampering with cronjob files on a Linux system by identifying 'echo' commands that append code to existing cronjob files. It leverages logs from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because adversaries often use it for persistence or privilege escalation. If confirmed malicious, this could allow attackers to execute unauthorized code automatically, leading to system compromises and unauthorized data access, thereby impacting business operations and data integrity.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-      WHERE Processes.process = "*echo*"
-        AND
-        Processes.process IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*echo*" Processes.process IN ("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may arise from legitimate actions by administrators or network operators who may use these commands for automation purposes. Therefore, it's recommended to adjust filter macros to eliminate such false positives.
 references:
diff --git a/detections/endpoint/linux_possible_bootloader_modification.yml b/detections/endpoint/linux_possible_bootloader_modification.yml
index 604d947263e..b929b8b27d6 100644
--- a/detections/endpoint/linux_possible_bootloader_modification.yml
+++ b/detections/endpoint/linux_possible_bootloader_modification.yml
@@ -6,52 +6,17 @@ modification_date: '2026-07-08'
 author: Raven Tait, Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects processes modifying data in the EFI volume on Linux.
+description: 'The following analytic detects processes modifying data in the EFI volume on Linux.
+
     These files are responsible for initializing the Boot Manager during system startup.
-    Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process.
+
+    Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process.'
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    (
-        Processes.process_name IN (
-            "cp",
-            "mv",
-            "ln"
-        )
-        Processes.process_current_directory="*/EFI/BOOT*"
-    )
-    OR
-    (
-        Processes.process="*/EFI/BOOT*"
-        NOT Processes.process_name IN (
-            "ls",
-            "grep",
-            "egrep"
-        )
-    )
-
-    by Processes.process Processes.vendor_product Processes.user_id
-       Processes.process_hash Processes.parent_process_name Processes.parent_process_exec
-       Processes.action Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_possible_bootloader_modification_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate system administrators or package managers such as grub or shim may modify EFI volume files during OS upgrades or bootloader updates. Filter based on known update processes or trusted administrative activity.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.process_name IN ("*cp", "*mv", "*ln") Processes.process_current_directory="*/EFI/BOOT*") OR (Processes.process="*/EFI/BOOT*" NOT (Processes.process_name IN ("*ls", "*grep", "*egrep"))) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_bootloader_modification_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate system administrators or package managers such as grub or shim may modify EFI volume files during OS upgrades or bootloader updates. Filter based on known update processes or trusted administrative activity.
 references:
     - https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/
     - https://www.bleepingcomputer.com/news/security/new-hybridpetya-ransomware-can-bypass-uefi-secure-boot/
@@ -100,8 +65,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml
index ea2d2665057..b7229dae355 100644
--- a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml
+++ b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml
@@ -9,25 +9,8 @@ type: Hunting
 description: The following analytic detects potential unauthorized modifications to Linux cronjobs using text editors like "nano," "vi," or "vim." It identifies this activity by monitoring command-line executions that interact with cronjob configuration paths. This behavior is significant for a SOC as it may indicate attempts at privilege escalation or establishing persistent access. If confirmed malicious, the impact could be severe, allowing attackers to execute damaging actions such as data theft, system sabotage, or further network penetration.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name IN("nano","vim.basic")
-            OR
-            Processes.process IN ("*nano *", "*vi *", "*vim *")
-        )
-        AND Processes.process IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_possible_cronjob_modification_with_editor_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*nano", "*vim.basic") OR Processes.process IN ("*nano *", "*vi *", "*vim *") Processes.process IN ("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_cronjob_modification_with_editor_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_possible_gsm_privilege_escalation.yml b/detections/endpoint/linux_possible_gsm_privilege_escalation.yml
index 8ff50d00933..4d302ff83b8 100644
--- a/detections/endpoint/linux_possible_gsm_privilege_escalation.yml
+++ b/detections/endpoint/linux_possible_gsm_privilege_escalation.yml
@@ -6,40 +6,15 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the commands used in a race condition found in the GSM 0710 tty multiplexor in the Linux kernel.
+description: 'The following analytic detects the commands used in a race condition found in the GSM 0710 tty multiplexor in the Linux kernel.
+
     This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled.
-    This could allow a local unprivileged user to escalate their privileges on the system.
+
+    This could allow a local unprivileged user to escalate their privileges on the system.'
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process="*rmmod *"
-    Processes.process="*n_gsm*"
-    Processes.process="*exec *"
-    Processes.process IN (
-        "*/bin/bash*",
-        "*/bin/dash*",
-        "*/bin/sh*",
-        "*/bin/zsh*"
-    )
-
-    by Processes.process Processes.vendor_product
-       Processes.user_id Processes.process_hash Processes.parent_process_name Processes.parent_process_exec
-       Processes.action Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_possible_gsm_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*rmmod *" Processes.process="*n_gsm*" Processes.process="*exec *" Processes.process IN ("*/bin/bash*", "*/bin/dash*", "*/bin/sh*", "*/bin/zsh*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_gsm_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate system administrators or developers testing GSM multiplexor configurations may trigger this detection. Filter based on known authorized users or testing environments.
 references:
@@ -82,8 +57,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml b/detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml
index 42c1670ce6c..0cf39c923a8 100644
--- a/detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml
+++ b/detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml
@@ -6,33 +6,15 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects directory traversal attempts associated with Nimbuspwn, a Linux privilege escalation vulnerability affecting the networkd-dispatcher service.
+description: 'The following analytic detects directory traversal attempts associated with Nimbuspwn, a Linux privilege escalation vulnerability affecting the networkd-dispatcher service.
+
     Nimbuspwn exploits weaknesses in the networkd-dispatcher service to traverse directories and execute arbitrary code with elevated privileges.
-    If confirmed malicious, this activity could allow an attacker to escalate privileges to root, potentially leading to full system compromise, persistent unauthorized access, and the ability to deploy additional malicious payloads.
+
+    If confirmed malicious, this activity could allow an attacker to escalate privileges to root, potentially leading to full system compromise, persistent unauthorized access, and the ability to deploy additional malicious payloads.'
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process="*networkd-dispatcher*"
-    Processes.process="*../*"
-
-    by Processes.process Processes.vendor_product Processes.user_id
-       Processes.process_hash Processes.parent_process_name Processes.parent_process_exec
-       Processes.action Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_possible_nimbuspwn_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*networkd-dispatcher*" Processes.process="*../*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_nimbuspwn_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate system processes or administrative scripts that traverse directories in a similar pattern may trigger this detection. Filter based on known administrative activity and verified system processes.
 references:
@@ -77,8 +59,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml b/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml
index 2a29b417203..80251a51fe7 100644
--- a/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml
+++ b/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml
@@ -6,40 +6,17 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects the creation of a malicious shared object at a Python importlib path outside the standard system library directories, a technique used to abuse PYTHONPATH for local privilege escalation.
+description: 'The following analytic detects the creation of a malicious shared object at a Python importlib path outside the standard system library directories, a technique used to abuse PYTHONPATH for local privilege escalation.
+
     Attackers exploiting vulnerabilities such as the 2024 NeedRestart flaw (CVE-2024-48990) plant a crafted importlib/__init__.so in an attacker-controlled directory, then manipulate the PYTHONPATH environment variable so that a privileged process, such as NeedRestart running as root, loads the rogue module instead of the legitimate one, achieving code execution with elevated privileges.
-    The detection monitors for file writes matching the importlib/__init__.so pattern that do not originate from expected system library paths.
+
+    The detection monitors for file writes matching the importlib/__init__.so pattern that do not originate from expected system library paths.'
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.file_path="*/importlib/__init__.so*"
-    NOT Filesystem.file_path IN (
-        "/lib/*",
-        "/lib64/*",
-        "/usr/lib/*",
-        "/usr/lib64/*",
-        "/usr/local/lib/*",
-        "/usr/local/lib64/*"
-    )
-
-    by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest
-       Filesystem.process_guid Filesystem.process_id
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_possible_privilege_escalation_via_pythonpath_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate Python developers or system administrators may modify PYTHONPATH for testing or application configuration purposes. Filter based on known development environments and trusted user activity.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*/importlib/__init__.so*" NOT (Filesystem.file_path IN ("/lib/*", "/lib64/*", "/usr/lib/*", "/usr/lib64/*", "/usr/local/lib/*", "/usr/local/lib64/*")) by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_privilege_escalation_via_pythonpath_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate Python developers or system administrators may modify PYTHONPATH for testing or application configuration purposes. Filter based on known development environments and trusted user activity.
 references:
     - https://www.bleepingcomputer.com/news/security/ubuntu-linux-impacted-by-decade-old-needrestart-flaw-that-gives-root/
     - https://www.qualys.com/2024/11/19/needrestart/needrestart.txt
@@ -79,8 +56,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_possible_ssh_key_file_creation.yml b/detections/endpoint/linux_possible_ssh_key_file_creation.yml
index 557e8f1f6ad..fd763b32293 100644
--- a/detections/endpoint/linux_possible_ssh_key_file_creation.yml
+++ b/detections/endpoint/linux_possible_ssh_key_file_creation.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of SSH key files in the ~/.ssh/ directory. It leverages filesystem data to identify new files in this specific path. This activity is significant because threat actors often create SSH keys to gain persistent access and escalate privileges on a compromised host. If confirmed malicious, this could allow attackers to remotely access the machine using the OpenSSH daemon service, leading to potential unauthorized control and data exfiltration.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.file_path IN ("*/.ssh*")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(lastTime)`
-    | `security_content_ctime(firstTime)`
-    | `linux_possible_ssh_key_file_creation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*/.ssh*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_ssh_key_file_creation_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: Administrator or network operator can create file in ~/.ssh folders for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_possible_system_binary_backdoor.yml b/detections/endpoint/linux_possible_system_binary_backdoor.yml
index 5ee3b287d49..465b14b3375 100644
--- a/detections/endpoint/linux_possible_system_binary_backdoor.yml
+++ b/detections/endpoint/linux_possible_system_binary_backdoor.yml
@@ -6,40 +6,17 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the creation or overwrite of commonly targeted Linux system binaries such as cat, ls, cp, ps, mv, netstat, ss, and lsof.
+description: 'The following analytic detects the creation or overwrite of commonly targeted Linux system binaries such as cat, ls, cp, ps, mv, netstat, ss, and lsof.
+
     Adversaries may replace these utilities with backdoored versions to hide malicious activity, harvest credentials, or maintain persistence while appearing to use legitimate system tools.
-    This technique is associated with rootkit deployment and post-exploitation frameworks such as PANIX.
+
+    This technique is associated with rootkit deployment and post-exploitation frameworks such as PANIX.'
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.file_path IN (
-        "/usr/bin/cat",
-        "/usr/bin/cp",
-        "/usr/bin/ls",
-        "/usr/bin/lsof",
-        "/usr/bin/mv",
-        "/usr/bin/netstat",
-        "/usr/bin/ps",
-        "/usr/bin/ss"
-    )
-
-    by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest
-       Filesystem.action Filesystem.process_guid Filesystem.process_id
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_possible_system_binary_backdoor_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate system updates or package managers may create or overwrite system binaries during normal operations. Filter for known update processes and package management activity to reduce noise.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("/usr/bin/cat", "/usr/bin/cp", "/usr/bin/ls", "/usr/bin/lsof", "/usr/bin/mv", "/usr/bin/netstat", "/usr/bin/ps", "/usr/bin/ss") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_system_binary_backdoor_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate system updates or package managers may create or overwrite system binaries during normal operations. Filter for known update processes and package management activity to reduce noise.
 references:
     - https://github.com/Aegrah/PANIX
 drilldown_searches:
@@ -77,8 +54,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml
index 375384b2a32..8a57ecaa894 100644
--- a/detections/endpoint/linux_preload_hijack_library_calls.yml
+++ b/detections/endpoint/linux_preload_hijack_library_calls.yml
@@ -9,20 +9,8 @@ type: TTP
 description: The following analytic detects the use of the LD_PRELOAD environment variable to hijack or hook library functions on a Linux platform. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because adversaries, malware authors, and red teamers commonly use this technique to gain elevated privileges and establish persistence on a compromised machine. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, and maintain long-term access to the system.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process = "*LD_PRELOAD*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_preload_hijack_library_calls_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*LD_PRELOAD*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_preload_hijack_library_calls_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -35,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A commandline $process$ that may hijack library function on $dest$
     entity:
diff --git a/detections/endpoint/linux_proxy_socks_curl.yml b/detections/endpoint/linux_proxy_socks_curl.yml
index 4b90b345f68..891556cc14e 100644
--- a/detections/endpoint/linux_proxy_socks_curl.yml
+++ b/detections/endpoint/linux_proxy_socks_curl.yml
@@ -6,42 +6,17 @@ modification_date: '2026-06-04'
 author: Michael Haag, Splunk, 0xC0FFEEEE, Github Community
 status: production
 type: TTP
-description: |-
-    The following analytic detects the use of the `curl` command with proxy-related arguments such as `-x`, `socks`, `--preproxy`, and `--proxy`.
+description: 'The following analytic detects the use of the `curl` command with proxy-related arguments such as `-x`, `socks`, `--preproxy`, and `--proxy`.
+
     This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details.
+
     This activity is significant as it may indicate an adversary attempting to use a proxy to evade network monitoring and obscure their actions.
-    If confirmed malicious, this behavior could allow attackers to bypass security controls, making it difficult to track their activities and potentially leading to unauthorized data access or exfiltration.
+
+    If confirmed malicious, this behavior could allow attackers to bypass security controls, making it difficult to track their activities and potentially leading to unauthorized data access or exfiltration.'
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    FROM datamodel=Endpoint.Processes WHERE
-
-    Processes.process_name=curl
-    Processes.process IN (
-        "*--preproxy *",
-        "*--proxy*",
-        "*-x *",
-        "*socks4://*",
-        "*socks4a://*",
-        "*socks5://*",
-        "*socks5h://*"
-    )
-
-    BY Processes.action Processes.dest Processes.original_file_name
-        Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-        Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-        Processes.process Processes.process_exec Processes.process_guid
-        Processes.process_hash Processes.process_id Processes.process_integrity_level
-        Processes.process_name Processes.process_path Processes.user
-        Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | where match(process, "-x\s") OR match(process, "(?i)(socks\d\w?:\/\/|--(pre)?proxy)")
-    | `linux_proxy_socks_curl_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*curl" Processes.process IN ("*--preproxy *", "*--proxy*", "*-x *", "*socks4://*", "*socks4a://*", "*socks5://*", "*socks5h://*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_proxy_socks_curl_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present based on proxy usage internally. Filter as needed.
 references:
@@ -59,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ utilizing a proxy. Review activity for further details.
     entity:
diff --git a/detections/endpoint/linux_puppet_privilege_escalation.yml b/detections/endpoint/linux_puppet_privilege_escalation.yml
index f9d72e9777a..bc11753e508 100644
--- a/detections/endpoint/linux_puppet_privilege_escalation.yml
+++ b/detections/endpoint/linux_puppet_privilege_escalation.yml
@@ -9,28 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of Puppet commands with elevated privileges, specifically when Puppet is used to apply configurations with sudo rights. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it indicates a potential privilege escalation attempt, where a user could gain root access and execute system commands as the root user. If confirmed malicious, this could allow an attacker to fully compromise the system, execute arbitrary commands, and maintain persistent control.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*puppet*"
-        AND
-        Processes.process="*apply*"
-        AND
-        Processes.process="*-e*"
-        AND
-        Processes.process="*exec*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_puppet_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*puppet*" Processes.process="*apply*" Processes.process="*-e*" Processes.process="*exec*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_puppet_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -44,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_root_execution_of_id.yml b/detections/endpoint/linux_root_execution_of_id.yml
index 47cb6b158b3..3fda58c164d 100644
--- a/detections/endpoint/linux_root_execution_of_id.yml
+++ b/detections/endpoint/linux_root_execution_of_id.yml
@@ -6,37 +6,18 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the execution of the `id` command by the root user on Linux systems. Attackers commonly run `id` during post-exploitation to confirm they have achieved root-level privileges after a privilege escalation attempt.
+description: 'The following analytic detects the execution of the `id` command by the root user on Linux systems. Attackers commonly run `id` during post-exploitation to confirm they have achieved root-level privileges after a privilege escalation attempt.
+
     This activity is significant because it may indicate an attacker is verifying superuser access following a successful compromise.
-    If confirmed malicious, this could signal that an attacker has gained full control of the system, enabling them to perform destructive actions, exfiltrate sensitive data, or establish persistent unauthorized access.
+
+    If confirmed malicious, this could signal that an attacker has gained full control of the system, enabling them to perform destructive actions, exfiltrate sensitive data, or establish persistent unauthorized access.'
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_path="/usr/bin/id"
-    Processes.user="root"
-
-    by Processes.process Processes.vendor_product Processes.user_id
-       Processes.process_hash Processes.parent_process_name Processes.parent_process_exec
-       Processes.action Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_root_execution_of_id_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Administrators and automated scripts routinely run the id command as root for system auditing or configuration tasks. Filter based on known administrative activity or trusted scripts.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path="/usr/bin/id" Processes.user="root" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_root_execution_of_id_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Administrators and automated scripts routinely run the id command as root for system auditing or configuration tasks. Filter based on known administrative activity or trusted scripts.
+references: []
 drilldown_searches:
     - earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
@@ -76,8 +57,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_rpm_privilege_escalation.yml b/detections/endpoint/linux_rpm_privilege_escalation.yml
index 0f62dd756f5..06b08a1c903 100644
--- a/detections/endpoint/linux_rpm_privilege_escalation.yml
+++ b/detections/endpoint/linux_rpm_privilege_escalation.yml
@@ -9,24 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the RPM Package Manager with elevated privileges, specifically when it is used to run system commands as root via the `--eval` and `lua:os.execute` options. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process metadata. This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to gain root access. If confirmed malicious, this could lead to full system compromise, unauthorized access to sensitive data, and further exploitation of the environment.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*rpm*--eval*"
-        AND
-        Processes.process="*lua:os.execute*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_rpm_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*rpm*--eval*" Processes.process="*lua:os.execute*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_rpm_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
 references:
@@ -40,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_ruby_privilege_escalation.yml b/detections/endpoint/linux_ruby_privilege_escalation.yml
index f27c5e55c32..23a90d7d329 100644
--- a/detections/endpoint/linux_ruby_privilege_escalation.yml
+++ b/detections/endpoint/linux_ruby_privilege_escalation.yml
@@ -9,24 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of Ruby commands with elevated privileges on a Linux system. It identifies processes where Ruby is used with the `-e` flag to execute commands via `sudo`, leveraging Endpoint Detection and Response (EDR) telemetry. This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute commands as root. If confirmed malicious, this could lead to full system compromise, enabling an attacker to gain root access, execute arbitrary commands, and maintain persistent control over the affected system.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*ruby*-e*"
-        AND
-        Processes.process="*exec*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_ruby_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*ruby*-e*" Processes.process="*exec*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_ruby_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
 references:
@@ -39,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml
index e1063596348..72b46b63e01 100644
--- a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml
+++ b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of suspicious service files within the systemd directories on Linux platforms. It leverages logs containing file name, file path, and process GUID data from endpoints. This activity is significant for a SOC as it may indicate an adversary attempting to establish persistence on a compromised host. If confirmed malicious, this could lead to system compromise or data exfiltration, allowing attackers to maintain control over the system and execute further malicious activities.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.file_name = *.service Filesystem.file_path IN ("*/etc/systemd/system*", "*/lib/systemd/system*", "*/usr/lib/systemd/system*", "*/run/systemd/system*", "*~/.config/systemd/*", "*~/.local/share/systemd/*","*/etc/systemd/user*", "*/lib/systemd/user*", "*/usr/lib/systemd/user*", "*/run/systemd/user*")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(lastTime)`
-    | `security_content_ctime(firstTime)`
-    | `linux_service_file_created_in_systemd_directory_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/systemd/system*", "*/lib/systemd/system*", "*/usr/lib/systemd/system*", "*/run/systemd/system*", "*~/.config/systemd/*", "*~/.local/share/systemd/*", "*/etc/systemd/user*", "*/lib/systemd/user*", "*/usr/lib/systemd/user*", "*/run/systemd/user*") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_service_file_created_in_systemd_directory_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: False positives may arise when administrators or network operators create files in systemd directories for legitimate automation tasks. Therefore, it's important to adjust filter macros to account for valid activities. To implement this search successfully, it's crucial to ingest appropriate logs, preferably using the Linux Sysmon Add-on from Splunkbase for those using Sysmon.
 references:
@@ -36,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml
index 91170720697..6e241c16e07 100644
--- a/detections/endpoint/linux_service_restarted.yml
+++ b/detections/endpoint/linux_service_restarted.yml
@@ -9,25 +9,8 @@ type: Anomaly
 description: The following analytic detects the restarting or re-enabling of services on Linux systems using the `systemctl` or `service` commands. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line execution logs. This activity is significant as adversaries may use it to maintain persistence or execute unauthorized actions. If confirmed malicious, this behavior could lead to repeated execution of malicious payloads, unauthorized access, or data destruction. Security analysts should investigate these events to mitigate risks and prevent further compromise.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name IN ("systemctl", "service")
-            OR
-            Processes.process IN ("*systemctl *", "*service *")
-        )
-        Processes.process IN ("*restart*", "*reload*", "*reenable*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_service_restarted_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*systemctl", "*service") OR Processes.process IN ("*systemctl *", "*service *") Processes.process IN ("*restart*", "*reload*", "*reenable*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_service_restarted_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -40,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_service_started_or_enabled.yml b/detections/endpoint/linux_service_started_or_enabled.yml
index e2f7f3d94fc..c30bdf3f265 100644
--- a/detections/endpoint/linux_service_started_or_enabled.yml
+++ b/detections/endpoint/linux_service_started_or_enabled.yml
@@ -9,25 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation or enabling of services on Linux platforms using the systemctl or service tools. It leverages Endpoint Detection and Response (EDR) logs, focusing on process names, parent processes, and command-line executions. This activity is significant as adversaries may create or modify services to maintain persistence or execute malicious payloads. If confirmed malicious, this behavior could lead to persistent access, data theft, ransomware deployment, or other damaging outcomes. Monitoring and investigating such activities are crucial for maintaining the security and integrity of the environment.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name IN ("systemctl", "service")
-            OR
-            Processes.process IN ("*systemctl *", "*service *")
-        )
-        Processes.process IN ("* start *", "* enable *") AND NOT (Processes.os="Microsoft Windows" OR Processes.vendor_product="Microsoft Windows")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_service_started_or_enabled_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*systemctl", "*service") OR Processes.process IN ("*systemctl *", "*service *") Processes.process IN ("* start *", "* enable *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_service_started_or_enabled_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -40,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml
index 961409714a1..9241f1ded93 100644
--- a/detections/endpoint/linux_setuid_using_chmod_utility.yml
+++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml
@@ -9,25 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the chmod utility to set the SUID or SGID bit on files, which can allow users to temporarily gain root or group-level access. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments related to chmod. This activity is significant as it can indicate an attempt to escalate privileges or maintain persistence on a system. If confirmed malicious, an attacker could gain elevated access, potentially compromising sensitive data or critical system functions.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name = chmod
-            OR
-            Processes.process = "*chmod *"
-        )
-        AND Processes.process IN("* g+s *", "* u+s *", "* 4777 *", "* 4577 *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_setuid_using_chmod_utility_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*chmod" OR Processes.process="*chmod *" Processes.process IN ("* g+s *", "* u+s *", "* 4777 *", "* 4577 *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_setuid_using_chmod_utility_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -40,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_setuid_using_setcap_utility.yml b/detections/endpoint/linux_setuid_using_setcap_utility.yml
index 5b3fa8052f1..a7a73c78cf0 100644
--- a/detections/endpoint/linux_setuid_using_setcap_utility.yml
+++ b/detections/endpoint/linux_setuid_using_setcap_utility.yml
@@ -9,25 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the 'setcap' utility to enable the SUID bit on Linux systems. It leverages Endpoint Detection and Response (EDR) data, focusing on process names and command-line arguments that indicate the use of 'setcap' with specific capabilities. This activity is significant because setting the SUID bit allows a user to temporarily gain root access, posing a substantial security risk. If confirmed malicious, an attacker could escalate privileges, execute arbitrary commands with elevated permissions, and potentially compromise the entire system.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name = setcap
-            OR
-            Processes.process = "*setcap *"
-        )
-        AND Processes.process IN ("* cap_setuid=ep *", "* cap_setuid+ep *", "* cap_net_bind_service+p *", "* cap_net_raw+ep *", "* cap_dac_read_search+ep *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_setuid_using_setcap_utility_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*setcap" OR Processes.process="*setcap *" Processes.process IN ("* cap_setuid=ep *", "* cap_setuid+ep *", "* cap_net_bind_service+p *", "* cap_net_raw+ep *", "* cap_dac_read_search+ep *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_setuid_using_setcap_utility_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -40,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_shell_history_access_via_command_line_utility.yml b/detections/endpoint/linux_shell_history_access_via_command_line_utility.yml
index 15010e2008c..3303c0633fa 100644
--- a/detections/endpoint/linux_shell_history_access_via_command_line_utility.yml
+++ b/detections/endpoint/linux_shell_history_access_via_command_line_utility.yml
@@ -6,56 +6,18 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects attempts to read shell history files (bash, zsh, fish, etc.).
+description: 'The following analytic detects attempts to read shell history files (bash, zsh, fish, etc.).
+
     A history file is a log file that records all the commands executed in a shell on a Linux or Unix-based operating system.
-    A malicious actor who gains access to a user's shell history file can potentially obtain sensitive information and use it to compromise the user's system and data.
+
+    A malicious actor who gains access to a user''s shell history file can potentially obtain sensitive information and use it to compromise the user''s system and data.'
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_name IN (
-        "cat",
-        "fmt",
-        "head",
-        "less",
-        "more",
-        "nano",
-        "sort",
-        "tail",
-        "uniq",
-        "vi",
-        "vim"
-    )
-    Processes.process IN (
-        "*.bash_history*",
-        "*.history*",
-        "*.sh_history*",
-        "*.zhistory*",
-        "*.zsh_history*",
-        "*fish_history*"
-    )
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action Processes.dest
-       Processes.process_current_directory Processes.process_path Processes.process_integrity_level
-       Processes.original_file_name Processes.parent_process Processes.parent_process_path
-       Processes.parent_process_guid Processes.parent_process_id Processes.process_guid
-       Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_shell_history_access_via_command_line_utility_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate system administrators and automated scripts may access shell history files for auditing or troubleshooting purposes. Filter based on known administrative accounts and approved tooling in your environment.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*cat", "*fmt", "*head", "*less", "*more", "*nano", "*sort", "*tail", "*uniq", "*vi", "*vim") Processes.process IN ("*.bash_history*", "*.history*", "*.sh_history*", "*.zhistory*", "*.zsh_history*", "*fish_history*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_shell_history_access_via_command_line_utility_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate system administrators and automated scripts may access shell history files for auditing or troubleshooting purposes. Filter based on known administrative accounts and approved tooling in your environment.
+references: []
 drilldown_searches:
     - earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
@@ -95,8 +57,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.003/linux_bash_history_access/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_shell_pseudo_device_reverse_shell.yml b/detections/endpoint/linux_shell_pseudo_device_reverse_shell.yml
index b53c890037e..7e5eca0ce47 100644
--- a/detections/endpoint/linux_shell_pseudo_device_reverse_shell.yml
+++ b/detections/endpoint/linux_shell_pseudo_device_reverse_shell.yml
@@ -6,46 +6,19 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the use of shell's /dev/tcp or /dev/udp pseudo-device feature to establish outbound network connections.
+description: 'The following analytic detects the use of shell''s /dev/tcp or /dev/udp pseudo-device feature to establish outbound network connections.
+
     This special file system interface allows opening a network socket and sending or receiving data using simple shell commands.
-    Attackers commonly abuse this native shell capability to create reverse shells without requiring external tools such as netcat, by redirecting shell I/O over a TCP or UDP connection to an attacker-controlled host and port.
+
+    Attackers commonly abuse this native shell capability to create reverse shells without requiring external tools such as netcat, by redirecting shell I/O over a TCP or UDP connection to an attacker-controlled host and port.'
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_name IN (
-        "bash",
-        "dash",
-        "sh",
-        "zsh"
-    )
-    Processes.process IN (
-        "*/dev/tcp/*",
-        "*/dev/udp/*"
-    )
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*bash", "*dash", "*sh", "*zsh") Processes.process IN ("*/dev/tcp/*", "*/dev/udp/*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_shell_pseudo_device_reverse_shell_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: 'Legitimate system administrators or developers may use /dev/tcp or /dev/udp for network diagnostics or testing purposes.
 
-    by Processes.process Processes.vendor_product
-       Processes.user_id Processes.process_hash Processes.parent_process_name Processes.parent_process_exec
-       Processes.action Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    |`linux_shell_pseudo_device_reverse_shell_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate system administrators or developers may use /dev/tcp or /dev/udp for network diagnostics or testing purposes.
-    Filter based on known authorized users and trusted source systems.
+    Filter based on known authorized users and trusted source systems.'
 references:
     - https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-reverse-cheatsheet/#bash-tcp
 drilldown_searches:
@@ -90,8 +63,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_shred_overwrite_command.yml b/detections/endpoint/linux_shred_overwrite_command.yml
index fd2ba42faaa..6cb9814484a 100644
--- a/detections/endpoint/linux_shred_overwrite_command.yml
+++ b/detections/endpoint/linux_shred_overwrite_command.yml
@@ -9,22 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because the 'shred' command can be used in destructive attacks, such as those seen in the Industroyer2 malware targeting energy facilities. If confirmed malicious, this activity could lead to the permanent destruction of critical files, severely impacting system integrity and data availability.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name =shred
-        AND
-        Processes.process IN ("*-n*", "*-u*", "*-z*", "*-s*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_shred_overwrite_command_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*shred" Processes.process IN ("*-n*", "*-u*", "*-z*", "*-s*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_shred_overwrite_command_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -38,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A possible shred overwrite command $process$ executed on $dest$
     entity:
diff --git a/detections/endpoint/linux_sqlite3_privilege_escalation.yml b/detections/endpoint/linux_sqlite3_privilege_escalation.yml
index f2e6b601f58..4627b3bd684 100644
--- a/detections/endpoint/linux_sqlite3_privilege_escalation.yml
+++ b/detections/endpoint/linux_sqlite3_privilege_escalation.yml
@@ -9,24 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the sqlite3 command with elevated privileges, which can be exploited for privilege escalation. It leverages Endpoint Detection and Response (EDR) telemetry to identify instances where sqlite3 is used in conjunction with shell commands and sudo. This activity is significant because it indicates a potential attempt to gain root access, which could lead to full system compromise. If confirmed malicious, an attacker could execute arbitrary commands as root, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*sqlite3*"
-        AND
-        Processes.process="*.shell*"
-        AND
-        Processes.process="*sudo*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_sqlite3_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*sqlite3*" Processes.process="*.shell*" Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_sqlite3_privilege_escalation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -40,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_ssh_authorized_keys_modification.yml b/detections/endpoint/linux_ssh_authorized_keys_modification.yml
index 3fa6d9e2a51..5fedb982de3 100644
--- a/detections/endpoint/linux_ssh_authorized_keys_modification.yml
+++ b/detections/endpoint/linux_ssh_authorized_keys_modification.yml
@@ -9,20 +9,8 @@ type: Anomaly
 description: The following analytic detects the modification of SSH Authorized Keys on Linux systems. It leverages process execution data from Endpoint Detection and Response (EDR) agents, specifically monitoring commands like "bash" and "cat" interacting with "authorized_keys" files. This activity is significant as adversaries often modify SSH Authorized Keys to establish persistent access to compromised endpoints. If confirmed malicious, this behavior could allow attackers to maintain unauthorized access, bypassing traditional authentication mechanisms and potentially leading to further exploitation or data exfiltration.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN ("bash","cat") Processes.process IN ("*/authorized_keys*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_ssh_authorized_keys_modification_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*bash", "*cat") Processes.process="*/authorized_keys*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_ssh_authorized_keys_modification_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Filtering will be required as system administrators will add and remove. One way to filter query is to add "echo".
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/linux_ssh_remote_services_script_execute.yml b/detections/endpoint/linux_ssh_remote_services_script_execute.yml
index 542cd03ceef..3ec3accfb4d 100644
--- a/detections/endpoint/linux_ssh_remote_services_script_execute.yml
+++ b/detections/endpoint/linux_ssh_remote_services_script_execute.yml
@@ -9,22 +9,8 @@ type: TTP
 description: The following analytic detects the use of SSH to move laterally and execute a script or file on a remote host. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific SSH command-line parameters and URLs. This activity is significant as it may indicate an attacker attempting to execute remote commands or scripts, potentially leading to unauthorized access or control over additional systems. If confirmed malicious, this could result in lateral movement, privilege escalation, or the execution of malicious payloads, compromising the security of the network.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=ssh Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*")
-        AND
-        Processes.process IN ("*http:*","*https:*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_ssh_remote_services_script_execute_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*ssh" Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*") Processes.process IN ("*http:*", "*https:*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_ssh_remote_services_script_execute_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: This is not a common command to be executed. Filter as needed.
 references:
@@ -37,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ attempting to move laterally and download a file.
     entity:
diff --git a/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml b/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml
index bef90c8d030..92bce5c54c8 100644
--- a/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml
+++ b/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml
@@ -9,20 +9,8 @@ type: Anomaly
 description: The following analytic detects command-line activities that redirect stdout or stderr to the /dev/null file. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This behavior is significant as it can indicate attempts to hide command outputs, a technique observed in the CyclopsBlink malware to conceal modifications to iptables firewall settings. If confirmed malicious, this activity could allow an attacker to stealthily alter system configurations, potentially leading to unauthorized access or persistent control over the compromised machine.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process = "*&amp;&gt;/dev/null*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_stdout_redirection_to_dev_null_file_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*&amp;&gt;/dev/null*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_stdout_redirection_to_dev_null_file_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -36,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_stop_services.yml b/detections/endpoint/linux_stop_services.yml
index e9e688c1c1a..05aeec7542a 100644
--- a/detections/endpoint/linux_stop_services.yml
+++ b/detections/endpoint/linux_stop_services.yml
@@ -9,20 +9,8 @@ type: TTP
 description: The following analytic detects attempts to stop or clear a service on Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes like "systemctl," "service," and "svcadm" executing stop commands. This activity is significant as adversaries often terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, allowing attackers to persist, escalate privileges, or deploy destructive payloads, severely impacting system integrity and availability.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN ("systemctl", "service", "svcadm")  Processes.process ="*stop*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_stop_services_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*systemctl", "*service", "*svcadm") Processes.process="*stop*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_stop_services_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -36,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to stop services on endpoint $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/linux_sudo_or_su_execution.yml b/detections/endpoint/linux_sudo_or_su_execution.yml
index c8c7981a07e..113ef134950 100644
--- a/detections/endpoint/linux_sudo_or_su_execution.yml
+++ b/detections/endpoint/linux_sudo_or_su_execution.yml
@@ -9,22 +9,8 @@ type: Hunting
 description: The following analytic detects the execution of the "sudo" or "su" command on a Linux operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent process names. This activity is significant because "sudo" and "su" commands are commonly used by adversaries to elevate privileges, potentially leading to unauthorized access or control over the system. If confirmed malicious, this activity could allow attackers to execute commands with root privileges, leading to severe security breaches, data exfiltration, or further system compromise.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN ("sudo", "su")
-        OR
-        Processes.parent_process_name IN ("sudo", "su")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_sudo_or_su_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*sudo", "*su") OR Processes.parent_process_name IN ("sudo", "su") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_sudo_or_su_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
index c4db376818d..54723a96aa6 100644
--- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml
+++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of the "sudoers.tmp" file, which occurs when editing the /etc/sudoers file using visudo or another editor on a Linux platform. This detection leverages filesystem data to identify the presence of "sudoers.tmp" files. Monitoring this activity is crucial as adversaries may exploit it to gain elevated privileges on a compromised host. If confirmed malicious, this activity could allow attackers to modify sudoers configurations, potentially granting them unauthorized access to execute commands as other users, including root, thereby compromising the system's security.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.file_path IN ("*sudoers.tmp*")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(lastTime)`
-    | `security_content_ctime(firstTime)`
-    | `linux_sudoers_tmp_file_creation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*sudoers.tmp*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_sudoers_tmp_file_creation_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 known_false_positives: administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_suspicious_child_process_of_postgresql.yml b/detections/endpoint/linux_suspicious_child_process_of_postgresql.yml
index 42805186793..cf5aa414cf8 100644
--- a/detections/endpoint/linux_suspicious_child_process_of_postgresql.yml
+++ b/detections/endpoint/linux_suspicious_child_process_of_postgresql.yml
@@ -6,52 +6,17 @@ modification_date: '2026-07-17'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects PostgreSQL spawning a shell, interpreter, or network utility as a child process.
+description: 'The following analytic detects PostgreSQL spawning a shell, interpreter, or network utility as a child process.
+
     When an attacker exploits a remote code execution vulnerability in PostgreSQL (such as via malicious COPY TO/FROM PROGRAM, CVE-2019-9193, or an insecurely configured extension), the database process itself becomes the parent of attacker-controlled commands.
-    Legitimate PostgreSQL processes do not normally fork shells or download tools, making this a high-fidelity signal for post-exploitation activity.
+
+    Legitimate PostgreSQL processes do not normally fork shells or download tools, making this a high-fidelity signal for post-exploitation activity.'
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    (
-        Processes.parent_process_name IN (
-            "postgres",
-            "postmaster",
-            "pg_ctl"
-        )
-        OR
-        Processes.parent_process_path = "*/bin/postgres"
-        OR
-        Processes.process_current_directory="*/var/lib/postgresql/*/main*"
-    )
-    Processes.process_name IN (
-        "awk", "bash", "curl", "dash", "env", "gawk", "id", "ifconfig",
-        "ksh", "lua", "nc", "ncat", "netcat", "nmap", "openssl", "perl",
-        "php", "python", "python2", "python3", "ruby", "sh", "socat",
-        "tcpdump", "wget", "whoami", "zsh"
-    )
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_current_directory Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name Processes.process_path
-       Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_suspicious_child_process_of_postgresql_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Custom PostgreSQL extensions or wrapper scripts that legitimately invoke shell utilities may trigger this detection. Baseline the environment and use the filter macro to suppress known-good parent/child combinations. Recommend throttling by dest and process_name before enabling broadly.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("postgres", "postmaster", "pg_ctl") OR Processes.process_current_directory="*/var/lib/postgresql/*/main*" Processes.process_name IN ("*awk", "*bash", "*curl", "*dash", "*env", "*gawk", "*id", "*ifconfig", "*ksh", "*lua", "*nc", "*ncat", "*netcat", "*nmap", "*openssl", "*perl", "*php", "*python", "*python2", "*python3", "*ruby", "*sh", "*socat", "*tcpdump", "*wget", "*whoami", "*zsh") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_suspicious_child_process_of_postgresql_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Custom PostgreSQL extensions or wrapper scripts that legitimately invoke shell utilities may trigger this detection. Baseline the environment and use the filter macro to suppress known-good parent/child combinations. Recommend throttling by dest and process_name before enabling broadly.
 references:
     - https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/
     - https://www.postgresql.org/docs/current/sql-copy.html
@@ -95,8 +60,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_suspicious_docker_build_command_execution.yml b/detections/endpoint/linux_suspicious_docker_build_command_execution.yml
index 643adc69314..4c498774290 100644
--- a/detections/endpoint/linux_suspicious_docker_build_command_execution.yml
+++ b/detections/endpoint/linux_suspicious_docker_build_command_execution.yml
@@ -6,43 +6,15 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects docker build being executed on Dockerfiles within the /tmp directory.
-    This is not a typical location for this activity and can indicate an actor adding a container for malicious future actions.
+description: 'The following analytic detects docker build being executed on Dockerfiles within the /tmp directory.
+
+    This is not a typical location for this activity and can indicate an actor adding a container for malicious future actions.'
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process="*docker*"
-    Processes.process="*build*"
-    (
-        (
-            Processes.process="*-f *"
-            Processes.process="* /tmp*"
-        )
-        OR
-        Processes.process_current_directory="/tmp*"
-    )
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action Processes.dest
-       Processes.process_current_directory Processes.process_path Processes.process_integrity_level
-       Processes.original_file_name Processes.parent_process Processes.parent_process_path
-       Processes.parent_process_guid Processes.parent_process_id Processes.process_guid
-       Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_suspicious_docker_build_command_execution_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Developers or administrators may occasionally use the /tmp directory for testing Docker builds in non-production environments. Filter based on known users or systems where this activity has been approved.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*docker*" Processes.process="*build*" (Processes.process="*-f *" Processes.process="* /tmp*") OR Processes.process_current_directory="/tmp*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_suspicious_docker_build_command_execution_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Developers or administrators may occasionally use the /tmp directory for testing Docker builds in non-production environments. Filter based on known users or systems where this activity has been approved.
 references:
     - https://github.com/Aegrah/PANIX
 drilldown_searches:
@@ -78,8 +50,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1610/linux_suspicious_docker_build/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml b/detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml
index 321a5f1d9e6..009b4b7d26a 100644
--- a/detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml
+++ b/detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml
@@ -6,43 +6,13 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects compiler usage with flags commonly used to create shared libraries that auto-run initialization functions, which are often associated with local privilege escalation exploits.
+description: The following analytic detects compiler usage with flags commonly used to create shared libraries that auto-run initialization functions, which are often associated with local privilege escalation exploits.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    Processes.process_name IN (
-        "*x86_64-linux-gnu-gcc*",
-        "cc",
-        "g++",
-        "gcc-*",
-        "gcc"
-    )
-    Processes.process="*-shared*"
-    Processes.process="*-Wl,-init,*"
-    Processes.process="*.so*"
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_current_directory Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name Processes.process_path
-       Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_suspicious_gcc_invocation_building_init_shared_object_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate developers may use these GCC flags when building shared libraries that require initialization functions. Filter based on known development environments and trusted users.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path IN ("*x86_64-linux-gnu-gcc*", "*cc*", "*g++*", "*gcc-*", "*gcc*") Processes.process="*-shared*" Processes.process="*-Wl,-init,*" Processes.process="*.so*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_suspicious_gcc_invocation_building_init_shared_object_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate developers may use these GCC flags when building shared libraries that require initialization functions. Filter based on known development environments and trusted users.
 references:
     - https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-linux-sudo-flaw-exploited-in-attacks/
     - https://github.com/pr0v3rbs/CVE-2025-32463_chwoot
@@ -86,8 +56,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_suspicious_namespace_creation.yml b/detections/endpoint/linux_suspicious_namespace_creation.yml
index 86c010c4fe8..e61f40fb369 100644
--- a/detections/endpoint/linux_suspicious_namespace_creation.yml
+++ b/detections/endpoint/linux_suspicious_namespace_creation.yml
@@ -6,8 +6,7 @@ modification_date: '2026-05-12'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects an unprivileged user invoking the unshare syscall with user namespace flags followed within 120 seconds by a root-owned shell or interpreter spawning under the same parent process, correlating auditd syscall telemetry with Sysmon process creation events to identify the two-step sequence characteristic of user-namespace-based Linux kernel privilege escalation exploits such as DirtyFrag.
+description: The following analytic detects an unprivileged user invoking the unshare syscall with user namespace flags followed within 120 seconds by a root-owned shell or interpreter spawning under the same parent process, correlating auditd syscall telemetry with Sysmon process creation events to identify the two-step sequence characteristic of user-namespace-based Linux kernel privilege escalation exploits such as DirtyFrag.
 data_source:
     - Linux Auditd Syscall
     - Sysmon for Linux EventID 1
@@ -81,7 +80,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious namespace created on $dest$ indicating possible privilege escalation via DirtyFrag.
     entity:
diff --git a/detections/endpoint/linux_suspicious_privileged_container_execution.yml b/detections/endpoint/linux_suspicious_privileged_container_execution.yml
index 7bacb3256d3..e8b924784c0 100644
--- a/detections/endpoint/linux_suspicious_privileged_container_execution.yml
+++ b/detections/endpoint/linux_suspicious_privileged_container_execution.yml
@@ -6,37 +6,15 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the execution of a Docker container with the privileged flag set, or with the pid namespace set to the host.
-    This can indicate a container running with elevated permissions and access to the underlying system. Actors can hide containers such as this to enable persistent access.
+description: 'The following analytic detects the execution of a Docker container with the privileged flag set, or with the pid namespace set to the host.
+
+    This can indicate a container running with elevated permissions and access to the underlying system. Actors can hide containers such as this to enable persistent access.'
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process="*docker *"
-    Processes.process="* run*"
-    Processes.process IN ("*--privileged*", "*--pid=host*")
-
-    by Processes.process Processes.vendor_product Processes.user_id
-       Processes.process_hash Processes.parent_process_name
-       Processes.parent_process_exec Processes.action Processes.dest Processes.process_current_directory
-       Processes.process_path Processes.process_integrity_level Processes.original_file_name
-       Processes.parent_process Processes.parent_process_path Processes.parent_process_guid
-       Processes.parent_process_id Processes.process_guid Processes.process_id Processes.user
-       Processes.process_name
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_suspicious_privileged_container_execution_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate system administrators may intentionally run privileged containers for maintenance, debugging, or specific infrastructure tasks. Filter based on known approved workflows and trusted administrative users.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*docker *" Processes.process="* run*" Processes.process IN ("*--privileged*", "*--pid=host*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_suspicious_privileged_container_execution_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate system administrators may intentionally run privileged containers for maintenance, debugging, or specific infrastructure tasks. Filter based on known approved workflows and trusted administrative users.
 references:
     - https://github.com/Aegrah/PANIX
 drilldown_searches:
@@ -76,8 +54,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1610/linux_suspicious_privileged_container/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_suspicious_react_or_next_js_child_process.yml b/detections/endpoint/linux_suspicious_react_or_next_js_child_process.yml
index 7dc74706ad5..3c6659001f7 100644
--- a/detections/endpoint/linux_suspicious_react_or_next_js_child_process.yml
+++ b/detections/endpoint/linux_suspicious_react_or_next_js_child_process.yml
@@ -6,111 +6,31 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    This analytic detects Linux processes such as sh, bash, and common Linux LOLBINs being spawned by React or Next.js application servers.
-    In the context of CVE-2025-55182 / React2Shell / CVE-2025-66478 for Next.js, successful exploitation can lead to arbitrary JavaScript execution on the server, which in turn is commonly used to invoke Node's child_process APIs (for example child_process.execSync) to run OS-level commands.
-    Public proof-of-concept payloads and observed in-the-wild exploit traffic show patterns where the vulnerable React Server Components handler triggers process.mainModule.require('child_process').execSync() to execute binaries such as ping, curl, or arbitrary shells on the underlying host.
+description: 'This analytic detects Linux processes such as sh, bash, and common Linux LOLBINs being spawned by React or Next.js application servers.
+
+    In the context of CVE-2025-55182 / React2Shell / CVE-2025-66478 for Next.js, successful exploitation can lead to arbitrary JavaScript execution on the server, which in turn is commonly used to invoke Node''s child_process APIs (for example child_process.execSync) to run OS-level commands.
+
+    Public proof-of-concept payloads and observed in-the-wild exploit traffic show patterns where the vulnerable React Server Components handler triggers process.mainModule.require(''child_process'').execSync() to execute binaries such as ping, curl, or arbitrary shells on the underlying host.
+
     This detection focuses on suspicious child processes where a Next/React server process spawns an uncommon process.
-    Such activity might be a strong indicator of exploitation of the aforementioned vulnerability.
+
+    Such activity might be a strong indicator of exploitation of the aforementioned vulnerability.'
 data_source:
     - Sysmon for Linux EventID 1
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
-      from datamodel=Endpoint.Processes
-      where
-        Processes.parent_process_name = "node"
-        Processes.parent_process IN (
-          "*--experimental-https*",
-          "*--experimental-next-config-strip-types*",
-          "*/node_modules/next*",
-          "*next dev*",
-          "*next start*",
-          "*node_modules/.bin*",
-          "*react-scripts start*",
-          "*start-server.js*"
-        )
-        AND (
-          Processes.process_name IN (
-            "awk",
-            "gawk",
-            "ifconfig",
-            "lua",
-            "nc",
-            "ncat",
-            "netcat",
-            "openssl",
-            "perl",
-            "php",
-            "python",
-            "python2",
-            "python3",
-            "ruby",
-            "socat",
-            "telnet"
-          )
-          OR (
-            Processes.process_name IN ("curl", "wget")
-            Processes.process = "*|*"
-          )
-          OR (
-            Processes.process_name IN (
-              "bash",
-              "dash",
-              "sh"
-            )
-            NOT Processes.process = "*-c*"
-          )
-          OR (
-            Processes.process_name IN (
-              "bash",
-              "dash",
-              "ksh",
-              "sh",
-              "zsh"
-            )
-            Processes.process IN (
-              "*/dev/tcp/*",
-              "*/dev/udp/*",
-              "*0>&1*",
-              "*curl*",
-              "*exec *>&*",
-              "*fsockopen*",
-              "*ifconfig*",
-              "*mkfifo*",
-              "*nc *",
-              "*ncat*",
-              "*netcat*",
-              "*proc_open*",
-              "*s_client*",
-              "*socat*",
-              "*socket*",
-              "*subprocess*",
-              "*TCPSocket*",
-              "*wget*"
-            )
-          )
-        )
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process
-       Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name Processes.process_path
-       Processes.user Processes.user_id Processes.vendor_product
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="node" Processes.parent_process IN ("*--experimental-https*", "*--experimental-next-config-strip-types*", "*/node_modules/next*", "*next dev*", "*next start*", "*node_modules/.bin*", "*react-scripts start*", "*start-server.js*") (Processes.process_name IN ("*curl", "*wget") Processes.process="*|*") OR (Processes.process_name IN ("*bash", "*dash", "*sh") NOT Processes.process="*-c*") OR (Processes.process_name IN ("*bash", "*dash", "*ksh", "*sh", "*zsh") Processes.process IN ("*/dev/tcp/*", "*/dev/udp/*", "*0>&1*", "*curl*", "*exec *>&*", "*fsockopen*", "*ifconfig*", "*mkfifo*", "*nc *", "*ncat*", "*netcat*", "*proc_open*", "*s_client*", "*socat*", "*socket*", "*subprocess*", "*TCPSocket*", "*wget*")) OR Processes.process_name IN ("*awk", "*gawk", "*ifconfig", "*lua", "*nc", "*ncat", "*netcat", "*openssl", "*perl", "*php", "*python", "*python2", "*python3", "*ruby", "*socat", "*telnet") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_suspicious_react_or_next_js_child_process_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
 
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_suspicious_react_or_next_js_child_process_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
     These agents are designed to provide security-related telemetry from the endpoints where the agent is installed.
+
     To implement this search, you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions.
+
     These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model.
-    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    Rare false positives might show up from child processes such as sh. Apply additional filters as needed.
+
+    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.'
+known_false_positives: Rare false positives might show up from child processes such as sh. Apply additional filters as needed.
 references:
     - https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
     - https://nextjs.org/blog/CVE-2025-66478
@@ -125,7 +45,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Node-based server process ($parent_process_name$) on Linux spawned the child process $process_name$ with command-line $process$ on host $dest$ by user $user$, which may indicate remote code execution via React Server Components (CVE-2025-55182 / React2Shell) or abuse of a similar Node.js RCE vector.
     entity:
diff --git a/detections/endpoint/linux_suspicious_redis_activity.yml b/detections/endpoint/linux_suspicious_redis_activity.yml
index 9efe94050dc..fa4ec3bfc9e 100644
--- a/detections/endpoint/linux_suspicious_redis_activity.yml
+++ b/detections/endpoint/linux_suspicious_redis_activity.yml
@@ -6,49 +6,13 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects Redis processes spawning a system shell command. This can indicate exploitation activity of a redis server to gain code execution.
+description: The following analytic detects Redis processes spawning a system shell command. This can indicate exploitation activity of a redis server to gain code execution.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    (
-        Processes.parent_process_name IN (
-            "redis-sentinel",
-            "redis-server"
-        )
-        OR
-        Processes.parent_process_path = "*/bin/redis*"
-    )
-
-    Processes.process_name IN (
-        "awk", "bash", "curl", "dash", "gawk", "id", "ifconfig",
-        "lua", "nc", "ncat", "netcat", "openssl", "perl", "php",
-        "python", "python2", "python3", "ruby", "sh", "socat",
-        "wget", "whoami", "zsh"
-    )
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_current_directory Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name Processes.process_path
-       Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_suspicious_redis_activity_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate administrative scripts or automated maintenance tasks may trigger this detection when managing Redis configurations or performing system operations. Filter based on known administrative activity and approved management tools.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("redis-sentinel", "redis-server") Processes.process_name IN ("*awk", "*bash", "*curl", "*dash", "*gawk", "*id", "*ifconfig", "*lua", "*nc", "*ncat", "*netcat", "*openssl", "*perl", "*php", "*python", "*python2", "*python3", "*ruby", "*sh", "*socat", "*wget", "*whoami", "*zsh") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_suspicious_redis_activity_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate administrative scripts or automated maintenance tasks may trigger this detection when managing Redis configurations or performing system operations. Filter based on known administrative activity and approved management tools.
 references:
     - https://thesecmaster.com/how-to-fix-cve-2022-0543-a-critical-lua-sandbox-escape-vulnerability-in-redis/
     - https://www.bleepingcomputer.com/news/security/new-p2pinfect-worm-malware-targets-linux-and-windows-redis-servers/
@@ -93,8 +57,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml b/detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml
index 028d14ace5c..c04a76b837f 100644
--- a/detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml
+++ b/detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml
@@ -6,45 +6,15 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the creation of sensitive system files such as nsswitch.conf, passwd, shadow, sudoers, and NSS shared libraries outside of their canonical /etc or /var/lib/docker paths.
-    This technique is associated with CVE-2025-32463 (chwoot), where an attacker stages a fake root directory containing spoofed system configuration files and NSS libraries to manipulate how privileged processes such as sudo resolve name services, enabling local privilege escalation by hijacking library loading without modifying the real /etc directory.
+description: 'The following analytic detects the creation of sensitive system files such as nsswitch.conf, passwd, shadow, sudoers, and NSS shared libraries outside of their canonical /etc or /var/lib/docker paths.
+
+    This technique is associated with CVE-2025-32463 (chwoot), where an attacker stages a fake root directory containing spoofed system configuration files and NSS libraries to manipulate how privileged processes such as sudo resolve name services, enabling local privilege escalation by hijacking library loading without modifying the real /etc directory.'
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Filesystem WHERE
-
-    Filesystem.file_path IN (
-        "*/etc/group",
-        "*/etc/nsswitch.conf",
-        "*/etc/pam.conf",
-        "*/etc/passwd",
-        "*/etc/shadow",
-        "*/etc/sudo.conf",
-        "*/etc/sudoers",
-        "*/libnss_*"
-    )
-    NOT Filesystem.file_path IN (
-        "/etc/*",
-        "/var/lib/docker/*"
-    )
-
-    BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-       Filesystem.file_name Filesystem.file_path Filesystem.process_guid
-       Filesystem.process_id Filesystem.user Filesystem.vendor_product
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_suspicious_staging_of_alternate_system_files_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Developers or system administrators may stage alternate system files for legitimate testing or containerized environments. Filter based on known development or testing systems.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/group", "*/etc/nsswitch.conf", "*/etc/pam.conf", "*/etc/passwd", "*/etc/shadow", "*/etc/sudo.conf", "*/etc/sudoers", "*/libnss_") NOT (Filesystem.file_path IN ("/etc/*", "/var/lib/docker/*")) by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_suspicious_staging_of_alternate_system_files_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Developers or system administrators may stage alternate system files for legitimate testing or containerized environments. Filter based on known development or testing systems.
 references:
     - https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-linux-sudo-flaw-exploited-in-attacks/
     - https://github.com/pr0v3rbs/CVE-2025-32463_chwoot
@@ -81,8 +51,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_suspicious_xdg_autostart.yml b/detections/endpoint/linux_suspicious_xdg_autostart.yml
index 02002b9513e..8ee07b8fe85 100644
--- a/detections/endpoint/linux_suspicious_xdg_autostart.yml
+++ b/detections/endpoint/linux_suspicious_xdg_autostart.yml
@@ -6,38 +6,17 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the creation of a .desktop file within XDG autostart directories, including the system-wide /etc/xdg/autostart and user-local ~/.config/autostart paths.
+description: 'The following analytic detects the creation of a .desktop file within XDG autostart directories, including the system-wide /etc/xdg/autostart and user-local ~/.config/autostart paths.
+
     Adversaries abuse XDG autostart entries to achieve persistence on Linux desktop environments — any .desktop file placed in these directories is automatically executed when a user logs into a graphical session.
-    This technique is used by post-exploitation frameworks such as PANIX to survive reboots without requiring root on user-local paths, or to achieve system-wide persistence when writing to /etc/xdg/autostart.
+
+    This technique is used by post-exploitation frameworks such as PANIX to survive reboots without requiring root on user-local paths, or to achieve system-wide persistence when writing to /etc/xdg/autostart.'
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Filesystem WHERE
-
-    Filesystem.action="created"
-    Filesystem.file_path IN (
-        "/etc/xdg/autostart/*",
-        "*/.config/autostart/*"
-    )
-    Filesystem.file_path = "*.desktop"
-
-    BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-       Filesystem.file_name Filesystem.file_path Filesystem.process_guid
-       Filesystem.process_id Filesystem.user Filesystem.vendor_product
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_suspicious_xdg_autostart_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate software installations may create .desktop files in /etc/xdg/autostart as part of their normal setup process. Filter known software deployment tools and approved administrative activity as needed.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("/etc/xdg/autostart/*", "/.config/autostart/*") Filesystem.file_path="*.desktop" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_suspicious_xdg_autostart_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate software installations may create .desktop files in /etc/xdg/autostart as part of their normal setup process. Filter known software deployment tools and approved administrative activity as needed.
 references:
     - https://github.com/Aegrah/PANIX
 drilldown_searches:
@@ -74,8 +53,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml
index f41e115544d..5c2136aac59 100644
--- a/detections/endpoint/linux_system_network_discovery.yml
+++ b/detections/endpoint/linux_system_network_discovery.yml
@@ -6,63 +6,20 @@ modification_date: '2026-10-02'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies potential enumeration of local network configuration on Linux systems.
+description: 'The following analytic identifies potential enumeration of local network configuration on Linux systems.
+
     It detects this activity by monitoring processes such as "arp," "ifconfig," "ip," "netstat," "firewall-cmd," "ufw," "iptables," "ss," and "route" within a 30-minute window.
+
     This behavior is significant as it often indicates reconnaissance efforts by adversaries to gather network information for subsequent attacks.
-    If confirmed malicious, this activity could enable attackers to map the network, identify vulnerabilities, and plan further exploitation or lateral movement within the environment.
+
+    If confirmed malicious, this activity could enable attackers to map the network, identify vulnerabilities, and plan further exploitation or lateral movement within the environment.'
 data_source:
     - Sysmon for Linux EventID 1
     - Osquery Results
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-            values(Processes.action) as action
-            values(Processes.original_file_name) as original_file_name
-            values(Processes.parent_process_exec) as parent_process_exec
-            values(Processes.parent_process_guid) as parent_process_guid
-            values(Processes.parent_process_id) as parent_process_id
-            values(Processes.parent_process_name) as parent_process_name
-            values(Processes.parent_process_path) as parent_process_path
-            values(Processes.parent_process) as parent_process
-            values(Processes.process_exec) as process_exec
-            values(Processes.process_guid) as process_guid
-            values(Processes.process_hash) as process_hash
-            values(Processes.process_id) as process_id
-            values(Processes.process_integrity_level) as process_integrity_level
-            values(Processes.process_name) as process_name
-            values(Processes.process_path) as process_path
-            values(Processes.process) as process
-            values(Processes.user_id) as user_id
-            values(Processes.vendor_product) as vendor_product
-            dc(Processes.process_name) as process_name_count
-    FROM datamodel=Endpoint.Processes WHERE
-
-    Processes.process_name IN (
-        "arp",
-        "firewall-cmd",
-        "ifconfig",
-        "ip",
-        "iptables",
-        "netstat",
-        "route",
-        "ss",
-        "ufw"
-    )
-
-    BY _time span=30m Processes.dest Processes.user
-
-    | where process_name_count>=4
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_system_network_discovery_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*arp", "*firewall-cmd", "*ifconfig", "*ip", "*iptables", "*netstat", "*route", "*ss", "*ufw") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_system_network_discovery_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md
     - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L33
@@ -74,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -109,6 +66,6 @@ tests:
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_network_discovery.log
-          sourcetype: osquery:results
           source: osquery
+          sourcetype: osquery:results
       test_type: unit
diff --git a/detections/endpoint/linux_system_reboot_via_system_request_key.yml b/detections/endpoint/linux_system_reboot_via_system_request_key.yml
index fae06269f2f..a962738ae21 100644
--- a/detections/endpoint/linux_system_reboot_via_system_request_key.yml
+++ b/detections/endpoint/linux_system_reboot_via_system_request_key.yml
@@ -9,19 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the SysReq hack to reboot a Linux system host. It leverages Endpoint Detection and Response (EDR) data to identify processes executing the command to pipe 'b' to /proc/sysrq-trigger. This activity is significant as it is an uncommon method to reboot a system and was observed in the Awfulshred malware wiper. If confirmed malicious, this technique could indicate the presence of suspicious processes and potential system compromise, leading to unauthorized reboots and disruption of services.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN ("dash", "sudo", "bash")  Processes.process =  "* echo b &gt; *" Processes.process = "*/proc/sysrq-trigger"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `linux_system_reboot_via_system_request_key_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*dash", "*sudo", "*bash") Processes.process="* echo b &gt; *" Processes.process="*/proc/sysrq-trigger" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_system_reboot_via_system_request_key_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -37,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: a $process_name$ execute sysrq command $process$ to reboot $dest$
     entity:
diff --git a/detections/endpoint/linux_telnet_authentication_bypass.yml b/detections/endpoint/linux_telnet_authentication_bypass.yml
index e462835e048..a64c5e6e388 100644
--- a/detections/endpoint/linux_telnet_authentication_bypass.yml
+++ b/detections/endpoint/linux_telnet_authentication_bypass.yml
@@ -9,20 +9,8 @@ type: TTP
 description: Detects an authentication bypass in telnet tracked as CVE-2026-24061. An attacker can supply a specifically crafted USER environment variable (-f root) that is passed to /usr/bin/login. Because this input isn't sanitized an attacker can force the system to skip authentication and login directly as root.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "login" Processes.parent_process_name = "telnetd" Processes.process = "* -p *" Processes.process = "* -f root*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_telnet_authentication_bypass_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*login" Processes.parent_process_name="telnetd" Processes.process="* -p *" Processes.process="* -f root*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_telnet_authentication_bypass_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: It is rare for the telnetd to spawn login process with these arguments.
 references:
@@ -35,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ with CommandLine $process$ was identified on endpoint $dest$ by user $user$ related to an authentication bypass in telnetd.
     entity:
diff --git a/detections/endpoint/linux_udev_rule_created.yml b/detections/endpoint/linux_udev_rule_created.yml
index d2bb67607db..a26ba740971 100644
--- a/detections/endpoint/linux_udev_rule_created.yml
+++ b/detections/endpoint/linux_udev_rule_created.yml
@@ -6,35 +6,13 @@ modification_date: '2026-07-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the creation of files within udev rules directories, including /etc/udev/rules.d and /usr/lib/udev/rules.d. Adversaries abuse udev rules to achieve persistent code execution by embedding RUN+= directives that trigger arbitrary commands whenever a matching device event occurs, such as a USB device being connected or a network interface coming online. Because udev rules execute in the context of the udev daemon with elevated privileges, this technique can provide both persistence and privilege escalation. It is used by post-exploitation frameworks such as PANIX and is effective on headless servers where device events still fire despite no interactive user session.
+description: The following analytic detects the creation of files within udev rules directories, including /etc/udev/rules.d and /usr/lib/udev/rules.d. Adversaries abuse udev rules to achieve persistent code execution by embedding RUN+= directives that trigger arbitrary commands whenever a matching device event occurs, such as a USB device being connected or a network interface coming online. Because udev rules execute in the context of the udev daemon with elevated privileges, this technique can provide both persistence and privilege escalation. It is used by post-exploitation frameworks such as PANIX and is effective on headless servers where device events still fire despite no interactive user session.
 data_source:
     - Sysmon for Linux EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Filesystem WHERE
-
-    Filesystem.file_path IN (
-        "/etc/udev/rules.d/*",
-        "/usr/lib/udev/rules.d/*"
-    )
-
-    BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-       Filesystem.file_name Filesystem.file_path Filesystem.process_guid
-       Filesystem.process_id Filesystem.user Filesystem.vendor_product
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_udev_rule_created_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate system administrators or software installers may create udev rules as part of normal hardware configuration or device management tasks. Filter based on known administrative activity and trusted software installations.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("/etc/udev/rules.d/*", "/usr/lib/udev/rules.d/*") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_udev_rule_created_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate system administrators or software installers may create udev rules as part of normal hardware configuration or device management tasks. Filter based on known administrative activity and trusted software installations.
 references:
     - https://github.com/Aegrah/PANIX
 drilldown_searches:
@@ -71,8 +49,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml b/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml
index 92c3e6d2e34..b7ad858b692 100644
--- a/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml
+++ b/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml
@@ -9,19 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of a command to enable all SysRq functions on a Linux system, a technique associated with the AwfulShred malware. It leverages Endpoint Detection and Response (EDR) data to identify processes executing the command to pipe bitmask '1' to /proc/sys/kernel/sysrq. This activity is significant as it can indicate an attempt to manipulate kernel system requests, which is uncommon and potentially malicious. If confirmed, this could allow an attacker to reboot the system or perform other critical actions, leading to system instability or further compromise.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN ("dash", "sudo", "bash")  Processes.process =  "* echo 1 &gt; *" Processes.process = "*/proc/sys/kernel/sysrq"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `linux_unix_shell_enable_all_sysrq_functions_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*dash", "*sudo", "*bash") Processes.process="* echo 1 &gt; *" Processes.process="*/proc/sys/kernel/sysrq" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_unix_shell_enable_all_sysrq_functions_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -36,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/linux_usermod_root_uid_set.yml b/detections/endpoint/linux_usermod_root_uid_set.yml
index 443c1fe2e13..818d64c99ff 100644
--- a/detections/endpoint/linux_usermod_root_uid_set.yml
+++ b/detections/endpoint/linux_usermod_root_uid_set.yml
@@ -9,22 +9,8 @@ type: TTP
 description: The following analytic detects the use of usermod to set a user's UID to 0. This functionally sets the user as a root user with full permissions. This approach can be used to bypass regular privilege escalation mechanisms, giving the attacker full control over the system while appearing as a regular user in most monitoring tools.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime FROM datamodel=Endpoint.Processes
-    WHERE Processes.process_name="usermod"
-      AND (Processes.process IN ("* -u 0 *", "* -u 0") OR Processes.process="*--uid 0*")
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_current_directory Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name Processes.process_path
-       Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_usermod_root_uid_set_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*usermod" Processes.process IN ("* -u 0 *", "* -u 0*", "*--uid 0*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_usermod_root_uid_set_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Setting a user's UID to 0 is extremely rare in legitimate administration — there is almost no valid operational reason to create a second root-equivalent account this way. False positives are expected to be very low. Verify any alert against change management records before dismissing.
 references:
@@ -72,8 +58,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack_linux.log
           source: Syslog:Linux-Sysmon/Operational
           sourcetype: sysmon:linux
+      test_type: unit
diff --git a/detections/endpoint/linux_visudo_utility_execution.yml b/detections/endpoint/linux_visudo_utility_execution.yml
index bb876891f70..23197b6d55c 100644
--- a/detections/endpoint/linux_visudo_utility_execution.yml
+++ b/detections/endpoint/linux_visudo_utility_execution.yml
@@ -9,20 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the 'visudo' utility to modify the /etc/sudoers file on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because unauthorized changes to the /etc/sudoers file can grant elevated privileges to users, potentially allowing adversaries to execute commands as root. If confirmed malicious, this could lead to full system compromise, privilege escalation, and persistent unauthorized access, severely impacting the security posture of the affected host.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = visudo
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `linux_visudo_utility_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*visudo" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_visudo_utility_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 references:
@@ -35,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/living_off_the_land_detection.yml b/detections/endpoint/living_off_the_land_detection.yml
index c221bb62035..a679aee0003 100644
--- a/detections/endpoint/living_off_the_land_detection.yml
+++ b/detections/endpoint/living_off_the_land_detection.yml
@@ -8,7 +8,7 @@ status: production
 type: Correlation
 description: The following correlation identifies multiple risk events associated with the "Living Off The Land" analytic story, indicating potentially suspicious behavior. It leverages the Risk data model to aggregate and correlate events tagged under this story, focusing on systems with a high count of distinct sources. This activity is significant as it often involves the use of legitimate tools for malicious purposes, making detection challenging. If confirmed malicious, this behavior could allow attackers to execute code, escalate privileges, or persist within the environment using trusted system utilities.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
       WHERE All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system"
       BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$risk_object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Living Off The Land Behavior detected - $risk_object$
     entity:
diff --git a/detections/endpoint/llm_model_file_creation.yml b/detections/endpoint/llm_model_file_creation.yml
index 27abf9c5256..133ab1dd011 100644
--- a/detections/endpoint/llm_model_file_creation.yml
+++ b/detections/endpoint/llm_model_file_creation.yml
@@ -6,64 +6,27 @@ modification_date: '2026-07-15'
 author: Rod Soto, Nasreddine Bencherchali, Splunk
 status: production
 type: Hunting
-description: |
-    Detects the creation of Large Language Model (LLM) files on Windows endpoints by monitoring file creation events for specific model file formats and extensions commonly used by local AI frameworks.
+description: 'Detects the creation of Large Language Model (LLM) files on Windows endpoints by monitoring file creation events for specific model file formats and extensions commonly used by local AI frameworks.
+
     This detection identifies potential shadow AI deployments, unauthorized model downloads, and rogue LLM infrastructure by detecting file creation patterns associated with quantized models (.gguf, .ggml), safetensors model format files, and Ollama Modelfiles.
+
     These file types are characteristic of local inference frameworks such as Ollama, llama.cpp, GPT4All, LM Studio, and similar tools that enable running LLMs locally without cloud dependencies.
-    Organizations can use this detection to identify potential data exfiltration risks, policy violations related to unapproved AI usage, and security blind spots created by decentralized AI deployments that bypass enterprise governance and monitoring.
+
+    Organizations can use this detection to identify potential data exfiltration risks, policy violations related to unapproved AI usage, and security blind spots created by decentralized AI deployments that bypass enterprise governance and monitoring.'
 data_source:
     - Sysmon EventID 11
 search: |
-    | tstats `security_content_summariesonly` count
-        min(_time) as firstTime
-        max(_time) as lastTime
-    from datamodel=Endpoint.Filesystem where
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="ggml-*" Filesystem.file_name IN ("*.gguf", "*.safetensors", "*ggml.dll", "*modelfile", "*.dll") NOT (Filesystem.file_path IN ("__PSScriptPolicyTest*", ".csv*", ".doc*", ".docx*", ".jpeg*", ".jpg*", ".pdf*", ".png*", ".ppt*", ".pptx*", ".py*", ".xls*", ".xlsx*", "Bentley.Civil*")) by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `llm_model_file_creation_filter`
+how_to_implement: 'To successfully implement this search, you need to be ingesting logs with file creation events from your endpoints.
 
-    (
-        Filesystem.file_name IN (
-            "*.gguf",
-            "*.safetensors",
-            "*ggml.dll",
-            "*modelfile*"
-        )
-        OR
-        (
-            Filesystem.file_name = "ggml-*"
-            Filesystem.file_name = "*.dll"
-        )
-    )
-    NOT Filesystem.file_name IN (
-        "__PSScriptPolicyTest*",
-        "*.csv",
-        "*.doc",
-        "*.docx",
-        "*.jpeg",
-        "*.jpg",
-        "*.pdf",
-        "*.png",
-        "*.ppt",
-        "*.pptx",
-        "*.py",
-        "*.xls",
-        "*.xlsx",
-        "*Bentley.Civil*"
-    )
-    by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
-       Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path
-       Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-       Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `llm_model_file_creation_filter`
-how_to_implement: |
-    To successfully implement this search, you need to be ingesting logs with file creation events from your endpoints.
     Ensure that the Endpoint data model is properly populated with filesystem events from EDR agents or Sysmon Event ID 11.
+
     The logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product.
+
     The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model.
-    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    Legitimate creation of LLM model files by authorized developers, ML engineers, and researchers during model training, fine-tuning, or experimentation. Approved AI/ML sandboxes and lab environments where model file creation is expected. Automated ML pipelines and workflows that generate or update model files as part of their normal operation. Third-party applications and services that manage or cache LLM model files for legitimate purposes.
+
+    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.'
+known_false_positives: Legitimate creation of LLM model files by authorized developers, ML engineers, and researchers during model training, fine-tuning, or experimentation. Approved AI/ML sandboxes and lab environments where model file creation is expected. Automated ML pipelines and workflows that generate or update model files as part of their normal operation. Third-party applications and services that manage or cache LLM model files for legitimate purposes.
 references:
     - https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
     - https://www.ibm.com/think/topics/shadow-ai
diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml
index ba399165e4b..aa409ae7985 100644
--- a/detections/endpoint/loading_of_dynwrapx_module.yml
+++ b/detections/endpoint/loading_of_dynwrapx_module.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the loading of the dynwrapx.dll module, which is associated with the DynamicWrapperX ActiveX component. This detection leverages Sysmon EventCode 7 to identify processes that load or register dynwrapx.dll. This activity is significant because DynamicWrapperX can be used to call Windows API functions in scripts, making it a potential tool for malicious actions. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence on the host. Immediate investigation of parallel processes and registry modifications is recommended.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName = "dynwrapx.dll" OR  Product = "DynamicWrapperX") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `loading_of_dynwrapx_module_filter`'
+search: |
+    `sysmon` EventCode=7 ImageLoaded="*\\dynwrapx.dll" OR OriginalFileName="dynwrapx.dll" OR Product="DynamicWrapperX" | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `loading_of_dynwrapx_module_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default).
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: dynwrapx.dll loaded by process $process_name$ on $dest$
     entity:
diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml
index b1af08dc560..12297498ec9 100644
--- a/detections/endpoint/local_account_discovery_with_wmic.yml
+++ b/detections/endpoint/local_account_discovery_with_wmic.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_wmic` (Processes.process=*useraccount*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `local_account_discovery_with_wmic_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process="*useraccount*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_wmic_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/local_llm_framework_dns_query.yml b/detections/endpoint/local_llm_framework_dns_query.yml
index e4d3bad5550..2727dc96e06 100644
--- a/detections/endpoint/local_llm_framework_dns_query.yml
+++ b/detections/endpoint/local_llm_framework_dns_query.yml
@@ -6,80 +6,17 @@ modification_date: '2026-07-15'
 author: Rod Soto, Nasreddine Bencherchali, Splunk
 status: production
 type: Hunting
-description: |
-    Detects DNS queries related to local LLM models on endpoints by monitoring Sysmon DNS query events (Event ID 22) for known LLM model domains and services.
+description: 'Detects DNS queries related to local LLM models on endpoints by monitoring Sysmon DNS query events (Event ID 22) for known LLM model domains and services.
+
     Local LLM frameworks like Ollama, LM Studio, and GPT4All make DNS calls to repositories such as huggingface.co and ollama.ai for model downloads, updates, and telemetry.
-    These queries can reveal unauthorized AI tool usage or data exfiltration risks on corporate networks.
+
+    These queries can reveal unauthorized AI tool usage or data exfiltration risks on corporate networks.'
 data_source:
     - Sysmon EventID 22
 search: |
-    `sysmon`
-    EventCode=22
-    QueryName IN (
-        "*anthropic*",
-        "*api.openrouter*",
-        "*civitai*",
-        "*dashscope.aliyuncs*",
-        "*gpt4all*",
-        "*huggingface*",
-        "*jan.ai*",
-        "*koboldai*",
-        "*lmstudio*",
-        "*modelscope*",
-        "*nomic.ai*",
-        "*ollama*",
-        "*oobabooga*",
-        "*openai*",
-        "*openrouter*",
-        "*replicate*",
-        "*tongyi*"
-    )
-    NOT (
-        Image IN (
-            "*\\360se.exe", "*\\arc.exe", "*\\atlas.exe", "*\\avastbrowser.exe",
-            "*\\avgbrowser.exe", "*\\blpbrowser.exe", "*\\brave.exe", "*\\braveupdate.exe",
-            "*\\chrome.exe", "*\\chromium.exe", "*\\Cisco\\Cisco Secure Client\\ThousandEyes Endpoint Agent\\*",
-            "*\\coccoc.exe", "*\\dragon.exe", "*\\duckduckgo.exe", "*\\epic.exe",
-            "*\\firefox.exe", "*\\ghost.exe", "*\\iexplore.exe", "*\\iridium.exe",
-            "*\\iron.exe", "*\\maxthon.exe", "*\\microsoftedge.exe", "*\\microsoftedgeupdate.exe",
-            "*\\msedge.exe", "*\\msedgewebview2.exe", "*\\MsMpEng.exe", "*\\opera_autoupdate.exe",
-            "*\\opera.exe", "*\\perplexity.exe", "*\\rave.exe", "*\\safari.exe", "*\\shift.exe",
-            "*\\sidekick.exe", "*\\thorium.exe", "*\\torch.exe", "*\\vivaldi.exe",
-            "*\\wavebrowser.exe", "*\\whale.exe", "*\\zen.exe", "C:\\ProgramData\\*",
-            "C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*"
-        )
-        OR
-        (
-            Image IN ("*\\AnthropicClaude\\Update.exe", "*\\claude.exe")
-            QueryName = "anthropic.com"
-        )
-        OR
-        (
-            Image = "*\\lm studio.exe"
-            QueryName = "lmstudio.ai"
-        )
-        OR
-        (
-            Image IN ("*\\ollama app.exe", "*\\ollama.exe")
-            QueryName = "ollama.com"
-        )
-        OR
-        (
-            Image IN ("*\\chatgpt.exe", "*\\codex.exe")
-            QueryName = "openai.com"
-        )
-    )
-    | stats count
-        min(_time) as firstTime
-        max(_time) as lastTime
-        by src Image process_name QueryName query_count answer answer_count reply_code_id vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `local_llm_framework_dns_query_filter`
-how_to_implement: |
-    Ensure Sysmon is deployed across Windows endpoints and configured to capture DNS query events (Event ID 22). Configure Sysmon's XML configuration file to log detailed command-line arguments, parent process information, and full process image paths. Ingest Sysmon event logs into Splunk via the Splunk Universal Forwarder or Windows Event Log Input, ensuring they are tagged with `sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`. Verify the `sysmon` macro exists in your Splunk environment and correctly references the Sysmon event logs. Create or update the `unauthorized_local_llm_framework_usage_filter` macro in your detections/filters folder to exclude approved systems, authorized developers, sanctioned ML/AI workstations, or known development/lab environments as needed. Deploy this hunting search to your Splunk Enterprise Security or Splunk Enterprise instance and schedule it to run on a regular cadence to detect unauthorized LLM model DNS queries and shadow AI activities. Correlate findings with endpoint asset inventory and user identity data to prioritize investigation.
-known_false_positives: |
-    Legitimate DNS queries to LLM model hosting platforms by authorized developers, ML engineers, and researchers during model training, fine-tuning, or experimentation. Approved AI/ML sandboxes and lab environments where LLM model downloads are expected. Automated ML pipelines and workflows that interact with LLM model hosting services as part of their normal operation. Third-party applications and services that access LLM model platforms for legitimate purposes.
+    `sysmon` EventCode=22 QueryName IN ("*anthropic*", "*api.openrouter*", "*civitai*", "*dashscope.aliyuncs*", "*gpt4all*", "*huggingface*", "*jan.ai*", "*koboldai*", "*lmstudio*", "*modelscope*", "*nomic.ai*", "*ollama*", "*oobabooga*", "*openai*", "*openrouter*", "*replicate*", "*tongyi*") NOT ((Image IN ("*\\AnthropicClaude\\Update.exe", "*\\claude.exe") QueryName="anthropic.com") OR (Image="*\\lm studio.exe" QueryName="lmstudio.ai") OR (Image IN ("*\\ollama app.exe", "*\\ollama.exe") QueryName="ollama.com") OR (Image IN ("*\\chatgpt.exe", "*\\codex.exe") QueryName="openai.com") OR Image IN ("*\\360se.exe", "*\\arc.exe", "*\\atlas.exe", "*\\avastbrowser.exe", "*\\avgbrowser.exe", "*\\blpbrowser.exe", "*\\brave.exe", "*\\braveupdate.exe", "*\\chrome.exe", "*\\chromium.exe", "*\\Cisco\\Cisco Secure Client\\ThousandEyes Endpoint Agent\\", "*\\coccoc.exe", "*\\dragon.exe", "*\\duckduckgo.exe", "*\\epic.exe", "*\\firefox.exe", "*\\ghost.exe", "*\\iexplore.exe", "*\\iridium.exe", "*\\iron.exe", "*\\maxthon.exe", "*\\microsoftedge.exe", "*\\microsoftedgeupdate.exe", "*\\msedge.exe", "*\\msedgewebview2.exe", "*\\MsMpEng.exe", "*\\opera_autoupdate.exe", "*\\opera.exe", "*\\perplexity.exe", "*\\rave.exe", "*\\safari.exe", "*\\shift.exe", "*\\sidekick.exe", "*\\thorium.exe", "*\\torch.exe", "*\\vivaldi.exe", "*\\wavebrowser.exe", "*\\whale.exe", "*\\zen.exe", "*C:\\ProgramData\\", "*C:\\Windows\\System32\\", "*C:\\Windows\\SysWOW64\\")) | eval process_name=process_name, dvc=dvc, dest=Computer, QueryName=QueryName | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count query query_count reply_code_id src vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_llm_framework_dns_query_filter`
+how_to_implement: Ensure Sysmon is deployed across Windows endpoints and configured to capture DNS query events (Event ID 22). Configure Sysmon's XML configuration file to log detailed command-line arguments, parent process information, and full process image paths. Ingest Sysmon event logs into Splunk via the Splunk Universal Forwarder or Windows Event Log Input, ensuring they are tagged with `sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`. Verify the `sysmon` macro exists in your Splunk environment and correctly references the Sysmon event logs. Create or update the `unauthorized_local_llm_framework_usage_filter` macro in your detections/filters folder to exclude approved systems, authorized developers, sanctioned ML/AI workstations, or known development/lab environments as needed. Deploy this hunting search to your Splunk Enterprise Security or Splunk Enterprise instance and schedule it to run on a regular cadence to detect unauthorized LLM model DNS queries and shadow AI activities. Correlate findings with endpoint asset inventory and user identity data to prioritize investigation.
+known_false_positives: Legitimate DNS queries to LLM model hosting platforms by authorized developers, ML engineers, and researchers during model training, fine-tuning, or experimentation. Approved AI/ML sandboxes and lab environments where LLM model downloads are expected. Automated ML pipelines and workflows that interact with LLM model hosting services as part of their normal operation. Third-party applications and services that access LLM model platforms for legitimate purposes.
 references:
     - https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
     - https://www.splunk.com/en_us/blog/artificial-intelligence/splunk-technology-add-on-for-ollama.html
diff --git a/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml b/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml
index 72ffd77d488..dbe549a3c73 100644
--- a/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml
+++ b/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml
@@ -8,7 +8,7 @@ status: production
 type: Correlation
 description: The following analytic identifies potential exploitation of Log4Shell CVE-2021-44228 by correlating multiple MITRE ATT&CK tactics detected in risk events. It leverages Splunk's risk data model to calculate the distinct count of MITRE ATT&CK tactics from Log4Shell-related detections. This activity is significant because it indicates a high probability of exploitation if two or more distinct tactics are observed. If confirmed malicious, this activity could lead to initial payload delivery, callback to a malicious server, and post-exploitation activities, potentially resulting in unauthorized access, lateral movement, and further compromise of the affected systems.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
       WHERE All_Risk.analyticstories="Log4Shell CVE-2021-44228" All_Risk.risk_object_type="system"
       BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$risk_object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Log4Shell CVE-2021-44228 Exploitation detected - $risk_object$
     entity:
diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml
index 13125a35711..df1c429aaa1 100644
--- a/detections/endpoint/logon_script_event_trigger_execution.yml
+++ b/detections/endpoint/logon_script_event_trigger_execution.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the modification of the UserInitMprLogonScript registry entry, which is often used by attackers to establish persistence and gain privilege escalation upon system boot. It leverages data from the Endpoint.Registry data model, focusing on changes to the specified registry path. This activity is significant because it is a common technique used by APT groups and malware to ensure their payloads execute automatically when the system starts. If confirmed malicious, this could allow attackers to maintain persistent access and potentially escalate their privileges on the compromised host.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Environment\\UserInitMprLogonScript") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `logon_script_event_trigger_execution_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Environment\\UserInitMprLogonScript" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `logon_script_event_trigger_execution_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Registry path $registry_path$ was modified, added, or deleted on $dest$.
     entity:
diff --git a/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml b/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml
index aa4777b88a4..7b90bf12efc 100644
--- a/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml
+++ b/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml
@@ -6,11 +6,13 @@ modification_date: '2026-08-24'
 author: Steven Dick, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic identifies Living Off the Land Binaries and Scripts (LOLBAS) that can legitimately initiate public network connections but are communicating over uncommon destination ports.
+description: 'The following analytic identifies Living Off the Land Binaries and Scripts (LOLBAS) that can legitimately initiate public network connections but are communicating over uncommon destination ports.
+
     It leverages the Network Traffic data model and applies per-binary common-port exclusions to reduce false positives while preserving suspicious non-standard communication.
+
     This behavior may indicate payload download, command-and-control, proxy execution, or attempts to blend malicious traffic into trusted Windows binaries.
-    Join this detection with the Process Execution events to provide context and avoid false positives.
+
+    Join this detection with the Process Execution events to provide context and avoid false positives.'
 data_source:
     - Sysmon EventID 3
 search: |
@@ -107,12 +109,12 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `lolbas_network_connection_on_uncommon_port_filter`
-how_to_implement: |-
-    To successfully implement this detection you must ingest events into the Network Traffic data model that contain the source, destination, destination port, and communicating process name in the app field.
-    Sysmon EventID 3 is a common source for this data when normalized into the Network Traffic data model.
-known_false_positives: |-
-    Legitimate software installation, support tooling, scripting, synchronization, or update workflows may still use uncommon ports in some environments.
-    Tune approved destinations, ports, and process paths with the analytic filter macro.
+how_to_implement: 'To successfully implement this detection you must ingest events into the Network Traffic data model that contain the source, destination, destination port, and communicating process name in the app field.
+
+    Sysmon EventID 3 is a common source for this data when normalized into the Network Traffic data model.'
+known_false_positives: 'Legitimate software installation, support tooling, scripting, synchronization, or update workflows may still use uncommon ports in some environments.
+
+    Tune approved destinations, ports, and process paths with the analytic filter macro.'
 references:
     - https://lolbas-project.github.io/#
     - https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/
@@ -124,7 +126,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/lolbas_rare_network_connection.yml b/detections/endpoint/lolbas_rare_network_connection.yml
index f6bc5c36555..c6b8cbc7bc6 100644
--- a/detections/endpoint/lolbas_rare_network_connection.yml
+++ b/detections/endpoint/lolbas_rare_network_connection.yml
@@ -6,13 +6,17 @@ modification_date: '2026-08-24'
 author: Steven Dick, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic identifies public network connections initiated by Living Off the Land Binaries and Scripts (LOLBAS) that rarely require direct outbound network access.
+description: 'The following analytic identifies public network connections initiated by Living Off the Land Binaries and Scripts (LOLBAS) that rarely require direct outbound network access.
+
     It leverages the Network Traffic data model and focuses on native Windows binaries where any public destination should be investigated and explicitly approved.
+
     This activity may indicate proxy execution, process injection, payload download, command-and-control, or other abuse of trusted binaries to evade security controls.
+
     Keep in mind that some of these binaries, such as Netsh.exe, Gpscript.exe, Wmic.exe, etc., will occasionally communicate with public network resources to perform their intended function.
+
     Exclude said processes from the detection if they are too noisy for your environment.
-    Join this detection with the Process Execution events to provide context and avoid false positives.
+
+    Join this detection with the Process Execution events to provide context and avoid false positives.'
 data_source:
     - Sysmon EventID 3
 search: |
@@ -85,13 +89,14 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `lolbas_rare_network_connection_filter`
-how_to_implement: |-
-    To successfully implement this detection you must ingest events into the Network Traffic data model that contain the source, destination, destination port, and communicating process name in the app field. Sysmon EventID 3 is a common source for this data when normalized into the Network Traffic data model.
-known_false_positives: |-
-    Limited legitimate administrative automation and scripts may cause false positives.
+how_to_implement: To successfully implement this detection you must ingest events into the Network Traffic data model that contain the source, destination, destination port, and communicating process name in the app field. Sysmon EventID 3 is a common source for this data when normalized into the Network Traffic data model.
+known_false_positives: 'Limited legitimate administrative automation and scripts may cause false positives.
+
     Any recurring use of these binaries for public network access should be reviewed, approved, and filtered with the analytic filter macro.
-    Notepad.exe can now communicate with Microsoft's service "apsaiservices.microsoft.com" over port 443 to provide AI services. Apply filtering if this behavior is known in your environment.
-    PowerShell, PowerShell ISE, PowerShell 7 (pwsh.exe), and cmd.exe are intentionally excluded from this analytic because they are too noisy.
+
+    Notepad.exe can now communicate with Microsoft''s service "apsaiservices.microsoft.com" over port 443 to provide AI services. Apply filtering if this behavior is known in your environment.
+
+    PowerShell, PowerShell ISE, PowerShell 7 (pwsh.exe), and cmd.exe are intentionally excluded from this analytic because they are too noisy.'
 references:
     - https://lolbas-project.github.io/#
     - https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/
@@ -103,7 +108,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/macos_account_created.yml b/detections/endpoint/macos_account_created.yml
index 80b1f4b0565..db02dcd58bf 100644
--- a/detections/endpoint/macos_account_created.yml
+++ b/detections/endpoint/macos_account_created.yml
@@ -6,13 +6,14 @@ modification_date: '2026-09-01'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the creation of a new local user account on a MacOS system. It leverages osquery logs to identify this activity.
+description: 'The following analytic detects the creation of a new local user account on a MacOS system. It leverages osquery logs to identify this activity.
+
     Monitoring the creation of local accounts is crucial for a SOC as it can indicate unauthorized access or lateral movement within the network.
-    If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data.
+
+    If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data.'
 data_source:
     - Osquery Results
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -52,11 +53,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `macos_account_created_filter`
-how_to_implement: |-
-    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
-    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
-known_false_positives: |-
-    Creating new accounts after initial endpoint management should be rare in most environments. Investigate and tune as needed.
+how_to_implement: 'This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+
+    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.'
+known_false_positives: Creating new accounts after initial endpoint management should be rare in most environments. Investigate and tune as needed.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
     - https://ss64.com/mac/sysadminctl.html
@@ -70,7 +70,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml b/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml
index 85775139d9e..56e76acd25a 100644
--- a/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml
+++ b/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml
@@ -6,43 +6,16 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk, Alex Karkins
 status: production
 type: Anomaly
-description: |
-    The following analytic detects AMOS Stealer VM check activity on macOS. It leverages osquery to monitor process events and identifies the execution of the "osascript" command along with specific commandline strings.
+description: 'The following analytic detects AMOS Stealer VM check activity on macOS. It leverages osquery to monitor process events and identifies the execution of the "osascript" command along with specific commandline strings.
+
     This activity is significant as AMOS stealer was seen using this pattern in order to check if the host is a Virtual Machine or not.
-    If confirmed malicious, this behavior indicate that the host is already infected by the AMOS stealer, which could allow attackers to execute arbitrary code, escalate privileges, steal information, or persist within the environment, posing a significant security risk.
+
+    If confirmed malicious, this behavior indicate that the host is already infected by the AMOS stealer, which could allow attackers to execute arbitrary code, escalate privileges, steal information, or persist within the environment, posing a significant security risk.'
 data_source:
     - Osquery Results
 search: |
-    `osquery_macro`
-    name=es_process_events
-    columns.cmdline="*osascript*"
-    columns.cmdline="* -e *"
-    columns.cmdline="*set*"
-    columns.cmdline="*system_profiler*"
-    columns.cmdline IN ("*VMware*", "*QEMU*")
-
-    | rename columns.* as *
-
-    | stats  min(_time) as firstTime max(_time) as lastTime
-      values(cmdline) as cmdline,
-      values(pid) as pid,
-      values(parent) as parent,
-      values(path) as path,
-      values(signing_id) as signing_id,
-      by username host
-
-    | rename
-      username as user,
-      cmdline as process,
-      parent as parent_process,
-      path as process_path,
-      host as dest
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `macos_amos_stealer___virtual_machine_check_activity_filter`
-how_to_implement: |
-    This detection leverages osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+    `osquery_macro` name="es_process_events" columns.cmdline="*osascript*" columns.cmdline="* -e *" columns.cmdline="*set*" columns.cmdline="*system_profiler*" columns.cmdline IN ("*VMware*", "*QEMU*") | eval dest=dest, user=username, host=host | stats count min(_time) as firstTime max(_time) as lastTime by name cmdline | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_amos_stealer___virtual_machine_check_activity_filter`
+how_to_implement: This detection leverages osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
 known_false_positives: No false positives have been identified at this time.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
@@ -55,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/macos_applescript_shell_execution_and_compilation.yml b/detections/endpoint/macos_applescript_shell_execution_and_compilation.yml
index be5632f1187..721545b49d8 100644
--- a/detections/endpoint/macos_applescript_shell_execution_and_compilation.yml
+++ b/detections/endpoint/macos_applescript_shell_execution_and_compilation.yml
@@ -6,14 +6,16 @@ modification_date: '2026-09-03'
 author: Radka Viskova, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the use of macOS AppleScript utilities to execute shell commands or compile AppleScript containing shell-command logic.
-    The analytic identifies `osascript` invocations using AppleScript's `do shell script` command, which executes shell commands on the host.
+description: 'The following analytic detects the use of macOS AppleScript utilities to execute shell commands or compile AppleScript containing shell-command logic.
+
+    The analytic identifies `osascript` invocations using AppleScript''s `do shell script` command, which executes shell commands on the host.
+
     It also identifies `osacompile` invocations referencing `do shell script`. `osacompile` compiles AppleScript into a compiled script but does not execute it directly.
-    Adversaries may abuse these utilities to execute shell commands, stage AppleScript payloads, or prepare scripts for later execution. Matches involving `osacompile` should be interpreted as script compilation or staging rather than confirmed shell-command execution.
+
+    Adversaries may abuse these utilities to execute shell commands, stage AppleScript payloads, or prepare scripts for later execution. Matches involving `osacompile` should be interpreted as script compilation or staging rather than confirmed shell-command execution.'
 data_source:
     - Osquery Results
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -45,11 +47,10 @@ search: |-
     | table firstTime lastTime dest user activity_type parent_process process parent_process_name parent_process_exec parent_process_guid parent_process_id parent_process_path process_exec process_guid process_hash process_id process_integrity_level process_name process_path action user_id vendor_product
 
     | `macos_applescript_shell_execution_and_compilation_filter`
-how_to_implement: |-
-    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
-    Also the TA-OSquery (https://splunkbase.splunk.com/app/8574) must be deployed in order to have the osquery data populate the data models.
-known_false_positives: |-
-    Legitimate administrative scripts or automation tools using Applescript.
+how_to_implement: 'This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+
+    Also the TA-OSquery (https://splunkbase.splunk.com/app/8574) must be deployed in order to have the osquery data populate the data models.'
+known_false_positives: Legitimate administrative scripts or automation tools using Applescript.
 references:
     - https://attack.mitre.org/tactics/TA0002/
     - https://attack.mitre.org/techniques/T1059/002/
@@ -63,7 +64,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/macos_data_chunking.yml b/detections/endpoint/macos_data_chunking.yml
index 4fb29f13823..ec72bf6371c 100644
--- a/detections/endpoint/macos_data_chunking.yml
+++ b/detections/endpoint/macos_data_chunking.yml
@@ -6,13 +6,14 @@ modification_date: '2026-09-01'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects suspicious data chunking activities that involve the use of split or dd, potentially indicating an attempt to evade detection by breaking large files into smaller parts.
+description: 'The following analytic detects suspicious data chunking activities that involve the use of split or dd, potentially indicating an attempt to evade detection by breaking large files into smaller parts.
+
     Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data.
-    By monitoring for unusual or unauthorized use of these commands, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network.
+
+    By monitoring for unusual or unauthorized use of these commands, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network.'
 data_source:
     - Osquery Results
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -40,11 +41,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `macos_data_chunking_filter`
-how_to_implement: |-
-    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
-    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
-known_false_positives: |-
-    Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
+how_to_implement: 'This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+
+    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.'
+known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
     - https://ss64.com/mac/dd.html
@@ -57,7 +57,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/macos_gatekeeper_bypass.yml b/detections/endpoint/macos_gatekeeper_bypass.yml
index 2525ad03a2e..f6392c2b4e2 100644
--- a/detections/endpoint/macos_gatekeeper_bypass.yml
+++ b/detections/endpoint/macos_gatekeeper_bypass.yml
@@ -6,12 +6,12 @@ modification_date: '2026-10-02'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects known MacOS security bypass techniques that may be used to enable malicious code execution.
-    Specifically monitors for attempts to remove the com.apple.quarantine attribute using xattr, or to disable Gatekeeper protections via spctl --master-disable, both of which can allow untrusted or malicious applications to execute without standard system safeguards.
+description: 'Detects known MacOS security bypass techniques that may be used to enable malicious code execution.
+
+    Specifically monitors for attempts to remove the com.apple.quarantine attribute using xattr, or to disable Gatekeeper protections via spctl --master-disable, both of which can allow untrusted or malicious applications to execute without standard system safeguards.'
 data_source:
     - Osquery Results
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -39,11 +39,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `macos_gatekeeper_bypass_filter`
-how_to_implement: |-
-    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
-    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
-known_false_positives: |-
-    Administrators or power users may need to disable Gatekeeper to install unsigned tools.
+how_to_implement: 'This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+
+    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.'
+known_false_positives: Administrators or power users may need to disable Gatekeeper to install unsigned tools.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
     - https://ss64.com/mac/xattr.html
@@ -57,7 +56,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/macos_hidden_files_and_directories.yml b/detections/endpoint/macos_hidden_files_and_directories.yml
index 512d9d50196..556ddd0b926 100644
--- a/detections/endpoint/macos_hidden_files_and_directories.yml
+++ b/detections/endpoint/macos_hidden_files_and_directories.yml
@@ -6,13 +6,14 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data.
+description: 'The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker''s attempt to conceal malicious activities or unauthorized data.
+
     Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information.
-    By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, and helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively.
+
+    By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, and helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively.'
 data_source:
     - Osquery Results
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where
 
     (
@@ -37,11 +38,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `macos_hidden_files_and_directories_filter`
-how_to_implement: |-
-    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
-    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
-known_false_positives: |-
-    Power users or developers utilizing build tools or CI/CD tools could trigger this activity.
+how_to_implement: 'This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+
+    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.'
+known_false_positives: Power users or developers utilizing build tools or CI/CD tools could trigger this activity.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
     - https://ss64.com/mac/chflags.html
@@ -54,7 +54,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/macos_kextload_usage.yml b/detections/endpoint/macos_kextload_usage.yml
index 0f299ce134e..a08da02c273 100644
--- a/detections/endpoint/macos_kextload_usage.yml
+++ b/detections/endpoint/macos_kextload_usage.yml
@@ -6,12 +6,12 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects execution of the kextload command on macOS systems. The kextload utility is used to manually load kernel extensions (KEXTs) into the macOS kernel, which can introduce privileged code at the kernel level.
-    While legitimate for driver installation and system administration, misuse may indicate attempts to install unauthorized, malicious, or persistence-enabling kernel extensions.
+description: 'Detects execution of the kextload command on macOS systems. The kextload utility is used to manually load kernel extensions (KEXTs) into the macOS kernel, which can introduce privileged code at the kernel level.
+
+    While legitimate for driver installation and system administration, misuse may indicate attempts to install unauthorized, malicious, or persistence-enabling kernel extensions.'
 data_source:
     - Osquery Results
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -38,11 +38,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `macos_kextload_usage_filter`
-how_to_implement: |-
-    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
-    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
-known_false_positives: |-
-    Administrators installing new drivers could use this application.
+how_to_implement: 'This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+
+    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.'
+known_false_positives: Administrators installing new drivers could use this application.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
     - https://www.unix.com/man_page/osx/8/kextload/
@@ -54,7 +53,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible kernel extension loaded on $dest$ by $user$ via $process$
     entity:
diff --git a/detections/endpoint/macos_keychains_dumped.yml b/detections/endpoint/macos_keychains_dumped.yml
index baa8affa24f..131afff3894 100644
--- a/detections/endpoint/macos_keychains_dumped.yml
+++ b/detections/endpoint/macos_keychains_dumped.yml
@@ -6,14 +6,16 @@ modification_date: '2026-10-02'
 author: Raven Tait, Jamie Windley, Splunk
 status: production
 type: TTP
-description: |-
-    Detects command-line attempts to access or dump macOS Keychain data using native utilities or direct file access.
+description: 'Detects command-line attempts to access or dump macOS Keychain data using native utilities or direct file access.
+
     This includes credential dumping via the `security` utility (e.g. `dump-keychain -d`), bulk certificate export using `security find-certificate`, and direct file copying of Keychain database files using utilities such as `cat`.
+
     Keychain files are located in `~/Library/Keychains/`, `/Library/Keychains/`, and `/Network/Library/Keychains/`.
-    This technique is commonly associated with post-exploitation credential harvesting, where an attacker with local access seeks to escalate privileges or move laterally by obtaining stored credentials for applications, Wi-Fi networks, system services, and certificates.
+
+    This technique is commonly associated with post-exploitation credential harvesting, where an attacker with local access seeks to escalate privileges or move laterally by obtaining stored credentials for applications, Wi-Fi networks, system services, and certificates.'
 data_source:
     - Osquery Results
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -60,11 +62,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `macos_keychains_dumped_filter`
-how_to_implement: |-
-    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
-    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
-known_false_positives: |-
-    Administrators accessing keychain files for troubleshooting or endpoint management.
+how_to_implement: 'This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+
+    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.'
+known_false_positives: Administrators accessing keychain files for troubleshooting or endpoint management.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
     - https://gist.github.com/hfeeki/88c12f01d00534e09a84
@@ -79,7 +80,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Keychains dumped on $dest$ by $user$ via $process$
     entity:
diff --git a/detections/endpoint/macos_list_firewall_rules.yml b/detections/endpoint/macos_list_firewall_rules.yml
index a09c47f4b16..5c304b16bf8 100644
--- a/detections/endpoint/macos_list_firewall_rules.yml
+++ b/detections/endpoint/macos_list_firewall_rules.yml
@@ -6,12 +6,15 @@ modification_date: '2026-10-02'
 author: Jamie Windley, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects attempts to enumerate or verify the configuration of the macOS application firewall.
+description: 'This analytic detects attempts to enumerate or verify the configuration of the macOS application firewall.
+
     Specifically, it monitors executions of `defaults read /Library/Preferences/com.apple.alf` and `/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate`.
+
     These commands provide insight into firewall status, allowed applications, and explicit authorization rules.
+
     While they are legitimate administrative operations, adversaries may leverage them to identify potential attack surfaces, determine whether the firewall is active, or enumerate allowed network flows.
-    Monitoring for these commands, particularly when executed by non-administrative users or at unusual times, can provide early indication of reconnaissance activity on macOS endpoints
+
+    Monitoring for these commands, particularly when executed by non-administrative users or at unusual times, can provide early indication of reconnaissance activity on macOS endpoints'
 data_source:
     - Osquery Results
 search: |
@@ -45,10 +48,8 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `macos_list_firewall_rules_filter`
-how_to_implement: |
-    Collection of process execution events from macOS endpoints is required. This can be achieved using osquery's `es_process_events` table, EndpointSecurity framework integrations, or an EDR platform capable of recording process command lines. Ensure that captured events include at least the process path, full command line, user context, and timestamp.
-known_false_positives: |
-    These commands are frequently executed by system administrators or IT personnel during routine configuration checks, troubleshooting, or automated maintenance scripts. Security tools or monitoring agents may also query firewall status for inventory or compliance purposes. To reduce false positives, consider excluding events from known administrative accounts, trusted management systems, or scheduled maintenance jobs.
+how_to_implement: Collection of process execution events from macOS endpoints is required. This can be achieved using osquery's `es_process_events` table, EndpointSecurity framework integrations, or an EDR platform capable of recording process command lines. Ensure that captured events include at least the process path, full command line, user context, and timestamp.
+known_false_positives: These commands are frequently executed by system administrators or IT personnel during routine configuration checks, troubleshooting, or automated maintenance scripts. Security tools or monitoring agents may also query firewall status for inventory or compliance purposes. To reduce false positives, consider excluding events from known administrative accounts, trusted management systems, or scheduled maintenance jobs.
 references:
     - https://www.manpagez.com/man/8/socketfilterfw/
     - https://ss64.com/mac/defaults.html
@@ -96,6 +97,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_list_firewall_rules.log
-          sourcetype: osquery:results
           source: osquery
+          sourcetype: osquery:results
       test_type: unit
diff --git a/detections/endpoint/macos_log_removal.yml b/detections/endpoint/macos_log_removal.yml
index c5055b906e3..483e7704311 100644
--- a/detections/endpoint/macos_log_removal.yml
+++ b/detections/endpoint/macos_log_removal.yml
@@ -6,12 +6,12 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects the deletion or modification of logs on MacOS systems by identifying execution of the rm command with command-line arguments referencing system.log or audit-related paths.
-    Adversaries may remove or alter log files to cover their tracks and hinder detection and forensic analysis. This behavior commonly occurs during post-exploitation cleanup.
+description: 'Detects the deletion or modification of logs on MacOS systems by identifying execution of the rm command with command-line arguments referencing system.log or audit-related paths.
+
+    Adversaries may remove or alter log files to cover their tracks and hinder detection and forensic analysis. This behavior commonly occurs during post-exploitation cleanup.'
 data_source:
     - Osquery Results
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -40,11 +40,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `macos_log_removal_filter`
-how_to_implement: |-
-    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
-    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
-known_false_positives: |-
-    Legitimate log rotation or administrative cleanup of system or audit logs.
+how_to_implement: 'This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+
+    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.'
+known_false_positives: Legitimate log rotation or administrative cleanup of system or audit logs.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
 drilldown_searches:
@@ -55,7 +54,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Log removal or modification on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/macos_loginhook_persistence.yml b/detections/endpoint/macos_loginhook_persistence.yml
index 7db02edacbd..305ac355edf 100644
--- a/detections/endpoint/macos_loginhook_persistence.yml
+++ b/detections/endpoint/macos_loginhook_persistence.yml
@@ -6,12 +6,12 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Identifies attempts to configure a macOS LoginHook via the defaults utility. LoginHooks enable automatic execution of a script or program upon user login and have historically been abused for persistence.
-    Creation or modification of this setting may indicate an attempt to establish startup execution outside standard LaunchAgent mechanisms.
+description: 'Identifies attempts to configure a macOS LoginHook via the defaults utility. LoginHooks enable automatic execution of a script or program upon user login and have historically been abused for persistence.
+
+    Creation or modification of this setting may indicate an attempt to establish startup execution outside standard LaunchAgent mechanisms.'
 data_source:
     - Osquery Results
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -34,11 +34,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `macos_loginhook_persistence_filter`
-how_to_implement: |-
-    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
-    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
-known_false_positives: |-
-    This method is possibly still used by legacy enterprise management scripts. Update filter macro to remove false positives.
+how_to_implement: 'This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+
+    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.'
+known_false_positives: This method is possibly still used by legacy enterprise management scripts. Update filter macro to remove false positives.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
     - https://www.loobins.io/binaries/defaults/
@@ -50,7 +49,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Loginhook created on $dest$ by $user$ via $process$
     entity:
diff --git a/detections/endpoint/macos_lolbin.yml b/detections/endpoint/macos_lolbin.yml
index 69fb1993ee1..33c8cd0d020 100644
--- a/detections/endpoint/macos_lolbin.yml
+++ b/detections/endpoint/macos_lolbin.yml
@@ -13,7 +13,8 @@ description: 'The following analytic detects multiple executions of Living off t
     If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk.'
 data_source:
     - Osquery Results
-search: "`osquery_macro`\nname=es_process_events\ncolumns.cmdline IN (\n    \"chmod*\",\n    \"crontab*\",\n    \"curl*\",\n    \"find*\",\n    \"funzip*\",\n    \"killall*\",\n    \"openssl*\",\n    \"screencapture*\",\n    \"wget*\",\n)\n| rename columns.* as *\n| stats count min(_time) as firstTime\n              max(_time) as lastTime\n              values(cmdline) as cmdline\n              values(pid) as pid\n              values(parent) as parent\n              values(path) as path\n              values(signing_id) as signing_id\n              dc(path) as dc_path\n    BY username host\n\n| rename username as user\n        cmdline as process\n        path as process_path\n        host as dest\n\n| where dc_path > 3\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `macos_lolbin_filter`"
+search: |
+    `osquery_macro` name="es_process_events" columns.cmdline IN ("chmod*", "crontab*", "curl*", "find*", "funzip*", "killall*", "openssl*", "screencapture*", "wget*") | eval dest=dest, user=username, host=host | stats count min(_time) as firstTime max(_time) as lastTime by name cmdline | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_lolbin_filter`
 how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/endpoint/macos_network_share_discovery.yml b/detections/endpoint/macos_network_share_discovery.yml
index f5a37a09cc2..6f8825d27d3 100644
--- a/detections/endpoint/macos_network_share_discovery.yml
+++ b/detections/endpoint/macos_network_share_discovery.yml
@@ -6,11 +6,10 @@ modification_date: '2026-10-02'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Identifies execution of network share enumeration commands (smbutil, showmount) that can be leveraged by adversaries to discover accessible SMB and NFS resources, supporting internal reconnaissance and potential lateral movement.
+description: Identifies execution of network share enumeration commands (smbutil, showmount) that can be leveraged by adversaries to discover accessible SMB and NFS resources, supporting internal reconnaissance and potential lateral movement.
 data_source:
     - Osquery Results
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -30,11 +29,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `macos_network_share_discovery_filter`
-how_to_implement: |-
-    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
-    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
-known_false_positives: |-
-    Administrators may utilize these tools occasionaly for troubleshooting.
+how_to_implement: 'This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+
+    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.'
+known_false_positives: Administrators may utilize these tools occasionaly for troubleshooting.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
     - https://leopard-adc.pepas.com/documentation/Darwin/Reference/ManPages/man8/showmount.8.html
@@ -48,7 +46,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml
index 983787c0c01..039c2f70f05 100644
--- a/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml
+++ b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml
@@ -6,13 +6,14 @@ modification_date: '2026-10-02'
 author: Radka Viskova, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the execution of the macOS osascript utility with AppleScript commands that display a dialog or alert containing potentially deceptive, credential-related, or security-themed content.
+description: 'The following analytic detects the execution of the macOS osascript utility with AppleScript commands that display a dialog or alert containing potentially deceptive, credential-related, or security-themed content.
+
     Adversaries may abuse osascript to present fake system messages or credential prompts and trick users into disclosing sensitive information.
-    This detection is based on command-line content and should be reviewed with the parent process, executing user, script content, and surrounding endpoint activity.
+
+    This detection is based on command-line content and should be reviewed with the parent process, executing user, script content, and surrounding endpoint activity.'
 data_source:
     - Osquery Results
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -48,11 +49,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `macos_osascript_displaying_suspicious_user_prompt_filter`
-how_to_implement: |-
-    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
-    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
-known_false_positives: |-
-    Legitimate administrative, MDM, software deployment, support, or automation scripts may use osascript to display dialogs or alerts. Review the parent process, executing user, script content, signer, and known administrative tooling before suppressing the activity.
+how_to_implement: 'This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+
+    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.'
+known_false_positives: Legitimate administrative, MDM, software deployment, support, or automation scripts may use osascript to display dialogs or alerts. Review the parent process, executing user, script content, signer, and known administrative tooling before suppressing the activity.
 references:
     - https://attack.mitre.org/tactics/TA0002/
     - https://attack.mitre.org/tactics/TA0006/
@@ -72,7 +72,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/macos_osascript_executing_interactive_shell.yml b/detections/endpoint/macos_osascript_executing_interactive_shell.yml
index 5c50548ce5e..bfc41248f35 100644
--- a/detections/endpoint/macos_osascript_executing_interactive_shell.yml
+++ b/detections/endpoint/macos_osascript_executing_interactive_shell.yml
@@ -6,14 +6,16 @@ modification_date: '2026-09-18'
 author: Radka Viskova, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic detects the macOS osascript utility being used with an interactive Bash invocation, identified by the presence
+description: 'This analytic detects the macOS osascript utility being used with an interactive Bash invocation, identified by the presence
+
     of "bash -i" in the command line.
-    Adversaries may abuse osascript and AppleScript's shell execution capabilities to launch
-    interactive shells, establish remote access, or execute post-exploitation commands.
+
+    Adversaries may abuse osascript and AppleScript''s shell execution capabilities to launch
+
+    interactive shells, establish remote access, or execute post-exploitation commands.'
 data_source:
     - Osquery Results
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -36,11 +38,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `macos_osascript_executing_interactive_shell_filter`
-how_to_implement: |-
-    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
-    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
-known_false_positives: |-
-    Legitimate administrative scripts, MDM workflows, software deployment tools, developer automation, or support utilities may use osascript to invoke an interactive shell.
+how_to_implement: 'This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+
+    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.'
+known_false_positives: Legitimate administrative scripts, MDM workflows, software deployment tools, developer automation, or support utilities may use osascript to invoke an interactive shell.
 references:
     - https://attack.mitre.org/tactics/TA0002/
     - https://attack.mitre.org/techniques/T1059/002/
@@ -55,7 +56,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml b/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml
index b0a26a48976..d81448baf3e 100644
--- a/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml
+++ b/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml
@@ -6,14 +6,16 @@ modification_date: '2026-09-18'
 author: Radka Viskova, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic detects the macOS osascript utility executing JavaScript for Automation (JXA) code, identified by
+description: 'This analytic detects the macOS osascript utility executing JavaScript for Automation (JXA) code, identified by
+
     the "-l JavaScript" interpreter flag, with references to the Objective-C bridge. Adversaries may abuse JXA and
+
     Objective-C APIs to interact with macOS applications, access native system functionality, execute commands, or
-    perform post-exploitation activity.
+
+    perform post-exploitation activity.'
 data_source:
     - Osquery Results
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -37,11 +39,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `macos_osascript_executing_javascript_code_with_objc_filter`
-how_to_implement: |-
-    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
-    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
-known_false_positives: |-
-    Scripts that legitimately invoke utility Osascript with JavaScript for automation or system management.
+how_to_implement: 'This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+
+    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.'
+known_false_positives: Scripts that legitimately invoke utility Osascript with JavaScript for automation or system management.
 references:
     - https://attack.mitre.org/tactics/TA0002/
     - https://attack.mitre.org/techniques/T1059/002/
@@ -55,7 +56,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/macos_plutil.yml b/detections/endpoint/macos_plutil.yml
index 62ffbdd7924..3a73759118d 100644
--- a/detections/endpoint/macos_plutil.yml
+++ b/detections/endpoint/macos_plutil.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the usage of the `plutil` command to modify plist files on macOS systems. It leverages osquery to monitor process events, specifically looking for executions of `/usr/bin/plutil`. This activity is significant because adversaries can use `plutil` to alter plist files, potentially adding malicious binaries or command-line arguments that execute upon user logon or system startup. If confirmed malicious, this could allow attackers to achieve persistence, execute arbitrary code, or escalate privileges, posing a significant threat to the system's security.
 data_source:
     - Osquery Results
-search: "`osquery_macro` name=es_process_events columns.path=/usr/bin/plutil\n  | rename columns.* as *\n  | stats count  min(_time) as firstTime max(_time) as lastTime\n    BY username host cmdline\n       pid path parent\n       signing_id\n  | rename username as user, cmdline as process, path as process_path, host as dest\n  | `security_content_ctime(firstTime)`\n  | `security_content_ctime(lastTime)`\n  | `macos_plutil_filter`"
+search: |
+    `osquery_macro` name="es_process_events" columns.path="/usr/bin/plutil" | eval dest=dest, user=username, host=host | stats count min(_time) as firstTime max(_time) as lastTime by name path | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_plutil_filter`
 how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
 known_false_positives: Administrators using plutil to change plist files.
 references:
diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml
index e81933f6f5a..903bd6bea39 100644
--- a/detections/endpoint/mailsniper_invoke_functions.yml
+++ b/detections/endpoint/mailsniper_invoke_functions.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of known MailSniper PowerShell functions on a machine. It leverages PowerShell logs (EventCode 4104) to identify specific script block text associated with MailSniper activities. This behavior is significant as MailSniper is often used by attackers to harvest sensitive emails from compromised Exchange servers. If confirmed malicious, this activity could lead to unauthorized access to sensitive email data, credential theft, and further compromise of the email infrastructure.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText IN ("*Invoke-GlobalO365MailSearch*", "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `mailsniper_invoke_functions_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*Invoke-GlobalO365MailSearch*", "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*", "*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*", "*Invoke-OpenInboxFinder*", "*Invoke-InjectGEventAPI*", "*Invoke-InjectGEvent*", "*Invoke-SearchGmail*", "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*", "*Invoke-PasswordSprayEAS*", "*Invoke-UsernameHarvestEAS*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mailsniper_invoke_functions_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential mailsniper.ps1 functions executed on dest $dest$ by user $user_id$.
     entity:
diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml
index 7a36570bc70..559212fe9ed 100644
--- a/detections/endpoint/malicious_inprocserver32_modification.yml
+++ b/detections/endpoint/malicious_inprocserver32_modification.yml
@@ -10,7 +10,8 @@ description: The following analytic detects a process modifying the registry wit
 data_source:
     - Sysmon EventID 12
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_inprocserver32_modification_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_inprocserver32_modification_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. It may be required, dependent upon the EDR tool producing registry events, to remove (Default) from the command-line.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process identified on endpoint $dest$ modifying the registry with a known malicious clsid under InProcServer32.
     entity:
diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml
index 4a6386bcde0..471d2bf6f39 100644
--- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml
+++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies the execution of malicious PowerShell commands or payloads via the Windows SC.exe utility. It detects this activity by analyzing Windows System logs (EventCode 7045) and filtering for specific PowerShell-related patterns in the ImagePath field. This behavior is significant because it indicates potential abuse of the Windows Service Control Manager to run unauthorized or harmful scripts, which could lead to system compromise. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
 data_source:
     - Windows Event Log System 7045
-search: |-
+search: |
     `wineventlog_system`
     EventCode=7045
     | eval l_ImagePath=lower(ImagePath)
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Identifies the abuse the Windows SC.exe to execute malicious powerShell as a service $ImagePath$ by $user$ on $dest$
     entity:
diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml
index 744d2ba42f5..560ca45b191 100644
--- a/detections/endpoint/malicious_powershell_process___encoded_command.yml
+++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml
@@ -6,41 +6,25 @@ modification_date: '2026-10-09'
 author: David Dorsey, Michael Haag, Splunk, SirDuckly, GitHub Community
 status: production
 type: Hunting
-description: |
-    The following analytic detects the use of the EncodedCommand parameter in PowerShell processes.
+description: 'The following analytic detects the use of the EncodedCommand parameter in PowerShell processes.
+
     It leverages Endpoint Detection and Response (EDR) data to identify variations of the EncodedCommand parameter, including shortened forms and different command switch types.
+
     This activity can be significant because adversaries often use encoded commands to obfuscate malicious scripts, making detection harder.
+
     If confirmed malicious, this behavior could allow attackers to execute hidden code, potentially leading to unauthorized access, privilege escalation, or persistent threats within the environment.
-    Review parallel events to determine legitimacy and tune based on known administrative scripts.
+
+    Review parallel events to determine legitimacy and tune based on known administrative scripts.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    from datamodel=Endpoint.Processes where
-    `process_powershell`
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | where match(process,"(?i)(?:^|\\s)(?:/(?!/)|--?|–{1,2}|—{1,2}|―{1,2})(?:ec|encodedcommand|encodedcomman|encodedcomma|encodedcomm|encodedcom|encodedco|encodedc|encoded|encode|encod|enco|enc|en|e(?=\\s))\\s+['\\\"]?[A-Za-z0-9+/=]{5,}['\\\"]?")
-    | `malicious_powershell_process___encoded_command_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    False positives are expected from legitimate PowerShell scripts,
-    system administrators, and applications. Filter as needed.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___encoded_command_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: 'False positives are expected from legitimate PowerShell scripts,
+
+    system administrators, and applications. Filter as needed.'
 references:
     - https://regexr.com/662ov
     - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
index 2e86d5d3ab1..953f420f121 100644
--- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
+++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process_id) as process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_powershell` (Processes.process="* -ex*"
-        AND
-        Processes.process="* bypass *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `malicious_powershell_process___execution_policy_bypass_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") Processes.process="* -ex*" Processes.process="* bypass *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: There may be legitimate reasons to bypass the PowerShell execution policy. The PowerShell script being run with this parameter should be validated to ensure that it is legitimate.
 references:
@@ -39,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
index 14b7b357184..bd87386d91d 100644
--- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
+++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects PowerShell processes launched with command-line arguments indicative of obfuscation techniques. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and complete command-line executions. This activity is significant because obfuscated PowerShell commands are often used by attackers to evade detection and execute malicious scripts. If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, or persistent access within the environment, posing a significant security risk.
 data_source:
     - Sysmon EventID 1
-search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process,"`"))-1) + (mvcount(split(process, "^"))-1) + (mvcount(split(process, "''"))-1) | search num_obfuscation > 10 | `malicious_powershell_process_with_obfuscation_techniques_filter`'
+search: |
+    `sysmon` EventCode=1 Image IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR OriginalFileName IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") num_obfuscation>10 | eval src_user=src_user | stats count min(_time) as firstTime max(_time) as lastTime by action dest original_file_name parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process process_exec process_guid process_hash process_id process_integrity_level process_name process_path user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process_with_obfuscation_techniques_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: These characters might be legitimately on the command-line, but it is not common.
 references: []
@@ -21,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Powershell.exe running with potential obfuscated arguments on $dest$
     entity:
diff --git a/detections/endpoint/microsoft_defender_atp_alerts.yml b/detections/endpoint/microsoft_defender_atp_alerts.yml
index cf0ca1eebe2..a0b83b2e00b 100644
--- a/detections/endpoint/microsoft_defender_atp_alerts.yml
+++ b/detections/endpoint/microsoft_defender_atp_alerts.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic is to leverage alerts from Microsoft Defender ATP Alerts. This query aggregates and summarizes all alerts from Microsoft Defender ATP Alerts, providing details such as the source, file name, severity, process command line, ip address, registry key, signature, description, unique id, and timestamps. This detection is not intended to detect new activity from raw data, but leverages Microsoft provided alerts to be correlated with other data as part of risk based alerting. The data contained in the alert is mapped not only to the risk object, but also the threat object. This detection filters out evidence that has a verdict of clean from Microsoft. It dynamically maps the MITRE technique at search time to auto populate the annotation field with the value provided in the alert. It also uses a dynamic mapping to set the risk score in Enterprise Security based on the severity of the alert.
 data_source:
     - MS Defender ATP Alerts
-search: "`ms_defender_atp_alerts` (dest=* OR user=*)\n  | eval tmp_evidence=json_extract(_raw, \"evidence\"), tmp_evidencemv=json_array_to_mv(tmp_evidence), entityType = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"entityType\")), filePath = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"filePath\")), processCommandLine = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"processCommandLine\")), ipAddress = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"ipAddress\")), registryKey = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"registryKey\")), url = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"url\")), fileName = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"fileName\"))\n  | eval tmp_evidencemv=mvfilter(json_extract(tmp_evidencemv, \"entityType\") = \"File\"), fileName = mvmap(tmp_evidencemv, spath(tmp_evidencemv, \"fileName\"))\n  | eval risk_score=case(severity=\"informational\", 5, severity=\"low\", 15, severity=\"medium\", 25, severity=\"high\", 50 , true(), 2)\n  | eval processCommandLine=if(processCommandLine=\"null\", \"\", processCommandLine), ipAddress=if(ipAddress=\"null\", \"\", ipAddress), registryKey=if(registryKey=\"null\", \"\", registryKey), url=if(url=\"null\", \"\", url)\n  | stats count min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) as user values(risk_score) as risk_score\n    BY id description src\n  | `security_content_ctime(firstTime)`\n  | `security_content_ctime(lastTime)`\n  | `microsoft_defender_atp_alerts_filter`"
+search: |
+    `ms_defender_atp_alerts` dest="*" OR user="*" | eval severity=severity, src=src, signature=signature | stats count min(_time) as firstTime max(_time) as lastTime by dest user file_name ip_address process registry_key url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `microsoft_defender_atp_alerts_filter`
 how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsoft Security. This add-on will collect alerts using the ms:defender:atp:alerts sourcetype. You will need to define the `ms_defender_atp_alerts` macro to point to the proper index that contains the ms:defender:atp:alerts sourcetype.
 known_false_positives: False positives may vary based on Microsfot Defender configuration; monitor and filter out the alerts that are not relevant to your environment.
 references:
diff --git a/detections/endpoint/microsoft_defender_incident_alerts.yml b/detections/endpoint/microsoft_defender_incident_alerts.yml
index 1212253ab9f..4d4e7541d04 100644
--- a/detections/endpoint/microsoft_defender_incident_alerts.yml
+++ b/detections/endpoint/microsoft_defender_incident_alerts.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic is to leverage alerts from Microsoft Defender O365 Incidents. This query aggregates and summarizes all alerts from Microsoft Defender O365 Incidents, providing details such as the destination, file name, severity, process command line, ip address, registry key, signature, description, unique id, and timestamps. This detection is not intended to detect new activity from raw data, but leverages Microsoft provided alerts to be correlated with other data as part of risk based alerting. The data contained in the alert is mapped not only to the risk object, but also the threat object. This detection filters out evidence that has a verdict of clean from Microsoft. It dynamically maps the MITRE technique at search time to auto populate the annotation field with the value provided in the alert. It also uses a static mapping to set the risk score based on the severity of the alert.
 data_source:
     - MS365 Defender Incident Alerts
-search: "`ms365_defender_incident_alerts`  (dest=* OR user=*)\n  | eval tmp_entities=json_extract(_raw, \"entities\"), tmp_entitymv=json_array_to_mv(tmp_entities), tmp_filtered_mv=mvfilter(json_extract(tmp_entitymv, \"verdict\") != \"Clean\"), entityType = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, \"entityType\")), filePath = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, \"filePath\")), processCommandLine = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, \"processCommandLine\")), ipAddress = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, \"ipAddress\")), registryKey = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, \"registryKey\")), url = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, \"url\"))\n  | eval tmp_filtered_mv=mvfilter(json_extract(tmp_filtered_mv, \"entityType\") = \"File\"), fileName = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, \"fileName\"))\n  | eval risk_score=case(severity=\"informational\", 5, severity=\"low\", 15, severity=\"medium\", 25, severity=\"high\", 50, true(), 2)\n  | stats count  min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(dest) as dest values(user) as user values(risk_score) as risk_score\n    BY id description\n  | `security_content_ctime(firstTime)`\n  | `security_content_ctime(lastTime)`\n  | `microsoft_defender_incident_alerts_filter`"
+search: |
+    `ms365_defender_incident_alerts` dest="*" OR user="*" | eval severity=severity, signature=signature | stats count min(_time) as firstTime max(_time) as lastTime by dest user file_name ip_address process registry_key url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `microsoft_defender_incident_alerts_filter`
 how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsoft Security. This add-on will collect alerts using the ms365:defender:incident:alerts sourcetype. You will need to define the `ms365_defender_incident_alerts` macro to point to the proper index that contains the ms365:defender:incident:alerts sourcetype.
 known_false_positives: False positives may vary based on Microsoft Defender configuration; monitor and filter out the alerts that are not relevant to your environment.
 references:
diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
index 2df903a199a..55f1ea7e450 100644
--- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
+++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process = "*sekurlsa::tickets /export*"
-            OR
-            Processes.process = "*kerberos::ptt*"
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `mimikatz_passtheticket_commandline_parameters_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*sekurlsa::tickets /export*", "*kerberos::ptt*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mimikatz_passtheticket_commandline_parameters_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although highly unlikely, legitimate applications may use the same command line parameters as Mimikatz.
 references:
@@ -42,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Mimikatz command line parameters for pass the ticket attacks were used on $dest$
     entity:
diff --git a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml
index 55b0d3e00c0..4940795ecc8 100644
--- a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml
@@ -12,28 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-    where (Processes.parent_process_name=mmc.exe) (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe",
-    "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe",
-    "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe",
-    "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe",
-    "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe",
-    "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe",
-    "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe",
-    "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe",
-    "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe",
-    "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe",
-    "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe"))
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
-    Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
-    Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
-    Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
-    Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `mmc_lolbas_execution_process_spawn_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*mmc.exe" Processes.process_name IN ("*Regsvcs.exe", "*Ftp.exe", "*OfflineScannerShell.exe", "*Rasautou.exe", "*Schtasks.exe", "*Xwizard.exe", "*Dllhost.exe", "*Pnputil.exe", "*Atbroker.exe", "*Pcwrun.exe", "*Ttdinject.exe", "*Mshta.exe", "*Bitsadmin.exe", "*Certoc.exe", "*Ieexec.exe", "*Microsoft.Workflow.Compiler.exe", "*Runscripthelper.exe", "*Forfiles.exe", "*Msbuild.exe", "*Register-cimprovider.exe", "*Tttracer.exe", "*Ie4uinit.exe", "*Bash.exe", "*Hh.exe", "*SettingSyncHost.exe", "*Cmstp.exe", "*Mmc.exe", "*Stordiag.exe", "*Scriptrunner.exe", "*Odbcconf.exe", "*Extexport.exe", "*Msdt.exe", "*WorkFolders.exe", "*Diskshadow.exe", "*Mavinject.exe", "*Regasm.exe", "*Gpscript.exe", "*Rundll32.exe", "*Regsvr32.exe", "*Msiexec.exe", "*Wuauclt.exe", "*Presentationhost.exe", "*Wmic.exe", "*Runonce.exe", "*Syncappvpublishingserver.exe", "*Verclsid.exe", "*Infdefaultinstall.exe", "*Explorer.exe", "*Installutil.exe", "*Netsh.exe", "*Wab.exe", "*Dnscmd.exe", "*At.exe", "*Pcalua.exe", "*Msconfig.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mmc_lolbas_execution_process_spawn_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate applications may trigger this behavior, filter as needed.
 references:
@@ -48,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Mmc.exe spawned a LOLBAS process on $dest$.
     entity:
diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml
index 2e16311d732..6f19f78fc64 100644
--- a/detections/endpoint/modification_of_wallpaper.yml
+++ b/detections/endpoint/modification_of_wallpaper.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the modification of registry keys related to the desktop wallpaper settings. It leverages Sysmon EventCode 13 to identify changes to the "Control Panel\\Desktop\\Wallpaper" and "Control Panel\\Desktop\\WallpaperStyle" registry keys, especially when the modifying process is not explorer.exe or involves suspicious file paths like temp or public directories. This activity is significant as it can indicate ransomware behavior, such as the REVIL ransomware, which changes the wallpaper to display a ransom note. If confirmed malicious, this could signify a compromised machine and the presence of ransomware, leading to potential data encryption and extortion.
 data_source:
     - Sysmon EventID 13
-search: '`sysmon` EventCode =13  (TargetObject IN ("*\\Control Panel\\Desktop\\Wallpaper","*\\Control Panel\\Desktop\\WallpaperStyle") AND Image != "*\\explorer.exe") OR (TargetObject IN ("*\\Control Panel\\Desktop\\Wallpaper","*\\Control Panel\\Desktop\\WallpaperStyle") AND Details IN ("*\\temp\\*", "*\\users\\public\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by action dest process_guid process_id registry_hive registry_path registry_key_name registry_value_data registry_value_name status user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modification_of_wallpaper_filter`'
+search: |
+    `sysmon` EventCode=13 (TargetObject IN ("*\\Control Panel\\Desktop\\Wallpaper", "*\\Control Panel\\Desktop\\WallpaperStyle") NOT Image="*\\explorer.exe") OR (TargetObject IN ("*\\Control Panel\\Desktop\\Wallpaper", "*\\Control Panel\\Desktop\\WallpaperStyle") Details IN ("*\\temp\\*", "*\\users\\public\\*")) | eval registry_value_name=registry_value_name, registry_value_data_len=registry_value_data_len, object_handle=registry_value_data | stats count min(_time) as firstTime max(_time) as lastTime by action dest process_guid process_id registry_hive registry_path registry_key_name registry_value_data registry_value_name status user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modification_of_wallpaper_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: 3rd party tool may used to changed the wallpaper of the machine
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Wallpaper modification on $dest$
     entity:
diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml
index aededa63a96..eba6f1ff8fb 100644
--- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml
+++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml
@@ -12,34 +12,24 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count
-      min(_time) as firstTime
-      max(_time) as lastTime
-      values(Processes.process) as process
-      values(Processes.process_id) as process_id
-    from datamodel=Endpoint.Processes where
-      Processes.process_name IN ("icacls.exe", "cacls.exe", "xcacls.exe")
-      Processes.process IN ("*/grant*", "*/g:*", "*/g *")
-      Processes.process IN ("* SYSTEM:*", "* S-1-1-0:*")
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `modify_acl_permission_to_files_or_folder_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*icacls.exe", "*cacls.exe", "*xcacls.exe") Processes.process IN ("*/grant*", "*/g:*", "*/g *") Processes.process IN ("* SYSTEM:*", "* S-1-1-0:*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modify_acl_permission_to_files_or_folder_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
+
+    names and speed up the data modeling process.'
 known_false_positives: administrators may use this command. Filter as needed.
 references:
     - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -51,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml
index 59f00a04fa0..f9a2ef6e407 100644
--- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml
+++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. It leverages data from the Endpoint.Registry data model, focusing on events where the registry path is modified. This activity is significant because attackers can exploit this registry key to load arbitrary .dll files, which will execute with elevated SYSTEM permissions and persist after a reboot. If confirmed malicious, this could allow attackers to maintain persistence, execute code with high privileges, and potentially compromise the entire system.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `monitor_registry_keys_for_print_monitors_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action="modified" Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `monitor_registry_keys_for_print_monitors_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: You will encounter noise from legitimate print-monitor registry entries.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: New print monitor added on $dest$
     entity:
diff --git a/detections/endpoint/moveit_certificate_store_access_failure.yml b/detections/endpoint/moveit_certificate_store_access_failure.yml
index 74a1f288cc7..5b8b16b8fe0 100644
--- a/detections/endpoint/moveit_certificate_store_access_failure.yml
+++ b/detections/endpoint/moveit_certificate_store_access_failure.yml
@@ -8,7 +8,7 @@ status: production
 type: Hunting
 description: This detection identifies potential exploitation attempts of the CVE-2024-5806 vulnerability in Progress MOVEit Transfer. It looks for log entries indicating failures to access the certificate store, which can occur when an attacker attempts to exploit the authentication bypass vulnerability. This behavior is a key indicator of attempts to impersonate valid users without proper credentials. While certificate store access failures can occur during normal operations, an unusual increase in such events, especially from unexpected sources, may indicate malicious activity.
 data_source: []
-search: |-
+search: |
     `moveit_sftp_logs` "IpWorksKeyService: Caught exception of type IPWorksSSHException: The certificate store could not be opened"
       | stats count
         BY source _raw
@@ -36,6 +36,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/moveit/SftpServer.log
-          sourcetype: sftp_server_logs
           source: sftp_server_logs
+          sourcetype: sftp_server_logs
       test_type: unit
diff --git a/detections/endpoint/moveit_empty_key_fingerprint_authentication_attempt.yml b/detections/endpoint/moveit_empty_key_fingerprint_authentication_attempt.yml
index 3da6d96f292..27efd3c5aef 100644
--- a/detections/endpoint/moveit_empty_key_fingerprint_authentication_attempt.yml
+++ b/detections/endpoint/moveit_empty_key_fingerprint_authentication_attempt.yml
@@ -8,7 +8,7 @@ status: production
 type: Hunting
 description: This detection identifies attempts to authenticate with an empty public key fingerprint in Progress MOVEit Transfer, which is a key indicator of potential exploitation of the CVE-2024-5806 vulnerability. Such attempts are characteristic of the authentication bypass technique used in this vulnerability, where attackers try to impersonate valid users without providing proper credentials. While occasional empty key fingerprint authentication attempts might occur due to misconfigurations, a sudden increase or attempts from unexpected sources could signify malicious activity. This analytic helps security teams identify and investigate potential exploitation attempts of the MOVEit Transfer authentication bypass vulnerability.
 data_source: []
-search: |-
+search: |
     `moveit_sftp_logs` "UserAuthRequestHandler: SftpPublicKeyAuthenticator: Attempted to authenticate empty public key fingerprint"
       | stats count
         BY source _raw
@@ -37,6 +37,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/moveit/SftpServer.log
-          sourcetype: sftp_server_logs
           source: sftp_server_logs
+          sourcetype: sftp_server_logs
       test_type: unit
diff --git a/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml b/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml
index 44384314a47..beaec89084e 100644
--- a/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml
+++ b/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies the creation of suspicious .aspx files in specific directories associated with Exchange exploitation by the HAFNIUM group and the ProxyShell vulnerability. It detects this activity by monitoring the MSExchangeMailboxReplication.exe process, which typically does not write .aspx files. This behavior is significant as it may indicate an active exploitation attempt on Exchange servers. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, or maintain persistence within the environment. Immediate investigation and remediation are crucial to prevent further compromise.
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=MSExchangeMailboxReplication.exe  by _time span=1h Processes.process_id Processes.process_name Processes.process_guid Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process process_guid] | dedup file_create_time | table dest file_create_time, file_name, file_path, process_name | `ms_exchange_mailbox_replication_service_writing_active_server_pages_filter`'
+search: |
+    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=MSExchangeMailboxReplication.exe  by _time span=1h Processes.process_id Processes.process_name Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process process_guid] | dedup file_create_time | table dest file_create_time, file_name, file_path, process_name | `ms_exchange_mailbox_replication_service_writing_active_server_pages_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.
 known_false_positives: The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
 references:
diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml
index 16a196f9c87..e6bbeedc043 100644
--- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml
+++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of MS scripting processes (wscript.exe or cscript.exe) loading LDAP-related modules (Wldap32.dll, adsldp.dll, adsldpc.dll). It leverages Sysmon EventCode 7 to identify these specific DLL loads. This activity is significant as it may indicate an attempt to query LDAP for host information, a behavior observed in FIN7 implants. If confirmed malicious, this could allow attackers to gather detailed Active Directory information, potentially leading to further exploitation or data exfiltration.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_ldap_module_filter`'
+search: |
+    `sysmon` EventCode=7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_ldap_module_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 known_false_positives: automation scripting language may used by network operator to do ldap query.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml
index babf14e1ad6..f4bc1719384 100644
--- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml
+++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the loading of WMI modules by Microsoft scripting processes like wscript.exe or cscript.exe. It leverages Sysmon EventCode 7 to identify instances where these scripting engines load specific WMI-related DLLs. This activity is significant because it can indicate the presence of malware, such as the FIN7 implant, which uses JavaScript to execute WMI queries for gathering host information to send to a C2 server. If confirmed malicious, this behavior could allow attackers to collect sensitive system information and maintain persistence within the environment.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , "*\\wmiutils.dll", "*\\wbemcomn.dll") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_wmi_module_filter`'
+search: |
+    `sysmon` EventCode=7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll", "*\\wmiutils.dll", "*\\wbemcomn.dll") | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_wmi_module_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 known_false_positives: automation scripting language may used by network operator to do ldap query.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml
index 9f44f7917c8..a2cc76843f2 100644
--- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml
+++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name IN ("wscript.exe", "cscript.exe")
-        AND
-        `process_msbuild`
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `msbuild_suspicious_spawned_by_script_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*wscript.exe", "*cscript.exe") Processes.process_name="*msbuild.exe" OR Processes.original_file_name="MSBuild.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msbuild_suspicious_spawned_by_script_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited as developers do not spawn MSBuild via a WSH.
 references:
@@ -39,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed by $user$
     entity:
diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
index c3d2e7c3b06..c7d47787417 100644
--- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
+++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name = "mshta.exe"  `process_rundll32`
-        OR
-        `process_regsvr32`
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `mshta_spawning_rundll32_or_regsvr32_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.parent_process_name="*mshta.exe" Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE") OR Processes.process_name="*regsvr32.exe" OR Processes.original_file_name="REGSVR32.EXE" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshta_spawning_rundll32_or_regsvr32_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: limitted. this anomaly behavior is not commonly seen in clean host.
 references:
@@ -39,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$
     entity:
diff --git a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml
index c8cd0bfc550..918f3129933 100644
--- a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml
+++ b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects the loading of `msi.dll` by a binary not located in `system32`, `syswow64`, `winsxs`, or `windows` directories. This is identified using Sysmon EventCode 7, which logs DLL loads, and filters out legitimate system paths. This activity is significant as it may indicate exploitation of CVE-2021-41379 or DLL side-loading attacks, both of which can lead to unauthorized system modifications. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or persist within the environment.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7 ImageLoaded="*\\msi.dll" NOT (Image IN ("*\\System32\\*","*\\syswow64\\*","*\\windows\\*", "*\\winsxs\\*")) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msi_module_loaded_by_non_system_binary_filter`'
+search: |
+    `sysmon` EventCode=7 ImageLoaded="*\\msi.dll" NOT (Image IN ("*\\System32\\*", "*\\syswow64\\*", "*\\windows\\*", "*\\winsxs\\*")) | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msi_module_loaded_by_non_system_binary_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: It is possible some Administrative utilities will load msi.dll outside of normal system paths, filter as needed.
 references:
diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml
index 6957aa4da6f..91dbb5eb943 100644
--- a/detections/endpoint/msmpeng_application_dll_side_loading.yml
+++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the suspicious creation of msmpeng.exe or mpsvc.dll in non-default Windows Defender folders. It leverages the Endpoint.Filesystem datamodel to identify instances where these files are created outside their expected directories. This activity is significant because it is associated with the REvil ransomware, which uses DLL side-loading to execute malicious payloads. If confirmed malicious, this could lead to ransomware deployment, resulting in data encryption, system compromise, and potential data loss or extortion.
 data_source:
     - Sysmon EventID 11
-search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll")  AND NOT (Filesystem.file_path IN ("*\\Program Files\\windows defender\\*","*\\WinSxS\\*defender-service*","*\\WinSxS\\Temp\\*defender-service*")) by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*msmpeng.exe", "*mpsvc.dll") NOT (Filesystem.file_path IN ("*\\Program Files\\windows defender\\*", "*\\WinSxS\*defender-service*", "*\\WinSxS\\Temp\*defender-service*")) by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 known_false_positives: quite minimal false positive expected.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder on host - $dest$
     entity:
diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml
index 77e315381c4..4dc7b86cce9 100644
--- a/detections/endpoint/net_profiler_uac_bypass.yml
+++ b/detections/endpoint/net_profiler_uac_bypass.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the registry aimed at bypassing the User Account Control (UAC) feature in Windows. It identifies changes to the .NET COR_PROFILER_PATH registry key, which can be exploited to load a malicious DLL via mmc.exe. This detection leverages data from the Endpoint.Registry datamodel, focusing on specific registry paths and values. Monitoring this activity is crucial as it can indicate an attempt to escalate privileges or persist within the environment. If confirmed malicious, this could allow an attacker to execute arbitrary code with elevated privileges, compromising system integrity.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH" Registry.registry_value_data = "*.dll" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `net_profiler_uac_bypass_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Environment\\COR_PROFILER_PATH" Registry.registry_value_data="*.dll" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `net_profiler_uac_bypass_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: limited false positive. It may trigger by some windows update that will modify this registry.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious modification of registry $registry_path$ with possible payload path $registry_path$ and key $registry_key_name$ on $dest$
     entity:
diff --git a/detections/endpoint/network_connection_discovery_with_arp.yml b/detections/endpoint/network_connection_discovery_with_arp.yml
index f1074df0d86..a5c59e11821 100644
--- a/detections/endpoint/network_connection_discovery_with_arp.yml
+++ b/detections/endpoint/network_connection_discovery_with_arp.yml
@@ -6,42 +6,13 @@ modification_date: '2026-08-30'
 author: Mauricio Velazco, Splunk
 status: production
 type: Hunting
-description: |-
-    The following analytic detects the execution of `arp.exe` with the `-a` flag, which is used to list network connections on a compromised system. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line executions, and related telemetry. Monitoring this activity is significant because both Red Teams and adversaries use `arp.exe` for situational awareness and Active Directory discovery. If confirmed malicious, this activity could allow attackers to map the network, identify active devices, and plan further lateral movement or attacks.
+description: The following analytic detects the execution of `arp.exe` with the `-a` flag, which is used to list network connections on a compromised system. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line executions, and related telemetry. Monitoring this activity is significant because both Red Teams and adversaries use `arp.exe` for situational awareness and Active Directory discovery. If confirmed malicious, this activity could allow attackers to map the network, identify active devices, and plan further lateral movement or attacks.
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    (
-        Processes.process_name="arp.exe"
-        OR
-        Processes.original_file_name="arp.exe"
-    )
-    Processes.process IN (
-        "* -a*",
-        "* -g *",
-        "* /a *",
-        "* /g *"
-    )
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `network_connection_discovery_with_arp_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*arp.exe" OR Processes.original_file_name="arp.exe" Processes.process IN ("* -a*", "* -g *", "* /a *", "* /g *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_connection_discovery_with_arp_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/network_connection_discovery_with_netstat.yml b/detections/endpoint/network_connection_discovery_with_netstat.yml
index 25877f0a57f..05e6cd228a3 100644
--- a/detections/endpoint/network_connection_discovery_with_netstat.yml
+++ b/detections/endpoint/network_connection_discovery_with_netstat.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="netstat.exe"
-        )
-        (Processes.process=*-a*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `network_connection_discovery_with_netstat_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*netstat.exe" Processes.process="*-a*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_connection_discovery_with_netstat_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml
index 77b8e2ae43c..62ea29ec077 100644
--- a/detections/endpoint/network_discovery_using_route_windows_app.yml
+++ b/detections/endpoint/network_discovery_using_route_windows_app.yml
@@ -12,18 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    (Processes.process_name=route.exe OR Processes.original_file_name=route.exe)
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `network_discovery_using_route_windows_app_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*route.exe" OR Processes.original_file_name="route.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_discovery_using_route_windows_app_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: A network operator or systems administrator may utilize an automated host discovery application that may generate false positives or an amazon ec2 script that uses this application. Filter as needed.
 references:
diff --git a/detections/endpoint/network_share_discovery_via_dir_command.yml b/detections/endpoint/network_share_discovery_via_dir_command.yml
index 6373999c085..d5d1fd378ba 100644
--- a/detections/endpoint/network_share_discovery_via_dir_command.yml
+++ b/detections/endpoint/network_share_discovery_via_dir_command.yml
@@ -6,13 +6,14 @@ modification_date: '2026-10-02'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
-description: |-
-    The following analytic detects access to Windows administrative SMB shares (Admin$, IPC$, C$) using the 'dir' command. It leverages Windows Security Event Logs with EventCode 5140 to identify this activity.
+description: 'The following analytic detects access to Windows administrative SMB shares (Admin$, IPC$, C$) using the ''dir'' command. It leverages Windows Security Event Logs with EventCode 5140 to identify this activity.
+
     This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed by adversaries for lateral movement and remote code execution.
-    If confirmed malicious, this activity could allow attackers to propagate malware, such as IcedID, across the network, leading to widespread infection and potential data breaches.
+
+    If confirmed malicious, this activity could allow attackers to propagate malware, such as IcedID, across the network, leading to widespread infection and potential data breaches.'
 data_source:
     - Windows Event Log Security 5140
-search: |-
+search: |
     `wineventlog_security`
     EventCode=5140
     ShareName IN (
@@ -42,11 +43,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `network_share_discovery_via_dir_command_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5140 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
-known_false_positives: |-
-    System Administrators may use tools like "net.exe", "net1.exe", or "dir" for troubleshooting or administrations tasks.
-    However, this will typically come only from certain users and certain systems that can be added to an allow list.
+how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5140 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
+known_false_positives: 'System Administrators may use tools like "net.exe", "net1.exe", or "dir" for troubleshooting or administrations tasks.
+
+    However, this will typically come only from certain users and certain systems that can be added to an allow list.'
 references:
     - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
     - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140#table-of-file-access-codes
diff --git a/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml b/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml
index 8b951a8993b..e9bfd856f46 100644
--- a/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml
+++ b/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic identifies network traffic directed to the Active Directory Web Services Protocol (ADWS) on port 9389. It leverages network traffic logs, focusing on source and destination IP addresses, application names, and destination ports. This activity is significant as ADWS is used to manage Active Directory, and unauthorized access could indicate malicious intent. If confirmed malicious, an attacker could manipulate Active Directory, potentially leading to privilege escalation, unauthorized access, or persistent control over the environment.
 data_source:
     - Sysmon EventID 3
-search: |-
+search: |
     | tstats count FROM datamodel=Network_Traffic
       WHERE All_Traffic.dest_port=9389
       BY All_Traffic.action All_Traffic.app All_Traffic.dest
diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml
index d529e9460af..575b0e08ab1 100644
--- a/detections/endpoint/nishang_powershelltcponeline.yml
+++ b/detections/endpoint/nishang_powershelltcponeline.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_powershell` (Processes.process=*Net.Sockets.TCPClient*
-        AND
-        Processes.process=*System.Text.ASCIIEncoding*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `nishang_powershelltcponeline_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") Processes.process="*Net.Sockets.TCPClient*" Processes.process="*System.Text.ASCIIEncoding*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nishang_powershelltcponeline_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives may be present. Filter as needed based on initial analysis.
 references:
@@ -42,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$
     entity:
diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml
index 6424ba14476..74e1fc25b53 100644
--- a/detections/endpoint/nltest_domain_trust_discovery.yml
+++ b/detections/endpoint/nltest_domain_trust_discovery.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=nltest.exe
-            OR
-            Processes.original_file_name=nltestrk.exe
-        )
-        (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `nltest_domain_trust_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*nltest.exe" OR Processes.original_file_name="nltestrk.exe" Processes.process IN ("*/domain_trusts*", "*/all_trusts*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nltest_domain_trust_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may use nltest for troubleshooting purposes, otherwise, rarely used.
 references:
@@ -49,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Domain trust discovery execution on $dest$
     entity:
diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
index 7c4d31481cc..1ebd62e1fdf 100644
--- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
+++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects a non-Chrome process accessing files in the Chrome user default folder. It leverages Windows Security Event logs, specifically event code 4663, to identify unauthorized access attempts. This activity is significant because the Chrome default folder contains sensitive user data such as login credentials, browsing history, and cookies. If confirmed malicious, this behavior could indicate an attempt to exfiltrate sensitive information, often associated with RATs, trojans, and advanced persistent threats like FIN7. Such access could lead to data theft and further compromise of the affected system.
 data_source:
     - Windows Event Log Security 4663
-search: '`wineventlog_security` EventCode=4663 NOT (ProcessName IN ("*\\chrome.exe", "*\\explorer.exe", "*sql*", "*\\dllhost.exe")) ObjectName="*\\Google\\Chrome\\User Data\\Default*" | stats count min(_time) as firstTime max(_time) as lastTime by ObjectName ObjectType ProcessName AccessMask EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `non_chrome_process_accessing_chrome_default_dir_filter`'
+search: |
+    `wineventlog_security` EventCode=4663 NOT (ProcessName IN ("*\\chrome.exe", "*\\explorer.exe", "*sql", "*\\dllhost.exe")) ObjectName="*\\Google\\Chrome\\User Data\\Default*" | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `non_chrome_process_accessing_chrome_default_dir_filter`
 how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
 known_false_positives: other browser not listed related to chrome may catch by this rule.
 references: []
@@ -21,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
index 87b1884b1ca..40433b6bb0d 100644
--- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
+++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects non-Firefox processes accessing the Firefox profile directory, which contains sensitive user data such as login credentials, browsing history, and cookies. It leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts. This activity is significant because it may indicate attempts by malware, such as RATs or trojans, to harvest user information. If confirmed malicious, this behavior could lead to data exfiltration, unauthorized access to user accounts, and further compromise of the affected system.
 data_source:
     - Windows Event Log Security 4663
-search: '`wineventlog_security` EventCode=4663 NOT (ProcessName IN ("*\\firefox.exe", "*\\explorer.exe", "*sql*")) ObjectName="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*" | stats count min(_time) as firstTime max(_time) as lastTime by ObjectName ObjectType ProcessName AccessMask EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `non_firefox_process_access_firefox_profile_dir_filter`'
+search: |
+    `wineventlog_security` EventCode=4663 NOT (ProcessName IN ("*\\firefox.exe", "*\\explorer.exe", "*sql")) ObjectName="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*" | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `non_firefox_process_access_firefox_profile_dir_filter`
 how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
 known_false_positives: other browser not listed related to firefox may catch by this rule.
 references: []
@@ -21,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/notepad_with_no_command_line_arguments.yml b/detections/endpoint/notepad_with_no_command_line_arguments.yml
index 50c1b2df02e..fb2b520fde6 100644
--- a/detections/endpoint/notepad_with_no_command_line_arguments.yml
+++ b/detections/endpoint/notepad_with_no_command_line_arguments.yml
@@ -11,7 +11,7 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
       WHERE Processes.process_name=notepad.exe
         AND
@@ -41,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ with no command line arguments.
     entity:
diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml
index 7ebf6578f52..375704e9300 100644
--- a/detections/endpoint/ntdsutil_export_ntds.yml
+++ b/detections/endpoint/ntdsutil_export_ntds.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=ntdsutil.exe Processes.process=*ntds* Processes.process=*create*
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `ntdsutil_export_ntds_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*ntdsutil.exe" Processes.process="*ntds*" Processes.process="*create*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ntdsutil_export_ntds_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Highly possible Server Administrators will troubleshoot with ntdsutil.exe, generating false positives.
 references:
@@ -44,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Active Directory NTDS export on $dest$
     entity:
diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
index 4a7df33c442..4ec1e22d5c0 100644
--- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
+++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
@@ -6,14 +6,16 @@ modification_date: '2026-05-13'
 author: Mauricio Velazco, Lou Stella, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects outbound network connections from Java processes to default ports used by LDAP and RMI protocols, which may indicate exploitation of the CVE-2021-44228-Log4j vulnerability.
+description: 'The following analytic detects outbound network connections from Java processes to default ports used by LDAP and RMI protocols, which may indicate exploitation of the CVE-2021-44228-Log4j vulnerability.
+
     This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and network traffic logs.
-    Monitoring this activity is crucial as it can signify an attacker's attempt to perform JNDI lookups and retrieve malicious payloads.
-    If confirmed malicious, this activity could lead to remote code execution and further compromise of the affected server.
+
+    Monitoring this activity is crucial as it can signify an attacker''s attempt to perform JNDI lookups and retrieve malicious payloads.
+
+    If confirmed malicious, this activity could lead to remote code execution and further compromise of the affected server.'
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 3
-search: |-
+search: |
     | tstats `security_content_summariesonly` count
     FROM datamodel=Endpoint.Processes WHERE
 
@@ -58,10 +60,8 @@ search: |-
             process_path process_name process process_hash
             connection_to_CNC dest_port user
     | `outbound_network_connection_from_java_using_default_ports_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    Legitimate Java applications may use perform outbound connections to these ports. Filter as needed
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate Java applications may use perform outbound connections to these ports. Filter as needed
 references:
     - https://www.lunasec.io/docs/blog/log4j-zero-day/
     - https://www.govcert.admin.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
@@ -73,7 +73,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Java performed outbound connections to default ports of LDAP or RMI on $dest$
     entity:
diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml
index 1cc5ecc0aa7..1ed997ac881 100644
--- a/detections/endpoint/overwriting_accessibility_binaries.yml
+++ b/detections/endpoint/overwriting_accessibility_binaries.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to Windows accessibility binaries such as sethc.exe, utilman.exe, osk.exe, Magnify.exe, Narrator.exe, DisplaySwitch.exe, and AtBroker.exe. It leverages filesystem activity data from the Endpoint.Filesystem data model to identify changes to these specific files. This activity is significant because adversaries can exploit these binaries to gain unauthorized access or execute commands without logging in. If confirmed malicious, this could allow attackers to bypass authentication mechanisms, potentially leading to unauthorized system access and further compromise of the environment.
 data_source:
     - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem where (Filesystem.file_path=*\\Windows\\System32\\sethc.exe* OR Filesystem.file_path=*\\Windows\\System32\\utilman.exe* OR Filesystem.file_path=*\\Windows\\System32\\osk.exe* OR Filesystem.file_path=*\\Windows\\System32\\Magnify.exe* OR Filesystem.file_path=*\\Windows\\System32\\Narrator.exe* OR Filesystem.file_path=*\\Windows\\System32\\DisplaySwitch.exe* OR Filesystem.file_path=*\\Windows\\System32\\AtBroker.exe*) by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `overwriting_accessibility_binaries_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\system32\\*" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `overwriting_accessibility_binaries_filter`
 how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
 known_false_positives: Microsoft may provide updates to these binaries. Verify that these changes do not correspond with your normal software update cycle.
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A suspicious file modification or replace in $file_path$  in host $dest$
     entity:
diff --git a/detections/endpoint/papercut_ng_suspicious_behavior_debug_log.yml b/detections/endpoint/papercut_ng_suspicious_behavior_debug_log.yml
index a4bd0f31166..e46c24bd782 100644
--- a/detections/endpoint/papercut_ng_suspicious_behavior_debug_log.yml
+++ b/detections/endpoint/papercut_ng_suspicious_behavior_debug_log.yml
@@ -8,7 +8,7 @@ status: production
 type: Hunting
 description: The following analytic identifies potential exploitation attempts on a PaperCut NG server by analyzing its debug log data. It detects unauthorized or suspicious access attempts from public IP addresses and searches for specific URIs associated with known exploits. The detection leverages regex to parse unstructured log data, focusing on admin login activities. This activity is significant as it can indicate an active exploitation attempt on the server. If confirmed malicious, attackers could gain unauthorized access, potentially leading to data breaches or further compromise of the server.
 data_source: []
-search: |-
+search: |
     `papercutng`
     (loginType=Admin OR userName=admin)
 
diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml
index f65e5944748..d1f635817a1 100644
--- a/detections/endpoint/permission_modification_using_takeown_app.yml
+++ b/detections/endpoint/permission_modification_using_takeown_app.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "takeown.exe" Processes.process = "*/f*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `permission_modification_using_takeown_app_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*takeown.exe" Processes.process="*/f*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `permission_modification_using_takeown_app_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: takeown.exe is a normal windows application that may used by network operator.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/petitpotam_network_share_access_request.yml b/detections/endpoint/petitpotam_network_share_access_request.yml
index 5fde7c21f00..d934d483143 100644
--- a/detections/endpoint/petitpotam_network_share_access_request.yml
+++ b/detections/endpoint/petitpotam_network_share_access_request.yml
@@ -9,14 +9,8 @@ type: TTP
 description: The following analytic detects network share access requests indicative of the PetitPotam attack (CVE-2021-36942). It leverages Windows Event Code 5145, which logs attempts to access network share objects. This detection is significant as PetitPotam can coerce authentication from domain controllers, potentially leading to unauthorized access. If confirmed malicious, this activity could allow attackers to escalate privileges or move laterally within the network, posing a severe security risk. Ensure Event Code 5145 is enabled via Group Policy to utilize this analytic effectively.
 data_source:
     - Windows Event Log Security 5145
-search: |-
-    `wineventlog_security` SubjectUserName="ANONYMOUS LOGON" EventCode=5145 RelativeTargetName=lsarpc
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest, SubjectUserSid, ShareName,
-           src, AccessMask, AccessReason
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `petitpotam_network_share_access_request_filter`
+search: |
+    `wineventlog_security` EventCode=5145 SubjectUserName="ANONYMOUS LOGON" RelativeTargetName="lsarpc" | eval src_user=src_user, AccessMask=AccessMask | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `petitpotam_network_share_access_request_filter`
 how_to_implement: Windows Event Code 5145 is required to utilize this analytic and it may not be enabled in most environments.
 known_false_positives: False positives have been limited when the Anonymous Logon is used for Account Name.
 references:
@@ -31,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A remote host is enumerating a $dest$ to identify permissions. This is a precursor event to CVE-2021-36942, PetitPotam.
     entity:
diff --git a/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml b/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml
index 4fefb3ea75a..f15024514e6 100644
--- a/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml
+++ b/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml
@@ -9,24 +9,12 @@ type: TTP
 description: The following analytic detects a suspicious Kerberos Ticket Granting Ticket (TGT) request, identified by Event Code 4768. This detection leverages Windows Security Event Logs to identify TGT requests with unusual fields, which may indicate the use of tools like Rubeus following the exploitation of CVE-2021-36942 (PetitPotam). This activity is significant as it can signal an attacker leveraging a compromised certificate to request Kerberos tickets, potentially leading to unauthorized access. If confirmed malicious, this could allow attackers to escalate privileges and persist within the environment, posing a severe security risk.
 data_source:
     - Windows Event Log Security 4768
-search: |-
-    `wineventlog_security`
-    EventCode=4768
-    src!="::1"
-    TargetUserName=*$
-    CertThumbprint!=""
-    PreAuthType=2
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      BY dest TargetUserName PreAuthType CertThumbprint src action
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `petitpotam_suspicious_kerberos_tgt_request_filter`
-how_to_implement: |-
-    The following analytic requires Event Code 4768. Ensure that it is logging no Domain Controllers and appearing in Splunk.
-known_false_positives: |-
-    False positives are possible if the environment is using certificates for authentication, since PreAuthType 2 can appear on some initial or fallback authentication flows alongside a populated certificate field.
-    Tune further based on observed authentication patterns in the environment.
+search: |
+    `wineventlog_security` EventCode=4768 NOT src="::1" TargetUserName="*$" NOT CertThumbprint="" PreAuthType="2" | eval src_ip=src_ip | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `petitpotam_suspicious_kerberos_tgt_request_filter`
+how_to_implement: The following analytic requires Event Code 4768. Ensure that it is logging no Domain Controllers and appearing in Splunk.
+known_false_positives: 'False positives are possible if the environment is using certificates for authentication, since PreAuthType 2 can appear on some initial or fallback authentication flows alongside a populated certificate field.
+
+    Tune further based on observed authentication patterns in the environment.'
 references:
     - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4768
     - https://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Kerberos TGT was requested in a non-standard manner against $dest$, potentially related to CVE-2021-36942, PetitPotam.
     entity:
diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml
index 2283e1a9af9..2d1fed51589 100644
--- a/detections/endpoint/ping_sleep_batch_command.yml
+++ b/detections/endpoint/ping_sleep_batch_command.yml
@@ -6,79 +6,33 @@ modification_date: '2026-10-09'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies the use of ping commands as a delay or sleep mechanism within batch-style command execution.
+description: 'The following analytic identifies the use of ping commands as a delay or sleep mechanism within batch-style command execution.
+
     It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and examines process and parent process command-line fields for ping commands that specify a count and are chained with additional commands using command separators or redirection operators.
+
     While execution of the command may generate individual process creation events, such as a separate ping.exe process, this analytic specifically focuses on the original command string passed to a command interpreter, such as cmd.exe /c, that combines the ping-based delay with subsequent command execution.
+
     Adversaries may use ping as an alternative to explicit sleep or timeout commands to introduce execution delays, potentially evading automated analysis, sandboxing, or behavior-based detection.
-    Because ping is commonly used for legitimate network troubleshooting, findings should be reviewed in the context of the complete command line, parent process, user, and commands executed before or after the delay.
+
+    Because ping is commonly used for legitimate network troubleshooting, findings should be reviewed in the context of the complete command line, parent process, user, and commands executed before or after the delay.'
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-    (
-        Processes.parent_process= "*ping*"
-        Processes.parent_process IN (
-            "*-n*",
-            "*/n*"
-        )
-        Processes.parent_process IN (
-            "*& *",
-            "*&amp;*",
-            "*&C:*",
-            "*&gt;*",
-            "*>*",
-            "*||*"
-        )
-    )
-    OR
-    (
-        (
-            Processes.process_name= "ping.exe"
-            OR
-            Processes.original_file_name= "ping.exe"
-        )
-        Processes.process IN (
-            "*-n*",
-            "*/n*"
-        )
-        Processes.process IN (
-            "*& *",
-            "*&amp;*",
-            "*&C:*",
-            "*&gt;*",
-            "*>*",
-            "*||*"
-        )
-    )
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.parent_process="*ping*" Processes.parent_process IN ("*-n*", "*/n*") Processes.parent_process IN ("*& *", "*&amp;*", "*&C:*", "*&gt;*", "*>*", "*||*")) OR (Processes.process_name="*ping.exe" OR Processes.original_file_name="ping.exe" Processes.process IN ("*-n*", "*/n*") Processes.process IN ("*& *", "*&amp;*", "*&C:*", "*&gt;*", "*>*", "*||*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ping_sleep_batch_command_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
 
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `ping_sleep_batch_command_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
     These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions.
+
     These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model.
-    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Administrators, network operators, scripts, and software installers may legitimately use ping commands as a simple delay mechanism between commands or operations.
+
+    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.'
+known_false_positives: 'Administrators, network operators, scripts, and software installers may legitimately use ping commands as a simple delay mechanism between commands or operations.
+
     Review the full command line, parent process, user context, and surrounding activity to determine whether the execution is expected.
-    Update the filter macro to exclude known legitimate command patterns or processes in your environment.
+
+    Update the filter macro to exclude known legitimate command patterns or processes in your environment.'
 references:
     - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 drilldown_searches:
@@ -89,7 +43,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
index 6b73129ed47..fded8d0d213 100644
--- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
+++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
@@ -6,14 +6,16 @@ modification_date: '2026-10-09'
 author: Mauricio Velazco, Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the spawning of a PowerShell process as a child or grandchild of commonly abused processes like services.exe, wmiprvse.exe, svchost.exe, wsmprovhost.exe, and mmc.exe.
+description: 'The following analytic detects the spawning of a PowerShell process as a child or grandchild of commonly abused processes like services.exe, wmiprvse.exe, svchost.exe, wsmprovhost.exe, and mmc.exe.
+
     It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process names, as well as command-line executions.
+
     This activity is significant as it could indicates lateral movement or remote code execution attempts by adversaries.
-    If confirmed malicious, this behavior could allow attackers to execute code remotely, escalate privileges, or persist within the environment.
+
+    If confirmed malicious, this behavior could allow attackers to execute code remotely, escalate privileges, or persist within the environment.'
 data_source:
     - Sysmon EventID 1
-search: |-
+search: |
     | tstats `security_content_summariesonly`
     count min(_time) as firstTime
           max(_time) as lastTime
@@ -65,10 +67,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `possible_lateral_movement_powershell_spawn_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    False positives are expected from legitimate use of WMI or certain services. Apply additoinal filters as needed.
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: False positives are expected from legitimate use of WMI or certain services. Apply additoinal filters as needed.
 references:
     - https://attack.mitre.org/techniques/T1021/003/
     - https://attack.mitre.org/techniques/T1021/006/
@@ -83,7 +83,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/potential_password_in_username.yml b/detections/endpoint/potential_password_in_username.yml
index 06649111165..80599710208 100644
--- a/detections/endpoint/potential_password_in_username.yml
+++ b/detections/endpoint/potential_password_in_username.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic identifies instances where users may have mistakenly entered their passwords in the username field during authentication attempts. It detects this by analyzing failed authentication events with usernames longer than 7 characters and high Shannon entropy, followed by a successful authentication from the same source to the same destination. This activity is significant as it can indicate potential security risks, such as password exposure. If confirmed malicious, attackers could exploit this to gain unauthorized access, leading to potential data breaches or further compromise of the system.
 data_source:
     - Linux Secure
-search: |-
+search: |
     | tstats `security_content_summariesonly` earliest(_time) AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype values(Authentication.src) AS src values(Authentication.dest) AS dest count FROM datamodel=Authentication
       WHERE nodename=Authentication.Failed_Authentication
       BY "Authentication.user"
diff --git a/detections/endpoint/potential_system_network_configuration_discovery_activity.yml b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml
index 26d4b2c4593..9f2f3e7b8c7 100644
--- a/detections/endpoint/potential_system_network_configuration_discovery_activity.yml
+++ b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml
@@ -62,7 +62,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/potential_telegram_api_request_via_commandline.yml b/detections/endpoint/potential_telegram_api_request_via_commandline.yml
index dfa19f02898..fb9db791385 100644
--- a/detections/endpoint/potential_telegram_api_request_via_commandline.yml
+++ b/detections/endpoint/potential_telegram_api_request_via_commandline.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process= "*api.telegram.org*" NOT Processes.process IN ("*-osint -url*", "* --single-argument*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `potential_telegram_api_request_via_commandline_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*api.telegram.org*" NOT (Processes.process IN ("*-osint -url*", "* --single-argument*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `potential_telegram_api_request_via_commandline_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positive may stem from application or users requesting the API directly via CommandLine for testing purposes. Investigate the matches and apply the necessary filters.
 references:
@@ -40,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml
index 006d345909f..c5ff034f962 100644
--- a/detections/endpoint/powershell_4104_hunting.yml
+++ b/detections/endpoint/powershell_4104_hunting.yml
@@ -6,118 +6,18 @@ modification_date: '2026-09-03'
 author: Michael Haag, Splunk
 status: production
 type: Hunting
-description: |-
-    The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence.
-    If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security.
+description: 'The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence.
+
+    If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization''s security.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventCode=4104
-
-    ScriptBlockText IN (
-        "*-dumpcr*", "* -version *", "*::decompress*",
-        "*Add-Exfiltration*", "*Add-Persistence*", "*Add-RegBackdoor*",
-        "*Add-ScrnSaveBackdoor*", "*AmsiBypass*", "*assemblybuilderaccess*", "*backdoor*",
-        "*backupprivilege*", "*beacon*", "*bitstransfer*", "*Brute-Force*", "*BruteForce*",
-        "*CachedRDPConnection*", "*Check-VM*", "*cnvert*", "*compress-archive*", "*ComputerProperty*",
-        "*comsvcs*", "*copy-vss*", "*CreateShortcut*", "*disablerealtimemonitoring*",
-        "*Do-Exfiltration*", "*downloadfile*", "*downloadstring*", "*Enabled-DuplicateToken*",
-        "*EXEonRemote*", "*exfiltration*", "*expand-archive*", "*Exploit-*", "*exploit*",
-        "*Find-*", "*Frombase64*", "*Get-ApplicationHost*", "*Get-ChromeDump*",
-        "*Get-ClipboardContents*", "*Get-*Credent*", "*Get-FoxDump*", "*Get-GPPPassword*", "*Get-IndexedItem*",
-        "*Get-Keystrokes*", "*Get-PassHash*", "*Get-*Password*", "*Get-RegAlwaysInstallElevated*", "*Get-RegAutoLogon*",
-        "*Get-RickAstley*", "*Get-Screenshot*", "*Get-SecurityPackages*", "*Get-ServiceFilePermission*",
-        "*Get-ServicePermission*", "*Get-ServiceUnquoted*", "*Get-SiteListPassword*",
-        "*Get-System*", "*Get-TimedScreenshot*", "*Get-UnattendedInstallFile*",
-        "*Get-Unconstrained*", "*Get-VaultCredential*", "*Get-VulnAutoRun*",
-        "*Get-VulnSchTask*", "*Gupt-Backdoor*", "*gzipstream*", "*hijack*",
-        "*HTTP-Login*", "*IEX *", "*injection*", "*Install-Service*",
-        "*Install-ServiceBinary*", "*Install-SSP*", "*internetexplorer.application*",
-        "*Invoke-*", "*io.compression*", "*kerberos::*", "*lastloggedon*",
-        "*localadmin*", "*LSASecret*", "*lsass.exe*", "*MailRaider*", "*metasp*",
-        "*mimikatz*", "*NEEEEWWW*", "*netfirewall*", "*NetworkRelay*",
-        "*New-HoneyHash*", "*ngrok*", "*nishang*", "*Out-Minidump*",
-        "*out-shortcut*", "*Port-Scan*", "*PortScan*", "*PowerBreach*",
-        "*PowerShellIcmp*", "*PowerShelludp*", "*powershellwmi*", "*PowerUp*", "*PowerView*",
-        "*rc4bytestream*", "*reflection.assembly*", "*remoteps*", "*remotewmi*",
-        "*Remove-Update*", "*SEKURLSA::*", "*Set-MacAttribute*", "*Set-Wallpaper*",
-        "*shell.application*", "*shellcode*", "*Show-TargetScreen*", "*Start-CaptureServer*",
-        "*start-process*", "*system.security.cryptography*", "*Uninstall-Windows*", "*UserProperty*",
-        "*VolumeShadowCopyTools*", "*WebClient*", "*webrequest*", "*wmicommand*",
-        "*wmimethod*", "*wmiobject*", "*write-zip*", "*xmlhttp*",
-    )
-
-    | eval script_lower=lower(ScriptBlockText)
-
-    | eval ecnoded_command_keyword=if(match(ScriptBlockText,"(?i)(?:^|\\s)(?:/(?!/)|--?|–{1,2}|—{1,2}|―{1,2})(?:ec|encodedcommand|encodedcomman|encodedcomma|encodedcomm|encodedcom|encodedco|encodedc|encoded|encode|encod|enco|enc|en|e(?=\\s))\\s+['\\\"]?[A-Za-z0-9+/=]{5,}['\\\"]?"), 4, 0)
-
-    | eval suspicious_cmdlets=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|netfirewall|Uninstall-Windows|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0)
-
-    | eval base64_keyword=if(like(script_lower,"%frombase64%"), 4, 0)
-
-    | eval empire=if(like(script_lower,"%system.net.webclient%") AND like(script_lower,"%frombase64%"),5,0)
-
-    | eval mimikatz=if(like(script_lower,"%mimikatz%") OR like(script_lower,"%-dumpcr%") OR like(script_lower,"%sekurlsa::pth%") OR like(script_lower,"%kerberos::ptt%") OR like(script_lower,"%kerberos::golden%"),5,0)
-
-    | eval invoke_expression_keyword=if(like(script_lower,"%iex %") OR like(script_lower,"%invoke-expression %"),2,0)
-
-    | eval webclient=if(like(script_lower,"%webclient%") OR like(script_lower,"%webrequest%") OR like(script_lower,"%downloadfile%") OR like(script_lower,"%downloadstring%") OR like(script_lower,"%bitstransfer%") OR like(script_lower,"%internetexplorer.application%") OR like(script_lower,"%xmlhttp%"),5,0)
-
-    | eval suspicious_keyword=if(match(script_lower, "(metasp|assemblybuilderaccess|reflection\.assembly|shellcode|injection|cnvert|shell\.application|start-process |rc4bytestream|system\.security\.cryptography|lsass\.exe|localadmin|lastloggedon|hijack|backupprivilege|ngrok|comsvcs|backdoor|brute.?force|port.?scan|exfiltration|exploit|disablerealtimemonitoring|beacon)"),1,0)
-
-    | eval invoke_wmi_keyword=if(like(script_lower,"%wmiobject%") OR like(script_lower,"%wmimethod%") OR like(script_lower,"%remotewmi%") OR like(script_lower,"%powershellwmi%") OR like(script_lower,"%wmicommand%"),5,0)
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*-dumpcr*", "* -version *", "*::decompress*", "*Add-Exfiltration*", "*Add-Persistence*", "*Add-RegBackdoor*", "*Add-ScrnSaveBackdoor*", "*AmsiBypass*", "*assemblybuilderaccess*", "*backdoor*", "*backupprivilege*", "*beacon*", "*bitstransfer*", "*Brute-Force*", "*BruteForce*", "*CachedRDPConnection*", "*Check-VM*", "*cnvert*", "*compress-archive*", "*ComputerProperty*", "*comsvcs*", "*copy-vss*", "*CreateShortcut*", "*disablerealtimemonitoring*", "*Do-Exfiltration*", "*downloadfile*", "*downloadstring*", "*Enabled-DuplicateToken*", "*EXEonRemote*", "*exfiltration*", "*expand-archive*", "*Exploit-*", "*exploit*", "*Find-*", "*Frombase64*", "*Get-ApplicationHost*", "*Get-ChromeDump*", "*Get-ClipboardContents*", "*Get-*Credent*", "*Get-FoxDump*", "*Get-GPPPassword*", "*Get-IndexedItem*", "*Get-Keystrokes*", "*Get-PassHash*", "*Get-*Password*", "*Get-RegAlwaysInstallElevated*", "*Get-RegAutoLogon*", "*Get-RickAstley*", "*Get-Screenshot*", "*Get-SecurityPackages*", "*Get-ServiceFilePermission*", "*Get-ServicePermission*", "*Get-ServiceUnquoted*", "*Get-SiteListPassword*", "*Get-System*", "*Get-TimedScreenshot*", "*Get-UnattendedInstallFile*", "*Get-Unconstrained*", "*Get-VaultCredential*", "*Get-VulnAutoRun*", "*Get-VulnSchTask*", "*Gupt-Backdoor*", "*gzipstream*", "*hijack*", "*HTTP-Login*", "*IEX *", "*injection*", "*Install-Service*", "*Install-ServiceBinary*", "*Install-SSP*", "*internetexplorer.application*", "*Invoke-*", "*io.compression*", "*kerberos::*", "*lastloggedon*", "*localadmin*", "*LSASecret*", "*lsass.exe*", "*MailRaider*", "*metasp*", "*mimikatz*", "*NEEEEWWW*", "*netfirewall*", "*NetworkRelay*", "*New-HoneyHash*", "*ngrok*", "*nishang*", "*Out-Minidump*", "*out-shortcut*", "*Port-Scan*", "*PortScan*", "*PowerBreach*", "*PowerShellIcmp*", "*PowerShelludp*", "*powershellwmi*", "*PowerUp*", "*PowerView*", "*rc4bytestream*", "*reflection.assembly*", "*remoteps*", "*remotewmi*", "*Remove-Update*", "*SEKURLSA::*", "*Set-MacAttribute*", "*Set-Wallpaper*", "*shell.application*", "*shellcode*", "*Show-TargetScreen*", "*Start-CaptureServer*", "*start-process*", "*system.security.cryptography*", "*Uninstall-Windows*", "*UserProperty*", "*VolumeShadowCopyTools*", "*WebClient*", "*webrequest*", "*wmicommand*", "*wmimethod*", "*wmiobject*", "*write-zip*", "*xmlhttp*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_4104_hunting_filter`
+how_to_implement: 'The following Hunting analytic requires PowerShell operational logs to be ingested with ScriptBlockLogging enabled.
 
-    | eval downgrade_version=if(like(script_lower, "% -version 2%"),3,0)
-
-    | eval compression_keyword=if(match(script_lower, "gzipstream|::decompress|io.compression|write-zip|(expand|compress)-archive"),5,0)
-
-    | eval invoke_command_keyword=if(like(script_lower,"%invoke-command%"), 4, 0)
-
-    | eval Score=ecnoded_command_keyword
-        + suspicious_cmdlets
-        + suspicious_keyword
-        + compression_keyword
-        + downgrade_version
-        + mimikatz
-        + invoke_expression_keyword
-        + empire
-        + webclient
-        + invoke_wmi_keyword
-        + invoke_command_keyword
-        + base64_keyword
-
-    | where Score>=4 OR mimikatz>0 OR suspicious_cmdlets>0 OR suspicious_keyword>0
-
-    | eval matched_rules=mvappend(
-        if(ecnoded_command_keyword>0, "Encoded Command Keywords", null()),
-        if(suspicious_cmdlets>0, "Suspicious Cmdlets", null()),
-        if(base64_keyword>0, "Base64 Keyword", null()),
-        if(empire>0, "Empire Framework Commands", null()),
-        if(mimikatz>0, "Mimikatz Keywords or Strings", null()),
-        if(invoke_expression_keyword>0, "Invoke Expression Keywords", null()),
-        if(webclient>0, "Webclient Keywords", null()),
-        if(suspicious_keyword>0, "Potentially Suspicious Keywords or Strings", null()),
-        if(invoke_wmi_keyword>0, "Invoke WMI Keywords", null()),
-        if(downgrade_version>0, "PowerShell Downgrade Version Attempt", null()),
-        if(compression_keyword>0, "Compression Keywords", null()),
-        if(invoke_command_keyword>0, "Invoke Command Keywords", null())
-    )
-
-    | eval matched_rules=mvfilter(isnotnull(matched_rules))
-
-    | rename Computer as dest, UserID as user
-
-    | stats max(Score) as Score values(matched_rules) as matched_rules
-      BY user dest ScriptBlockId
-
-    | eval matched_rules=mvjoin(matched_rules, ", ")
-
-    | `powershell_4104_hunting_filter`
-how_to_implement: |-
-    The following Hunting analytic requires PowerShell operational logs to be ingested with ScriptBlockLogging enabled.
     Modify the powershell macro as needed to match the sourcetype or add index.
-    This analytic is specific to EventID 4104, or PowerShell Script Block Logging.
+
+    This analytic is specific to EventID 4104, or PowerShell Script Block Logging.'
 known_false_positives: Limited false positives. May filter as needed.
 references:
     - https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md
diff --git a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml
index c5982ee92c5..e7a66384793 100644
--- a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml
+++ b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects attempts to modify or add a Component Object Model (COM) entry to the InProcServer32 path within the registry using PowerShell. It leverages PowerShell ScriptBlock Logging (EventCode 4104) to identify suspicious script blocks that target the InProcServer32 registry path. This activity is significant because modifying COM objects can be used for persistence or privilege escalation by attackers. If confirmed malicious, this could allow an attacker to execute arbitrary code or maintain persistent access to the compromised system, posing a severe security risk.
 data_source:
     - Powershell Script Block Logging 4104
-search: '`powershell` EventCode=4104 ScriptBlockText = "*Software\\Classes\\CLSID\\*\\InProcServer32*" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_com_hijacking_inprocserver32_modification_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Software\\Classes\\CLSID\*\\InProcServer32*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_com_hijacking_inprocserver32_modification_filter`
 how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the PowerShell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: False positives will be present if any scripts are adding to inprocserver32. Filter as needed.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A PowerShell script has been identified with InProcServer32 within the script code on $dest$.
     entity:
diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml
index acef6938780..787b22f8296 100644
--- a/detections/endpoint/powershell_creating_thread_mutex.yml
+++ b/detections/endpoint/powershell_creating_thread_mutex.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of PowerShell scripts using the `mutex` function via EventCode 4104. This detection leverages PowerShell Script Block Logging to identify scripts that create thread mutexes, a technique often used in obfuscated scripts to ensure only one instance runs on a compromised machine. This activity is significant as it may indicate the presence of sophisticated malware or persistence mechanisms. If confirmed malicious, the attacker could maintain exclusive control over a process, potentially leading to further exploitation or persistence within the environment.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `powershell_creating_thread_mutex_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Threading.Mutex*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: powershell developer may used this function in their script for instance checking too.
 references:
@@ -37,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A suspicious powershell script contains Thread Mutex on host $dest$
     entity:
diff --git a/detections/endpoint/powershell_defender_threat_actions_set_to_allow.yml b/detections/endpoint/powershell_defender_threat_actions_set_to_allow.yml
index 559f874a718..df96c822204 100644
--- a/detections/endpoint/powershell_defender_threat_actions_set_to_allow.yml
+++ b/detections/endpoint/powershell_defender_threat_actions_set_to_allow.yml
@@ -12,33 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    from datamodel=Endpoint.Processes where
-    `process_powershell`
-    Processes.process="*Set-MpPreference*"
-    (
-      Processes.process IN (
-        "*-HighThreatDefaultAction*",
-        "*-ModerateThreatDefaultAction*",
-        "*-LowThreatDefaultAction*",
-        "*-SevereThreatDefaultAction*"
-      )
-      Processes.process IN (
-        "* 6*"
-      )
-    )
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `powershell_defender_threat_actions_set_to_allow_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") Processes.process="*Set-MpPreference*" Processes.process IN ("*-HighThreatDefaultAction*", "*-ModerateThreatDefaultAction*", "*-LowThreatDefaultAction*", "*-SevereThreatDefaultAction*") Processes.process="* 6*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_defender_threat_actions_set_to_allow_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives. However, tune based on scripts that may perform this action.
 references:
@@ -52,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Process Commandline [$process$] that Set to Allow Windows Defender Threat Actions on [$dest$].
     entity:
diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml
index 7f5e5a62b20..9676d9d4928 100644
--- a/detections/endpoint/powershell_disable_security_monitoring.yml
+++ b/detections/endpoint/powershell_disable_security_monitoring.yml
@@ -6,89 +6,43 @@ modification_date: '2026-10-02'
 author: Michael Haag, Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic identifies attempts to disable Windows Defender
+description: 'The following analytic identifies attempts to disable Windows Defender
+
     real-time behavior monitoring via PowerShell commands. It detects the use of specific
+
     `Set-MpPreference` parameters that disable various security features. This activity
+
     is significant as it is commonly used by malware such as RATs, bots, or Trojans
+
     to evade detection by disabling antivirus protections. If confirmed malicious, this
+
     action could allow an attacker to operate undetected, leading to potential data
-    exfiltration, further system compromise, or persistent access within the environment.
+
+    exfiltration, further system compromise, or persistent access within the environment.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    from datamodel=Endpoint.Processes where
-    `process_powershell`
-    Processes.process="*Set-MpPreference*"
-    (
-      Processes.process IN (
-        "*DisableArchiveScanning*",
-        "*DisableBehaviorMonitoring*",
-        "*DisableBlockAtFirstSeen*",
-        "*DisableCatchupFullScan*",
-        "*DisableCatchupQuickScan*",
-        "*DisableIOAVProtection*",
-        "*DisableRealtimeMonitoring*",
-        "*DisableRemovableDriveScanning*",
-        "*DisableRestorePoint*",
-        "*DisableScanningMappedNetworkDrivesForFullScan*",
-        "*DisableScanningNetworkFiles*",
-        "*DisableScriptScanning*",
-        "*drdsc*",
-        "*dsnf *",
-        "*drtm *",
-        "*dioavp *",
-        "*dscrptsc *",
-        "*dbaf *",
-        "*darchsc *",
-        "*dcfsc *",
-        "*dbm *"
-      )
-      Processes.process IN (
-        "* $true*",
-        "* 1*"
-      )
-    )
-    OR
-    (
-      Processes.process = "*PUAProtection*"
-      Processes.process = "*disable*"
-    )
-    OR
-    (
-      Processes.process = "*CloudBlockLevel*"
-      Processes.process IN (
-        "* $false*",
-        "* 0*"
-      )
-    )
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") Processes.process="*Set-MpPreference*" Processes.process IN ("*DisableArchiveScanning*", "*DisableBehaviorMonitoring*", "*DisableBlockAtFirstSeen*", "*DisableCatchupFullScan*", "*DisableCatchupQuickScan*", "*DisableIOAVProtection*", "*DisableRealtimeMonitoring*", "*DisableRemovableDriveScanning*", "*DisableRestorePoint*", "*DisableScanningMappedNetworkDrivesForFullScan*", "*DisableScanningNetworkFiles*", "*DisableScriptScanning*", "*drdsc*", "*dsnf *", "*drtm *", "*dioavp *", "*dscrptsc *", "*dbaf *", "*darchsc *", "*dcfsc *", "*dbm *") Processes.process IN ("* $true*", "* 1*")) OR (Processes.process="*PUAProtection*" Processes.process="*disable*") OR (Processes.process="*CloudBlockLevel*" Processes.process IN ("* $false*", "* 0*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_disable_security_monitoring_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `powershell_disable_security_monitoring_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    Limited false positives. However, tune based on scripts that may perform this action.
+
+    names and speed up the data modeling process.'
+known_false_positives: Limited false positives. However, tune based on scripts that may perform this action.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell
     - https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps
@@ -101,7 +55,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender Real-time Behavior Monitoring disabled on $dest$
     entity:
diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml
index af8dd8778b8..34b48141d4f 100644
--- a/detections/endpoint/powershell_domain_enumeration.yml
+++ b/detections/endpoint/powershell_domain_enumeration.yml
@@ -6,34 +6,17 @@ modification_date: '2026-06-28'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the execution of PowerShell commands used for domain enumeration, such as `get-netdomaintrust` and `get-adgroupmember`.
+description: 'The following analytic detects the execution of PowerShell commands used for domain enumeration, such as `get-netdomaintrust` and `get-adgroupmember`.
+
     It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command sent to PowerShell.
+
     This activity is significant as it often indicates reconnaissance efforts by an attacker to map out the domain structure and identify key users and groups.
-    If confirmed malicious, this behavior could lead to further targeted attacks, privilege escalation, and unauthorized access to sensitive information within the domain.
+
+    If confirmed malicious, this behavior could lead to further targeted attacks, privilege escalation, and unauthorized access to sensitive information within the domain.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventCode=4104
-    ScriptBlockText IN (
-        *get-netdomaintrust*,
-        *get-netforesttrust*,
-        *get-addomain*,
-        *get-adgroupmember*,
-        *get-domainuser*
-    )
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `powershell_domain_enumeration_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*get-netdomaintrust*", "*get-netforesttrust*", "*get-addomain*", "*get-adgroupmember*", "*get-domainuser*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Legitimate use can be common or expected in certain environments. Filter as needed.
 references:
@@ -50,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/powershell_enable_powershell_remoting.yml b/detections/endpoint/powershell_enable_powershell_remoting.yml
index cd1f780f46a..fcdba17a075 100644
--- a/detections/endpoint/powershell_enable_powershell_remoting.yml
+++ b/detections/endpoint/powershell_enable_powershell_remoting.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of the Enable-PSRemoting cmdlet, which allows PowerShell remoting on a local or remote computer. This detection leverages PowerShell Script Block Logging (EventCode 4104) to identify when this cmdlet is executed. Monitoring this activity is crucial as it can indicate an attacker enabling remote command execution capabilities on a compromised system. If confirmed malicious, this activity could allow an attacker to take control of the system remotely, execute commands, and potentially pivot to other systems within the network, leading to further compromise and lateral movement.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText="*Enable-PSRemoting*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `powershell_enable_powershell_remoting_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Enable-PSRemoting*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_enable_powershell_remoting_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Note that false positives may occur due to the use of the Enable-PSRemoting cmdlet by legitimate users, such as system administrators. It is recommended to apply appropriate filters as needed to minimize the number of false positives.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml
index 64fefbe0fb8..3498020f5b5 100644
--- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml
+++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the enabling of the SMB1 protocol via `powershell.exe`. It leverages PowerShell script block logging (EventCode 4104) to identify the execution of the `Enable-WindowsOptionalFeature` cmdlet with the `SMB1Protocol` parameter. This activity is significant because enabling SMB1 can facilitate lateral movement and file encryption by ransomware, such as RedDot. If confirmed malicious, this action could allow an attacker to propagate through the network, encrypt files, and potentially disrupt business operations.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*Enable-WindowsOptionalFeature*" ScriptBlockText = "*SMB1Protocol*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `powershell_enable_smb1protocol_feature_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Enable-WindowsOptionalFeature*" Processes.process="*SMB1Protocol*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_enable_smb1protocol_feature_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
 known_false_positives: network operator may enable or disable this windows feature.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Powershell Enable SMB1Protocol Feature on $dest$
     entity:
diff --git a/detections/endpoint/powershell_environment_variable_execution.yml b/detections/endpoint/powershell_environment_variable_execution.yml
index 235dd1f2e97..6afbc61ad4c 100644
--- a/detections/endpoint/powershell_environment_variable_execution.yml
+++ b/detections/endpoint/powershell_environment_variable_execution.yml
@@ -6,14 +6,16 @@ modification_date: '2026-06-29'
 author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the execution of PowerShell scripts that combine environment variable access (`$env:` or `[Environment]::SetEnvironmentVariable`) with `Invoke-Expression` or its alias `iex` to dynamically construct and run code at runtime.
+description: 'The following analytic detects the execution of PowerShell scripts that combine environment variable access (`$env:` or `[Environment]::SetEnvironmentVariable`) with `Invoke-Expression` or its alias `iex` to dynamically construct and run code at runtime.
+
     This technique is commonly used by adversaries to stage and execute payloads by embedding commands or encoded content inside environment variables, then evaluating them on the fly — effectively hiding the true execution intent from static inspection.
+
     Detection is based on PowerShell Script Block Logging (Event ID 4104), which captures the de-obfuscated script block before it executes.
-    Triggering this analytic indicates a potential attempt to execute environment-variable-stored code, a behavior observed in malware loaders and stagers, including those associated with the VIP Keylogger campaign.
+
+    Triggering this analytic indicates a potential attempt to execute environment-variable-stored code, a behavior observed in malware loaders and stagers, including those associated with the VIP Keylogger campaign.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
+search: |
     `powershell`
     EventCode=4104
     ScriptBlockText="*$env:*"
diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml
index c35197e74fc..8308b3fa801 100644
--- a/detections/endpoint/powershell_execute_com_object.yml
+++ b/detections/endpoint/powershell_execute_com_object.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of a COM CLSID through PowerShell. It leverages EventCode 4104 and searches for specific script block text indicating the creation of a COM object. This activity is significant as it is commonly used by adversaries and malware, such as the Conti ransomware, to execute commands, potentially for privilege escalation or bypassing User Account Control (UAC). If confirmed malicious, this technique could allow attackers to gain elevated privileges or persist within the environment, posing a significant security risk.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*CreateInstance([type]::GetTypeFromCLSID*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `powershell_execute_com_object_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*CreateInstance([type]::GetTypeFromCLSID*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_execute_com_object_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: network operrator may use this command.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A suspicious powershell script contains COM CLSID command on host $dest$
     entity:
diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
index 208bae1d5a5..e24bd6a5457 100644
--- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
+++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the use of `GetProcAddress` in PowerShell script blocks, leveraging PowerShell Script Block Logging (EventCode=4104). This method captures the full command sent to PowerShell, which is then logged in Windows event logs. The presence of `GetProcAddress` is unusual for typical PowerShell scripts and often indicates malicious activity, as many attack toolkits use it to achieve code execution. If confirmed malicious, this activity could allow an attacker to execute arbitrary code, potentially leading to system compromise. Analysts should review parallel processes and the entire logged script block for further investigation.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText=*getprocaddress*
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `powershell_fileless_process_injection_via_getprocaddress_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*getprocaddress*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_process_injection_via_getprocaddress_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Limited false positives. Filter as needed.
 references:
@@ -37,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A suspicious powershell script contains GetProcAddress API on host $dest$
     entity:
diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
index 9343d1a1b2d..64741f4e949 100644
--- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the execution of PowerShell scripts containing Base64 encoded content, specifically identifying the use of `FromBase64String`. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command sent to PowerShell. This activity is significant as Base64 encoding is often used by attackers to obfuscate malicious payloads, making it harder to detect. If confirmed malicious, this could lead to code execution, allowing attackers to run arbitrary commands and potentially compromise the system.
 data_source:
     - Powershell Script Block Logging 4104
-search: "`powershell` EventCode=4104 ScriptBlockText = \"*frombase64string*\" OR ScriptBlockText = \"*gnirtS46esaBmorF*\"\n  | fillnull\n  | stats count min(_time) as firstTime max(_time) as lastTime\n    BY dest signature signature_id\n       user_id vendor_product EventID\n       Guid Opcode Name\n       Path ProcessID ScriptBlockId\n       ScriptBlockText\n  | `security_content_ctime(firstTime)`\n  | `security_content_ctime(lastTime)`\n  | `powershell_fileless_script_contains_base64_encoded_content_filter`"
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*frombase64string*", "*gnirtS46esaBmorF*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: False positives should be limited. Filter as needed.
 references:
diff --git a/detections/endpoint/powershell_get_localgroup_discovery.yml b/detections/endpoint/powershell_get_localgroup_discovery.yml
index fce9a2354d9..4bfedf5ffbc 100644
--- a/detections/endpoint/powershell_get_localgroup_discovery.yml
+++ b/detections/endpoint/powershell_get_localgroup_discovery.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=powershell.exe
-            OR
-            Processes.process_name=cmd.exe
-        )
-        (Processes.process="*get-localgroup*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `powershell_get_localgroup_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*powershell.exe", "*cmd.exe") Processes.process="*get-localgroup*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present. Tune as needed.
 references:
diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml
index 81e3c49d6ba..fe1a5d9caf6 100644
--- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml
+++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects the execution of the PowerShell cmdlet `get-localgroup` using PowerShell Script Block Logging (EventCode=4104). This method captures the full command sent to PowerShell, providing detailed visibility into script execution. Monitoring this activity is significant as it can indicate an attempt to enumerate local groups, which may be a precursor to privilege escalation or lateral movement. If confirmed malicious, an attacker could gain insights into group memberships, potentially leading to unauthorized access or privilege abuse. Review parallel processes and the entire script block for comprehensive analysis.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*get-localgroup*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `powershell_get_localgroup_discovery_with_script_block_logging_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*get-localgroup*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: False positives may be present. Tune as needed.
 references:
diff --git a/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml b/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml
index da3bad95877..e4b25145b67 100644
--- a/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml
+++ b/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of a New-CIMSession cmdlet followed by the use of the Invoke-CIMMethod cmdlet within PowerShell. It leverages PowerShell Script Block Logging to identify these specific cmdlets in the ScriptBlockText field. This activity is significant because it mirrors the behavior of the Invoke-WMIMethod cmdlet, often used for remote code execution via NTLMv2 pass-the-hash authentication. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access and control over targeted systems.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText IN ("*invoke-CIMMethod*", "*New-CimSession*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `powershell_invoke_cimmethod_cimsession_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*invoke-CIMMethod*", "*New-CimSession*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_invoke_cimmethod_cimsession_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: False positives may be present based on third-party applications or administrators using CIM. It is recommended to apply appropriate filters as needed to minimize the number of false positives.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/powershell_invoke_wmiexec_usage.yml b/detections/endpoint/powershell_invoke_wmiexec_usage.yml
index 04f3575f007..5db886cd7cc 100644
--- a/detections/endpoint/powershell_invoke_wmiexec_usage.yml
+++ b/detections/endpoint/powershell_invoke_wmiexec_usage.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the Invoke-WMIExec utility within PowerShell Script Block Logging (EventCode 4104). This detection leverages PowerShell script block logs to identify instances where the Invoke-WMIExec command is used. Monitoring this activity is crucial as it indicates potential lateral movement using WMI commands with NTLMv2 pass-the-hash authentication. If confirmed malicious, this activity could allow an attacker to execute commands remotely on target systems, potentially leading to further compromise and lateral spread within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText IN ("*invoke-wmiexec*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `powershell_invoke_wmiexec_usage_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*invoke-wmiexec*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_invoke_wmiexec_usage_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: False positives should be limited as this analytic is designed to detect a specific utility. It is recommended to apply appropriate filters as needed to minimize the number of false positives.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: PowerShell was identified running a Invoke-WmiExec on $dest$.
     entity:
diff --git a/detections/endpoint/powershell_load_module_in_meterpreter.yml b/detections/endpoint/powershell_load_module_in_meterpreter.yml
index 0a232a9f487..22ab6544aac 100644
--- a/detections/endpoint/powershell_load_module_in_meterpreter.yml
+++ b/detections/endpoint/powershell_load_module_in_meterpreter.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of suspicious PowerShell commands associated with Meterpreter modules, such as "MSF.Powershell" and "MSF.Powershell.Meterpreter". It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command sent to PowerShell. This activity is significant as it indicates potential post-exploitation actions, including credential dumping and persistence mechanisms. If confirmed malicious, an attacker could gain extensive control over the compromised system, escalate privileges, and maintain long-term access, posing a severe threat to the environment.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText IN ("*MSF.Powershell*","*MSF.Powershell.Meterpreter*","*MSF.Powershell.Meterpreter.Kiwi*","*MSF.Powershell.Meterpreter.Transport*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `powershell_load_module_in_meterpreter_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*MSF.Powershell*", "*MSF.Powershell.Meterpreter*", "*MSF.Powershell.Meterpreter.Kiwi*", "*MSF.Powershell.Meterpreter.Transport*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_load_module_in_meterpreter_filter`
 how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: False positives should be very limited as this is strict to MetaSploit behavior.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_id$" and "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: PowerShell was identified running a script utilized by Meterpreter from MetaSploit on endpoint $dest$ by user $user_id$.
     entity:
diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
index 2cb74860b73..d0490ce6d37 100644
--- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
+++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
@@ -6,37 +6,17 @@ modification_date: '2026-06-29'
 author: Michael Haag, Teoderick Contreras Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the use of PowerShell scripts to load .NET assemblies into memory via reflection, a technique often used in malicious activities such as those by Empire and Cobalt Strike.
+description: 'The following analytic detects the use of PowerShell scripts to load .NET assemblies into memory via reflection, a technique often used in malicious activities such as those by Empire and Cobalt Strike.
+
     It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed.
+
     This behavior is significant as it can indicate advanced attack techniques aiming to execute code in memory, bypassing traditional defenses.
-    If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, and persistent access within the environment.
+
+    If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, and persistent access within the environment.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104
-    ScriptBlockText IN (
-        "*.LoadFrom(*",
-        "*.LoadModule(*",
-        "*.LoadWithPartialName*",
-        "*Reflection.Assembly.Load*",
-        "*Reflection.Assembly]::('daoL'[-1..-4] -join '')*",
-        "*Reflection.Assembly]::Load*",
-        "*ReflectionOnlyLoad*",
-        "*UnsafeLoadFrom*"
-    )
-
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by dest signature signature_id user_id
-         vendor_product EventID Guid Opcode
-         Name Path ProcessID
-         ScriptBlockId ScriptBlockText
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `powershell_loading_dotnet_into_memory_via_reflection_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*.LoadFrom(*", "*.LoadModule(*", "*.LoadWithPartialName*", "*Reflection.Assembly.Load*", "*Reflection.Assembly]::('daoL'[-1..-4] -join '')*", "*Reflection.Assembly]::Load*", "*ReflectionOnlyLoad*", "*UnsafeLoadFrom*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_reflection_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: False positives should be limited as day to day scripts do not use this method.
 references:
diff --git a/detections/endpoint/powershell_pinvoke_process_injection_api_chain.yml b/detections/endpoint/powershell_pinvoke_process_injection_api_chain.yml
index 5474df66a47..af988d1804b 100644
--- a/detections/endpoint/powershell_pinvoke_process_injection_api_chain.yml
+++ b/detections/endpoint/powershell_pinvoke_process_injection_api_chain.yml
@@ -6,74 +6,15 @@ modification_date: '2026-06-25'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects PowerShell Script Block Logging (Event ID 4104) evidence of a complete P/Invoke process-injection API chain at either the compile phase or the execution phase.
-    Portions of this search were modified to retain the same functionality while preventing antivirus products from alerting on the detection itself
+description: 'The following analytic detects PowerShell Script Block Logging (Event ID 4104) evidence of a complete P/Invoke process-injection API chain at either the compile phase or the execution phase.
+
+    Portions of this search were modified to retain the same functionality while preventing antivirus products from alerting on the detection itself'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventCode=4104
-    ScriptBlockText="*add-type*"
-    ScriptBlockText="*DllImport*"
-    ScriptBlockText IN (
-        "*extern IntPtr*",
-        "*extern bool*",
-        "*extern uint*",
-        "*extern int*"
-    )
-    | where
-        (
-            match(ScriptBlockText, "(?i)[v][i][r][t][u][a][l][a][l][l][o][c]")
-            AND match(ScriptBlockText, "(?i)[v][i][r][t][u][a][l][p][r][o][t][e][c][t]")
-            AND match(ScriptBlockText, "(?i)[c][r][e][a][t][e][t][h][r][e][a][d]")
-        )
-        OR
-        (
-            match(ScriptBlockText, "(?i)[o][p][e][n][p][r][o][c][e][s][s]")
-            AND match(ScriptBlockText, "(?i)[v][i][r][t][u][a][l][a][l][l][o][c]")
-            AND match(ScriptBlockText, "(?i)[w][r][i][t][e][p][r][o][c][e][s][s][m][e][m][o][r][y]")
-            AND (
-                match(ScriptBlockText, "(?i)[c][r][e][a][t][e][r][e][m][o][t][e][t][h][r][e][a][d]")
-                OR
-                match(ScriptBlockText, "(?i)[q][u][e][u][e][u][s][e][r][a][p][c]")
-            )
-        )
-        OR
-        (
-            match(ScriptBlockText, "(?i)[o][p][e][n][t][h][r][e][a][d]")
-            AND match(ScriptBlockText, "(?i)[s][u][s][p][e][n][d][t][h][r][e][a][d]")
-            AND match(ScriptBlockText, "(?i)[g][e][t][t][h][r][e][a][d][c][o][n][t][e][x][t]")
-            AND match(ScriptBlockText, "(?i)[w][r][i][t][e][p][r][o][c][e][s][s][m][e][m][o][r][y]")
-            AND match(ScriptBlockText, "(?i)[s][e][t][t][h][r][e][a][d][c][o][n][t][e][x][t]")
-            AND match(ScriptBlockText, "(?i)[r][e][s][u][m][e][t][h][r][e][a][d]")
-        )
-        OR
-        (
-            match(ScriptBlockText, "(?i)[c][r][e][a][t][e][p][r][o][c][e][s][s]")
-            AND match(ScriptBlockText, "(?i)[v][i][r][t][u][a][l][a][l][l][o][c]")
-            AND match(ScriptBlockText, "(?i)[w][r][i][t][e][p][r][o][c][e][s][s][m][e][m][o][r][y]")
-            AND match(ScriptBlockText, "(?i)[s][e][t][t][h][r][e][a][d][c][o][n][t][e][x][t]")
-            AND ScriptBlockText = "*ResumeThread*"
-        )
-        OR
-        (
-            match(ScriptBlockText, "(?i)[n][t][c][r][e][a][t][e][s][e][c][t][i][o][n]")
-            AND match(ScriptBlockText, "(?i)[n][t][m][a][p][v][i][e][w][o][f][s][e][c][t][i][o][n]")
-            AND match(ScriptBlockText, "(?i)[c][r][e][a][t][e][r][e][m][o][t][e][t][h][r][e][a][d]")
-        )
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-       by dest signature signature_id user_id vendor_product EventID
-          Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `powershell_pinvoke_process_injection_api_chain_filter`
-how_to_implement: |-
-    The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
-known_false_positives: |-
-    No false positives have been identified at this time.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*add-type*" Processes.process="*DllImport*" Processes.process IN ("*extern IntPtr*", "*extern bool*", "*extern uint*", "*extern int*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_pinvoke_process_injection_api_chain_filter`
+how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://learn.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.dllimportattribute
     - https://www.ired.team/offensive-security/code-injection-process-injection
@@ -88,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A PowerShell script Script block ID [$ScriptBlockId$] contains a possible P-Invoke process injection API chain via either inline Add-Type class declaration or direct static method invocation on [$dest$]
     entity:
diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml
index eb231a56282..9c9e29dfe66 100644
--- a/detections/endpoint/powershell_processing_stream_of_data.yml
+++ b/detections/endpoint/powershell_processing_stream_of_data.yml
@@ -6,32 +6,17 @@ modification_date: '2026-06-29'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects suspicious PowerShell script execution involving compressed stream data processing, identified via EventCode 4104.
+description: 'The following analytic detects suspicious PowerShell script execution involving compressed stream data processing, identified via EventCode 4104.
+
     It leverages PowerShell Script Block Logging to flag scripts using `IO.Compression`, `IO.StreamReader`, or decompression methods.
+
     This activity is significant as it often indicates obfuscated PowerShell or embedded .NET/binary execution, which are common tactics for evading detection.
-    If confirmed malicious, this behavior could allow attackers to execute hidden code, escalate privileges, or maintain persistence within the environment.
+
+    If confirmed malicious, this behavior could allow attackers to execute hidden code, escalate privileges, or maintain persistence within the environment.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventCode=4104
-    ScriptBlockText IN (
-        "*IO.Compression.*",
-        "*IO.StreamReader*",
-        "*]::Decompress*"
-    )
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by dest signature signature_id
-         user_id vendor_product EventID
-         Guid Opcode Name
-         Path ProcessID ScriptBlockId
-         ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `powershell_processing_stream_of_data_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*IO.Compression.*", "*IO.StreamReader*", "*]::Decompress*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: powershell may used this function to process compressed data.
 references:
@@ -50,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/powershell_remote_services_add_trustedhost.yml b/detections/endpoint/powershell_remote_services_add_trustedhost.yml
index f928035da33..bca8cc182a0 100644
--- a/detections/endpoint/powershell_remote_services_add_trustedhost.yml
+++ b/detections/endpoint/powershell_remote_services_add_trustedhost.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the execution of a PowerShell script that modifies the 'TrustedHosts' configuration via EventCode 4104. It leverages PowerShell Script Block Logging to identify commands targeting WSMan settings, specifically those altering or concatenating trusted hosts. This activity is significant as it can indicate attempts to manipulate remote connection settings, potentially allowing unauthorized remote access. If confirmed malicious, this could enable attackers to establish persistent remote connections, bypass security protocols, and gain unauthorized access to sensitive systems and data.
 data_source:
     - Powershell Script Block Logging 4104
-search: '`powershell` EventCode=4104  ScriptBlockText = "*WSMan:\\localhost\\Client\\TrustedHosts*" ScriptBlockText IN ("* -Value *", "* -Concatenate *") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remote_services_add_trustedhost_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*WSMan:\\localhost\\Client\\TrustedHosts*" Processes.process IN ("* -Value *", "* -Concatenate *") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remote_services_add_trustedhost_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: user and network administrator may used this function to add trusted host.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: a powershell script adding a remote trustedhost on $dest$ .
     entity:
diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
index 76bd9216a93..569055f8811 100644
--- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
+++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
@@ -6,45 +6,17 @@ modification_date: '2026-07-01'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects suspicious PowerShell processes attempting to inject code into critical Windows processes using CreateRemoteThread.
+description: 'The following analytic detects suspicious PowerShell processes attempting to inject code into critical Windows processes using CreateRemoteThread.
+
     It leverages Sysmon EventCode 8 to identify instances where PowerShell spawns threads in processes like svchost.exe, csrss.exe, and others.
+
     This activity is significant as it is commonly used by malware such as TrickBot and offensive tools like Cobalt Strike to execute malicious payloads, establish reverse shells, or download additional malware.
-    If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, and persistent access within the environment.
+
+    If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, and persistent access within the environment.'
 data_source:
     - Sysmon EventID 8
-search: |-
-    `sysmon`
-    EventCode=8
-    SourceImage IN (
-        "*\\powershell_ise.exe",
-        "*\\powershell.exe",
-        "*\\pwsh.exe"
-    )
-    TargetImage IN (
-        "*\\csrss.exe",
-        "*\\explorer.exe",
-        "*\\gpupdate.exe",
-        "*\\services.exe",
-        "*\\smss.exe",
-        "*\\spoolsv.exe",
-        "*\\svchost.exe",
-        "*\\taskhost.exe",
-        "*\\userinit.exe",
-        "*\\wininit.exe",
-        "*\\winlogon.exe"
-    )
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-                  values(NewThreadId) as "NewThreadId"
-                  values(StartAddress) as "StartAddress"
-      by dest signature_id signature
-         SourceProcessGuid SourceProcessId SourceImage
-         TargetProcessGuid TargetProcessId TargetImage
-         StartModule StartFunction vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `powershell_remote_thread_to_known_windows_process_filter`
+search: |
+    `sysmon` EventCode=8 SourceImage IN ("*\\powershell_ise.exe", "*\\powershell.exe", "*\\pwsh.exe") TargetImage IN ("*\\csrss.exe", "*\\explorer.exe", "*\\gpupdate.exe", "*\\services.exe", "*\\smss.exe", "*\\spoolsv.exe", "*\\svchost.exe", "*\\taskhost.exe", "*\\userinit.exe", "*\\wininit.exe", "*\\winlogon.exe") | stats count min(_time) as firstTime max(_time) as lastTime by dest signature_id signature SourceProcessGuid SourceProcessId SourceImage TargetProcessGuid TargetProcessId TargetImage StartModule StartFunction SourceUser TargetUser vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remote_thread_to_known_windows_process_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, Create Remote thread from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of create remote thread may be used.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -57,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A suspicious powershell process $SourceImage$ created a remote thread into the target process $TargetImage$ on host $dest$
     entity:
diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml
index 02c1d12e897..2cbbf31c84d 100644
--- a/detections/endpoint/powershell_remove_windows_defender_directory.yml
+++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml
@@ -6,28 +6,17 @@ modification_date: '2026-06-29'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects a suspicious PowerShell command attempting to delete the Windows Defender directory.
+description: 'The following analytic detects a suspicious PowerShell command attempting to delete the Windows Defender directory.
+
     It leverages PowerShell Script Block Logging to identify commands containing "rmdir" and targeting the Windows Defender path.
+
     This activity is significant as it may indicate an attempt to disable or corrupt Windows Defender, a key security component.
-    If confirmed malicious, this action could allow an attacker to bypass endpoint protection, facilitating further malicious activities without detection.
+
+    If confirmed malicious, this action could allow an attacker to bypass endpoint protection, facilitating further malicious activities without detection.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventCode=4104
-    ScriptBlockText = "*rmdir *"
-    ScriptBlockText = "*\\Microsoft\\Windows Defender*"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by dest signature signature_id user_id
-         vendor_product EventID Guid Opcode
-         Name Path ProcessID
-         ScriptBlockId ScriptBlockText
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `powershell_remove_windows_defender_directory_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*rmdir *" Processes.process="*\\Microsoft\\Windows Defender*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remove_windows_defender_directory_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -40,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/powershell_script_block_with_url_chain.yml b/detections/endpoint/powershell_script_block_with_url_chain.yml
index a4e86f52664..f631f68302a 100644
--- a/detections/endpoint/powershell_script_block_with_url_chain.yml
+++ b/detections/endpoint/powershell_script_block_with_url_chain.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that contains multiple URLs within a function or array. It leverages PowerShell operational logs to detect script blocks with embedded URLs, often indicative of obfuscated scripts or those attempting to download secondary payloads. This activity is significant as it may signal an attempt to execute malicious code or download additional malware. If confirmed malicious, this could lead to code execution, further system compromise, or data exfiltration. Review parallel processes and the full script block for additional context and related artifacts.
 data_source:
     - Powershell Script Block Logging 4104
-search: '`powershell` EventCode=4104 ScriptBlockText IN ("*http:*","*https:*") | regex ScriptBlockText="(\"?(https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*))\"?(?:,|\))?){2,}" | rex max_match=20 field=ScriptBlockText "(?<url>https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*))" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_script_block_with_url_chain_filter`'
+search: |
+    `powershell` EventCode=4104 ScriptBlockText IN ("*http:*","*https:*") | regex ScriptBlockText="(\"?(https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*))\"?(?:,|\))?){2,}" | rex max_match=20 field=ScriptBlockText "(?<url>https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*))" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_script_block_with_url_chain_filter`
 how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A suspicious powershell script used by $user_id$ on host $dest$ contains URLs in an array, this is commonly used for malware.
     entity:
diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml
index 3b69c4a75d2..0bc58a764c0 100644
--- a/detections/endpoint/powershell_start_bitstransfer.yml
+++ b/detections/endpoint/powershell_start_bitstransfer.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_powershell` Processes.process=*start-bitstransfer*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `powershell_start_bitstransfer_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") Processes.process="*start-bitstransfer*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_start_bitstransfer_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives. It is possible administrators will utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent process or command-line arguments.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A suspicious process $process_name$ with commandline $process$ that are related to bittransfer functionality in host $dest$
     entity:
diff --git a/detections/endpoint/powershell_start_or_stop_service.yml b/detections/endpoint/powershell_start_or_stop_service.yml
index 84b0b7eb74a..75070bfe8d2 100644
--- a/detections/endpoint/powershell_start_or_stop_service.yml
+++ b/detections/endpoint/powershell_start_or_stop_service.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic identifies the use of PowerShell's Start-Service or Stop-Service cmdlets on an endpoint. It leverages PowerShell Script Block Logging to detect these commands. This activity is significant because attackers can manipulate services to disable or stop critical functions, causing system instability or disrupting business operations. If confirmed malicious, this behavior could allow attackers to disable security services, evade detection, or disrupt essential services, leading to potential system downtime and compromised security.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText IN ("*start-service*", "*stop-service*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `powershell_start_or_stop_service_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*start-service*", "*stop-service*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_start_or_stop_service_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: This behavior may be noisy, as these cmdlets are commonly used by system administrators or other legitimate users to manage services. Therefore, it is recommended not to enable this analytic as a direct finding Instead, it should be used as part of a broader set of security controls to detect and investigate potential threats.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml
index 92e8a6216a1..161bd5b2098 100644
--- a/detections/endpoint/powershell_using_memory_as_backing_store.yml
+++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects suspicious PowerShell script execution using memory streams as a backing store, identified via EventCode 4104. It leverages PowerShell Script Block Logging to capture scripts that create new objects with memory streams, often used to decompress and execute payloads in memory. This activity is significant as it indicates potential in-memory execution of malicious code, bypassing traditional file-based detection. If confirmed malicious, this technique could allow attackers to execute arbitrary code, maintain persistence, or escalate privileges without leaving a trace on the disk.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = *New-Object* ScriptBlockText = *IO.MemoryStream*
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `powershell_using_memory_as_backing_store_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*New-Object*" Processes.process="*IO.MemoryStream*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_using_memory_as_backing_store_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: powershell may used this function to store out object into memory.
 references:
@@ -38,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A PowerShell script contains memorystream command on host $dest$.
     entity:
diff --git a/detections/endpoint/powershell_webrequest_using_memory_stream.yml b/detections/endpoint/powershell_webrequest_using_memory_stream.yml
index e9f683d57ae..e261b8cb2b4 100644
--- a/detections/endpoint/powershell_webrequest_using_memory_stream.yml
+++ b/detections/endpoint/powershell_webrequest_using_memory_stream.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the use of .NET classes in PowerShell to download a URL payload directly into memory, a common fileless malware staging technique. It leverages PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell commands involving `system.net.webclient`, `system.net.webrequest`, and `IO.MemoryStream`. This activity is significant as it indicates potential fileless malware execution, which is harder to detect and can bypass traditional file-based defenses. If confirmed malicious, this technique could allow attackers to execute code in memory, evade detection, and maintain persistence in the environment.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104  ScriptBlockText IN ("*system.net.webclient*","*system.net.webrequest*") AND ScriptBlockText="*IO.MemoryStream*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `powershell_webrequest_using_memory_stream_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*system.net.webclient*", "*system.net.webrequest*") Processes.process="*IO.MemoryStream*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_webrequest_using_memory_stream_filter`
 how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Powershell webrequest to memory stream behavior. Possible fileless malware staging on $dest$ by $user_id$.
     entity:
diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml
index 85183c77144..ef84bed33e8 100644
--- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml
+++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml
@@ -6,32 +6,17 @@ modification_date: '2026-06-29'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the use of PowerShell commands to add or set Windows Defender exclusions.
+description: 'The following analytic detects the use of PowerShell commands to add or set Windows Defender exclusions.
+
     It leverages EventCode 4104 to identify suspicious `Add-MpPreference` or `Set-MpPreference` commands with exclusion parameters.
+
     This activity is significant because adversaries often use it to bypass Windows Defender, allowing malicious code to execute without detection.
-    If confirmed malicious, this behavior could enable attackers to evade antivirus defenses, maintain persistence, and execute further malicious activities undetected.
+
+    If confirmed malicious, this behavior could enable attackers to evade antivirus defenses, maintain persistence, and execute further malicious activities undetected.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventCode=4104
-    ScriptBlockText IN (
-        "*Add-MpPreference *",
-        "*Set-MpPreference *"
-    )
-    ScriptBlockText = "*-exclusion*"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by dest signature signature_id
-         user_id vendor_product EventID
-         Guid Opcode Name
-         Path ProcessID ScriptBlockId
-         ScriptBlockText
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `powershell_windows_defender_exclusion_commands_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*Add-MpPreference *", "*Set-MpPreference *") Processes.process="*-exclusion*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_windows_defender_exclusion_commands_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: admin or user may choose to use this windows features.
 references:
@@ -46,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_id$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml
index ebf40c2a02e..f79fb623271 100644
--- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml
+++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "bcdedit.exe" Processes.process = "*bootstatuspolicy*"  Processes.process = "*ignoreallfailures*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `prevent_automatic_repair_mode_using_bcdedit_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*bcdedit.exe" Processes.process="*bootstatuspolicy*" Processes.process="*ignoreallfailures*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `prevent_automatic_repair_mode_using_bcdedit_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may modify the boot configuration ignore failure during testing and debugging.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A suspicious process $process_name$ with process id $process_id$ contains commandline $process$ to ignore all bcdedit execution failure in host $dest$
     entity:
diff --git a/detections/endpoint/print_processor_registry_autostart.yml b/detections/endpoint/print_processor_registry_autostart.yml
index bcd6b05ac34..fa0ab45c951 100644
--- a/detections/endpoint/print_processor_registry_autostart.yml
+++ b/detections/endpoint/print_processor_registry_autostart.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects suspicious modifications or new entries in the Print Processor registry path. It leverages registry activity data from the Endpoint data model to identify changes in the specified registry path. This activity is significant because the Print Processor registry is known to be exploited by APT groups like Turla for persistence and privilege escalation. If confirmed malicious, this could allow an attacker to execute a malicious DLL payload by restarting the spoolsv.exe process, leading to potential control over the compromised machine.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\Control\\Print\\Environments\\Windows x64\\Print Processors*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `print_processor_registry_autostart_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\Print\\Environments\\Windows x64\\Print Processors*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `print_processor_registry_autostart_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 known_false_positives: possible new printer installation may add driver component on this registry.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: modified/added/deleted registry entry $registry_path$ on $dest$
     entity:
diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml
index 044a4cd6394..39703c37d68 100644
--- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml
+++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml
@@ -9,14 +9,8 @@ type: TTP
 description: The following analytic detects the addition of new printer drivers by monitoring Windows PrintService operational logs, specifically EventCode 316. This detection leverages log data to identify messages indicating the addition or update of printer drivers, such as "kernelbase.dll" and "UNIDRV.DLL." This activity is significant as it may indicate exploitation attempts related to vulnerabilities like CVE-2021-34527 (PrintNightmare). If confirmed malicious, attackers could gain code execution or escalate privileges, potentially compromising the affected system. Immediate isolation and investigation of the endpoint are recommended.
 data_source:
     - Windows Event Log Printservice 316
-search: |-
-    `printservice` EventCode=316 category = "Adding a printer driver" Message = "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*"
-      | stats  count min(_time) as firstTime max(_time) as lastTime
-        BY OpCode EventCode ComputerName
-           Message
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `print_spooler_adding_a_printer_driver_filter`
+search: |
+    `printservice` EventCode=316 category="Adding a printer driver" Message="*kernelbase.dll,*" Message="*UNIDRV.DLL,*" Message="*.DLL.*" | stats count min(_time) as firstTime max(_time) as lastTime by category Message ComputerName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `print_spooler_adding_a_printer_driver_filter`
 how_to_implement: You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -32,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$ComputerName$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$ComputerName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious print driver was loaded on endpoint $ComputerName$.
     entity:
diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml
index 92bebb4f5c3..0297ba05c76 100644
--- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml
+++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml
@@ -10,7 +10,8 @@ description: The following analytic detects driver load errors in the Windows Pr
 data_source:
     - Windows Event Log Printservice 808
     - Windows Event Log Printservice 4909
-search: '`printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `print_spooler_failed_to_load_a_plug_in_filter`'
+search: |
+    `printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `print_spooler_failed_to_load_a_plug_in_filter`
 how_to_implement: You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems.
 known_false_positives: False positives are unknown and filtering may be required.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$ComputerName$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$ComputerName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious printer spooler errors have occurred on endpoint $ComputerName$ with EventCode $EventCode$.
     entity:
diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
index 89befa690f4..b3f0d031dd1 100644
--- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
+++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
@@ -6,59 +6,27 @@ modification_date: '2026-05-13'
 author: Jose Hernandez, Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects a process creating a `.lnk` file in suspicious locations such as `C:\User*` or `*\Local\Temp\*`.
+description: 'The following analytic detects a process creating a `.lnk` file in suspicious locations such as `C:\User*` or `*\Local\Temp\*`.
+
     It leverages filesystem and process activity data from the Endpoint data model to identify this behavior.
+
     This activity can be significant because creating `.lnk` files in these directories is a common indicator of spear phishing tools to establish persistence or execute malicious payloads.
-    If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary code, or further compromise the system.
+
+    If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary code, or further compromise the system.'
 data_source:
     - Sysmon EventID 11
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk" Filesystem.file_path IN ("*:\\AppData\\Local\\Temp\\*", "*:\\Temp\\*", "*:\\Users\\*", "*:\\Windows\\Temp\\*") NOT (Filesystem.file_path IN ("*\\AppData\\Local\\Microsoft\\Windows\\WinX\\*", "*\\AppData\\Roaming\\Microsoft\\Excel\\*", "*\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", "*\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", "*\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", "*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", "*\\AppData\\Roaming\\Microsoft\\Word\\*", "*\\Links\\*", "*\\OneDrive *")) by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_creating_lnk_file_in_suspicious_location_filter`
+how_to_implement: 'You must be ingesting data that records filesystem and process activity
 
-    FROM datamodel=Endpoint.Filesystem where
+    from your hosts to populate the Endpoint data model. This is typically populated
 
-    Filesystem.action="created"
-    Filesystem.file_name="*.lnk"
-    Filesystem.file_path IN (
-      "*:\\AppData\\Local\\Temp\\*",
-      "*:\\Temp\\*",
-      "*:\\Users\\*",
-      "*:\\Windows\\Temp\\*"
-    )
-    NOT Filesystem.file_path IN (
-      "*\\AppData\\Local\\Microsoft\\Windows\\WinX\\*",
-      "*\\AppData\\Roaming\\Microsoft\\Excel\\*",
-      "*\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*",
-      "*\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*",
-      "*\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*",
-      "*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*",
-      "*\\AppData\\Roaming\\Microsoft\\Word\\*",
-      "*\\Links\\*",
-      "*\\OneDrive *"
-    )
+    via endpoint detection-and-response product, such as Carbon Black, or endpoint data
 
-    by Filesystem.action Filesystem.dest Filesystem.file_access_time
-       Filesystem.file_create_time Filesystem.file_hash
-       Filesystem.file_modify_time Filesystem.file_name
-       Filesystem.file_path Filesystem.file_acl Filesystem.file_size
-       Filesystem.process_guid Filesystem.process_id
-       Filesystem.user Filesystem.vendor_product
+    sources, such as Sysmon.'
+known_false_positives: 'False positives are expected to occur, since `.lnk` files can be created legitimately
 
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `process_creating_lnk_file_in_suspicious_location_filter`
-how_to_implement: |
-    You must be ingesting data that records filesystem and process activity
-    from your hosts to populate the Endpoint data model. This is typically populated
-    via endpoint detection-and-response product, such as Carbon Black, or endpoint data
-    sources, such as Sysmon.
-known_false_positives: |
-    False positives are expected to occur, since `.lnk` files can be created legitimately
-    by users or applications. To reduce false positives. To reduce noise, think of joining this to the process that created the LNK file and see if it's a known good process.
+    by users or applications. To reduce false positives. To reduce noise, think of joining this to the process that created the LNK file and see if it''s a known good process.'
 references:
     - https://attack.mitre.org/techniques/T1566/001/
     - https://www.trendmicro.com/en_us/research/17/e/rising-trend-attackers-using-lnk-files-download-malware.html
@@ -71,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml
index 30521a89e7e..a0149847b41 100644
--- a/detections/endpoint/process_deleting_its_process_file_path.yml
+++ b/detections/endpoint/process_deleting_its_process_file_path.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies a process attempting to delete its own file path, a behavior often associated with defense evasion techniques. This detection leverages Sysmon EventCode 1 logs, focusing on command lines executed via cmd.exe that include deletion commands. This activity is significant as it may indicate malware, such as Clop ransomware, trying to evade detection by removing its executable file if certain conditions are met. If confirmed malicious, this could allow the attacker to persist undetected, complicating incident response and remediation efforts.
 data_source:
     - Sysmon EventID 1
-search: '`sysmon` EventCode=1 CommandLine = "* /c *" CommandLine = "* del*" Image = "*\\cmd.exe" | eval result = if(like(process,"%".parent_process."%"), "Found", "Not Found") | stats min(_time) as firstTime max(_time) as lastTime count by action dest original_file_name parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process process_exec process_guid process_hash process_id process_integrity_level process_name process_path user user_id vendor_product result | where result = "Found" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_deleting_its_process_file_path_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="* /c *" Processes.process="* del*" Processes.process_path="*\\cmd.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_deleting_its_process_file_path_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process $process_name$ tries to delete its process path in commandline $process$ as part of defense evasion in host $dest$ by user $user$
     entity:
diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml
index 8b86ff9be68..37567c6efbe 100644
--- a/detections/endpoint/process_execution_via_wmi.yml
+++ b/detections/endpoint/process_execution_via_wmi.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=WmiPrvSE.exe NOT (Processes.process IN ("*\\dismhost.exe*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_execution_via_wmi_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*WmiPrvSE.exe" NOT Processes.process="*\\dismhost.exe*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_execution_via_wmi_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, administrators may use wmi to execute commands for legitimate purposes.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A remote instance execution of wmic.exe by WmiPrvSE.exe detected on host - $dest$
     entity:
diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml
index 0cbe4326521..7a17af9a141 100644
--- a/detections/endpoint/process_kill_base_on_file_path.yml
+++ b/detections/endpoint/process_kill_base_on_file_path.yml
@@ -11,26 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_wmic`
-        AND
-        Processes.process="*process*"
-        AND
-        Processes.process="*executablepath*"
-        AND
-        Processes.process="*delete*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `process_kill_base_on_file_path_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process="*process*" Processes.process="*executablepath*" Processes.process="*delete*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_kill_base_on_file_path_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -43,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process $process_name$ attempt to kill process by its file path using commandline $process$ in host $dest$
     entity:
diff --git a/detections/endpoint/process_writing_dynamicwrapperx.yml b/detections/endpoint/process_writing_dynamicwrapperx.yml
index 07dae66dd22..ec05ff642b4 100644
--- a/detections/endpoint/process_writing_dynamicwrapperx.yml
+++ b/detections/endpoint/process_writing_dynamicwrapperx.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects a process writing the dynwrapx.dll file to disk and registering it in the registry. It leverages data from the Endpoint datamodel, specifically monitoring process and filesystem events. This activity is significant because DynamicWrapperX is an ActiveX component often used in scripts to call Windows API functions, and its presence in non-standard locations is highly suspicious. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment. Immediate investigation of parallel processes and registry modifications is recommended.
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.file_name="dynwrapx.dll"
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `process_writing_dynamicwrapperx_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*dynwrapx.dll" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_writing_dynamicwrapperx_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default).
 references:
diff --git a/detections/endpoint/processes_tapping_keyboard_events.yml b/detections/endpoint/processes_tapping_keyboard_events.yml
index b7f281adb5a..2e4d60d1069 100644
--- a/detections/endpoint/processes_tapping_keyboard_events.yml
+++ b/detections/endpoint/processes_tapping_keyboard_events.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects processes on macOS systems that are tapping keyboard events, potentially monitoring all keystrokes made by a user. It leverages data from osquery results within the Alerts data model, focusing on specific process names and command lines. This activity is significant as it is a common technique used by Remote Access Trojans (RATs) to log keystrokes, posing a serious security risk. If confirmed malicious, this could lead to unauthorized access to sensitive information, including passwords and personal data, compromising the integrity and confidentiality of the system.
 data_source:
     - Osquery Results
-search: |-
+search: |
     | from datamodel Alerts.Alerts
     | search app=osquery:results name=pack_osx-attacks_Keyboard_Event_Taps
     | rename columns.cmdline as cmd, columns.name as process_name, columns.pid as process_id
diff --git a/detections/endpoint/python_network_traffic_during_package_build.yml b/detections/endpoint/python_network_traffic_during_package_build.yml
index b5b36b69b29..4d3071d4249 100644
--- a/detections/endpoint/python_network_traffic_during_package_build.yml
+++ b/detections/endpoint/python_network_traffic_during_package_build.yml
@@ -6,14 +6,16 @@ modification_date: '2026-08-21'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects a Python process making an outbound network connection during package installation.
+description: 'The following analytic detects a Python process making an outbound network connection during package installation.
+
     Adversaries can abuse `setup.py` build scripts by leveraging `distutils`/`setuptools` command classes to execute arbitrary code, including network beacons to third-party domains, the moment a malicious Python package is installed.
+
     This activity is significant because it allows adversaries to establish a foothold or exfiltrate data without any direct interaction from the victim beyond running `pip install`.
-    If confirmed malicious, this could indicate a successful software supply chain compromise.
+
+    If confirmed malicious, this could indicate a successful software supply chain compromise.'
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 3
-search: |-
+search: |
     `sysmon`
     (
         EventID=1
@@ -57,13 +59,14 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `python_network_traffic_during_package_build_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Sysmon. To implement this search, you must ingest logs
+how_to_implement: 'The detection is based on data that originates from Sysmon. To implement this search, you must ingest logs
+
     with process creation (EventID 1) and network connection (EventID 3) events, mapped via the appropriate
-    Splunk Technology Add-on. Use the Splunk Common Information Model (CIM) to normalize the field names.
-known_false_positives: |-
-    Python packages may contact software repositories, mirror sites during build time.
-    Investigate the destination and package content to determine legitimacy.
+
+    Splunk Technology Add-on. Use the Splunk Common Information Model (CIM) to normalize the field names.'
+known_false_positives: 'Python packages may contact software repositories, mirror sites during build time.
+
+    Investigate the destination and package content to determine legitimacy.'
 references:
     - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
 drilldown_searches:
@@ -74,7 +77,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/python_pth_file_creation_during_package_installation.yml b/detections/endpoint/python_pth_file_creation_during_package_installation.yml
index c7c514aee1d..1398b90444c 100644
--- a/detections/endpoint/python_pth_file_creation_during_package_installation.yml
+++ b/detections/endpoint/python_pth_file_creation_during_package_installation.yml
@@ -6,14 +6,16 @@ modification_date: '2026-08-21'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the creation of a Python path configuration (`.pth`) file in conjunction with a package installation process.
+description: 'The following analytic detects the creation of a Python path configuration (`.pth`) file in conjunction with a package installation process.
+
     Path configuration files placed under `site-packages` or `dist-packages` are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type.
+
     This technique was used by the threat actor group TeamPCP during the supply chain compromise of the `litellm` package.
-    If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
+
+    If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.'
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 11
-search: |-
+search: |
     `sysmon`
     EventID IN (1,11)
     process_name="python.exe"
@@ -51,14 +53,16 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `python_pth_file_creation_during_package_installation_filter`
-how_to_implement: |-
-    This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
+how_to_implement: 'This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
+
     and file creation (EventID 11) events, ensuring that file creation events are collected for files with the .pth
+
     extension. Ingest the data via the appropriate Splunk Technology Add-on and normalize field names using the
-    Splunk Common Information Model (CIM).
-known_false_positives: |-
-    Legitimate packages, such as those managing namespace packages or editable installs, may create `.pth` files as part of normal installation.
-    Investigate the file contents and parent process to determine legitimacy.
+
+    Splunk Common Information Model (CIM).'
+known_false_positives: 'Legitimate packages, such as those managing namespace packages or editable installs, may create `.pth` files as part of normal installation.
+
+    Investigate the file contents and parent process to determine legitimacy.'
 references:
     - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
 drilldown_searches:
@@ -69,7 +73,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/python_pythonpath_modification_during_package_installation.yml b/detections/endpoint/python_pythonpath_modification_during_package_installation.yml
index a314b6e63eb..117840ba653 100644
--- a/detections/endpoint/python_pythonpath_modification_during_package_installation.yml
+++ b/detections/endpoint/python_pythonpath_modification_during_package_installation.yml
@@ -6,14 +6,16 @@ modification_date: '2026-08-21'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects modification of the PYTHONPATH environment variable in conjunction with a package installation process.
+description: 'The following analytic detects modification of the PYTHONPATH environment variable in conjunction with a package installation process.
+
     Python looks up the `sys.path` variable, which is generated by combining user and site folders with `.pth` files and the value of the PYTHONPATH environment variable, to determine which directories to use for importing modules.
+
     If an adversary is able to control the value of PYTHONPATH, they can point it to an attacker-controlled directory and hijack imported packages, achieving user-level persistence across future Python invocations and new shell sessions.
-    If confirmed malicious, this could result in arbitrary code execution every time Python is invoked by the affected user.
+
+    If confirmed malicious, this could result in arbitrary code execution every time Python is invoked by the affected user.'
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 13
-search: |-
+search: |
     `sysmon`
     EventID IN (1,13)
     (
@@ -51,14 +53,16 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `python_pythonpath_modification_during_package_installation_filter`
-how_to_implement: |-
-    This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
+how_to_implement: 'This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
+
     and registry modification (EventID 13) events, ensuring that registry modification events are collected for the
+
     PYTHONPATH environment variable(\Environment\PYTHONPATH). Ingest the data via the appropriate Splunk Technology Add-on
-    and normalize field names using the Splunk Common Information Model (CIM).
-known_false_positives: |-
-    Developers and legitimate installers may modify PYTHONPATH as part of normal environment configuration.
-    Investigate the new value and parent process to determine legitimacy.
+
+    and normalize field names using the Splunk Common Information Model (CIM).'
+known_false_positives: 'Developers and legitimate installers may modify PYTHONPATH as part of normal environment configuration.
+
+    Investigate the new value and parent process to determine legitimacy.'
 references:
     - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
 drilldown_searches:
@@ -69,7 +73,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The PYTHONPATH environment variable [$registry_path$] was modified to the value of [$registry_value_data$] on [$dest$] during package installation using [$process$].
     entity:
diff --git a/detections/endpoint/python_site_hooks_creation_during_package_installation.yml b/detections/endpoint/python_site_hooks_creation_during_package_installation.yml
index 43b5a52eafe..d2f58f1cc38 100644
--- a/detections/endpoint/python_site_hooks_creation_during_package_installation.yml
+++ b/detections/endpoint/python_site_hooks_creation_during_package_installation.yml
@@ -6,15 +6,18 @@ modification_date: '2026-08-21'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects the creation of a Python site hook file (`sitecustomize.py` or `usercustomize.py`) within a `site-packages`/`dist-packages` directory in conjunction with a package installation process.
-    Python's `site` module loads these hooks from directories on `sys.path` before Python is executed.
+description: 'The following analytic detects the creation of a Python site hook file (`sitecustomize.py` or `usercustomize.py`) within a `site-packages`/`dist-packages` directory in conjunction with a package installation process.
+
+    Python''s `site` module loads these hooks from directories on `sys.path` before Python is executed.
+
     If an adversary manipulates or plants one of these files, they can hijack the Python environment and execute their payload with every Python invocation, achieving persistence on the victim endpoint.
+
     The VIPERTUNNEL backdoor was reported to abuse site hooks in order to import and trigger DLL execution.
-    If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
+
+    If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.'
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 11
-search: |-
+search: |
     `sysmon`
     EventID IN (1,11)
     (
@@ -52,14 +55,16 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `python_site_hooks_creation_during_package_installation_filter`
-how_to_implement: |-
-    This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
+how_to_implement: 'This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
+
     and file creation (EventID 11) events, ensuring that file creation events are collected for files with the .py
+
     extension. Ingest the data via the appropriate Splunk Technology Add-on and normalize field names using the
-    Splunk Common Information Model (CIM).
-known_false_positives: |-
-    Some legitimate tooling and environment managers create or modify `sitecustomize.py`/`usercustomize.py`
-    as part of normal setup. Investigate the file contents and parent process to determine legitimacy.
+
+    Splunk Common Information Model (CIM).'
+known_false_positives: 'Some legitimate tooling and environment managers create or modify `sitecustomize.py`/`usercustomize.py`
+
+    as part of normal setup. Investigate the file contents and parent process to determine legitimacy.'
 references:
     - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
 drilldown_searches:
@@ -70,7 +75,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Python site hook file [$file_path$] was created on [$dest$] during package installation using [$process$].
     entity:
diff --git a/detections/endpoint/randomly_generated_scheduled_task_name.yml b/detections/endpoint/randomly_generated_scheduled_task_name.yml
index bc858a9d53d..6934b055a6c 100644
--- a/detections/endpoint/randomly_generated_scheduled_task_name.yml
+++ b/detections/endpoint/randomly_generated_scheduled_task_name.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic detects the creation of a Scheduled Task with a high entropy, randomly generated name, leveraging Event ID 4698. It uses the `ut_shannon` function from the URL ToolBox Splunk application to measure the entropy of the Task Name. This activity is significant as adversaries often use randomly named Scheduled Tasks for lateral movement and remote code execution, employing tools like Impacket or CrackMapExec. If confirmed malicious, this could allow attackers to execute arbitrary code remotely, potentially leading to further compromise and persistence within the network.
 data_source:
     - Windows Event Log Security 4698
-search: |-
+search: |
     `wineventlog_security` EventCode=4698
       | xmlkv Message
       | lookup ut_shannon_lookup word as Task_Name
diff --git a/detections/endpoint/randomly_generated_windows_service_name.yml b/detections/endpoint/randomly_generated_windows_service_name.yml
index a62a9ca6123..1a330b9d7e2 100644
--- a/detections/endpoint/randomly_generated_windows_service_name.yml
+++ b/detections/endpoint/randomly_generated_windows_service_name.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic detects the installation of a Windows Service with a suspicious, high-entropy name, indicating potential malicious activity. It leverages Event ID 7045 and the `ut_shannon` function from the URL ToolBox Splunk application to identify services with random names. This behavior is significant as adversaries often use randomly named services for lateral movement and remote code execution. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
 data_source:
     - Windows Event Log System 7045
-search: |-
+search: |
     `wineventlog_system` EventCode=7045
       | lookup ut_shannon_lookup word as Service_Name
       | where ut_shannon > 3
diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml
index 13ed40a2b3c..3d60f39b25e 100644
--- a/detections/endpoint/ransomware_notes_bulk_creation.yml
+++ b/detections/endpoint/ransomware_notes_bulk_creation.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame. This activity is significant as it often indicates an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
 data_source:
     - Sysmon EventID 11
-search: |-
+search: |
     `sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta")
       | bin _time span=10s
       | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) as unique_readme_path_count values(TargetFilename) as list_of_readme_path values(action) as action values(file_access_time) as file_access_time values(file_create_time) as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time values(file_path) as file_path values(file_acl) as file_acl values(file_size) as file_size values(process_guid) as process_guid values(process_id) as process_id values(user) as user values(vendor_product) as vendor_product
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
index ca0a2fe969e..aee26b540da 100644
--- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
+++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects suspicious PowerShell script execution via EventCode 4104, specifically targeting checks for installed anti-virus products using WMI or PowerShell commands. This detection leverages PowerShell Script Block Logging to identify scripts containing keywords like "SELECT," "WMIC," "AntiVirusProduct," or "AntiSpywareProduct." This activity is significant as it is commonly used by malware and APT actors to map running security applications or services, potentially aiding in evasion techniques. If confirmed malicious, this could allow attackers to disable or bypass security measures, leading to further compromise of the endpoint.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText = "*SELECT*" OR ScriptBlockText = "*WMIC*") AND (ScriptBlockText = "*AntiVirusProduct*" OR ScriptBlockText = "*AntiSpywareProduct*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `recon_avproduct_through_pwh_or_wmi_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*SELECT*", "*WMIC*") Processes.process IN ("*AntiVirusProduct*", "*AntiSpywareProduct*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: network administrator may used this command for checking purposes
 references:
@@ -38,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A suspicious powershell script contains AV recon command on host $dest$
     entity:
diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml
index d87ae316176..d3d9670ab24 100644
--- a/detections/endpoint/recon_using_wmi_class.yml
+++ b/detections/endpoint/recon_using_wmi_class.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious PowerShell activity via EventCode 4104, where WMI performs event queries to gather information on running processes or services. This detection leverages PowerShell Script Block Logging to identify specific WMI queries targeting system information classes like Win32_Bios and Win32_OperatingSystem. This activity is significant as it often indicates reconnaissance efforts by an adversary to profile the compromised machine. If confirmed malicious, the attacker could gain detailed system information, aiding in further exploitation or lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: "`powershell` EventCode=4104 AND ScriptBlockText IN (\"*SELECT*\", \"*Get-WmiObject*\") AND ScriptBlockText IN (\"*Win32_Bios*\", \"*Win32_OperatingSystem*\", \"*Win32_Processor*\", \"*Win32_ComputerSystem*\", \"*Win32_PnPEntity*\", \"*Win32_ShadowCopy*\", \"*Win32_DiskDrive*\", \"*Win32_PhysicalMemory*\", \"*Win32_BaseBoard*\", \"*Win32_DisplayConfiguration*\")\n  | fillnull\n  | stats count min(_time) as firstTime max(_time) as lastTime\n    BY dest signature signature_id\n       user_id vendor_product EventID\n       Guid Opcode Name\n       Path ProcessID ScriptBlockId\n       ScriptBlockText\n  | `security_content_ctime(firstTime)`\n  | `security_content_ctime(lastTime)`\n  | `recon_using_wmi_class_filter`"
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*SELECT*", "*Get-WmiObject*") Processes.process IN ("*Win32_Bios*", "*Win32_OperatingSystem*", "*Win32_Processor*", "*Win32_ComputerSystem*", "*Win32_PnPEntity*", "*Win32_ShadowCopy*", "*Win32_DiskDrive*", "*Win32_PhysicalMemory*", "*Win32_BaseBoard*", "*Win32_DisplayConfiguration*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: network administrator may used this command for checking purposes
 references:
diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
index 5e4cd42fb5e..c90707d7e2c 100644
--- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
+++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_cmd` Processes.process=*/c*  Processes.process="* rd *" Processes.process="*/s*" Processes.process="*/q*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `recursive_delete_of_directory_in_batch_cmd_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*cmd.exe" OR Processes.original_file_name="Cmd.Exe" Processes.process="*/c*" Processes.process="* rd *" Processes.process="*/s*" Processes.process="*/q*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network operator may use this batch command to delete recursively a directory or files within directory
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Recursive Delete of Directory In Batch CMD by $user$ on $dest$
     entity:
diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
index a7f3292192e..5005d2a6d6b 100644
--- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
+++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes
-      WHERE (Processes.process_name=reg.exe Processes.process=*reg* Processes.process=*add* Processes.process=*Services*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `reg_exe_manipulating_windows_services_registry_keys_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*reg.exe" Processes.process="*reg*" Processes.process="*add*" Processes.process="*Services*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `reg_exe_manipulating_windows_services_registry_keys_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: It is unusual for a service to be created or modified by directly manipulating the registry. However, there may be legitimate instances of this behavior. It is important to validate and investigate, as appropriate.
 references: []
@@ -36,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A reg.exe process $process_name$ with commandline $process$ in host $dest$
     entity:
diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml
index e4b56f2824e..fa54aba4fb9 100644
--- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml
+++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects registry activity related to the creation of application compatibility shims. It leverages data from the Endpoint.Registry data model, specifically monitoring registry paths associated with AppCompatFlags. This activity is significant because attackers can use shims to bypass security controls, achieve persistence, or escalate privileges. If confirmed malicious, this could allow an attacker to maintain long-term access, execute arbitrary code, or manipulate application behavior, posing a severe risk to the integrity and security of the affected systems.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB*) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_for_creating_shim_databases_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*CurrentVersion\\AppCompatFlags\\Custom*", "*CurrentVersion\\AppCompatFlags\\InstalledSDB*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_for_creating_shim_databases_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A registry activity in $registry_path$ related to shim modication in host $dest$
     entity:
diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml
index 8cd37e1aa5b..b1932e0e721 100644
--- a/detections/endpoint/registry_keys_used_for_persistence.yml
+++ b/detections/endpoint/registry_keys_used_for_persistence.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies modifications to registry keys commonly used for persistence mechanisms. It leverages data from endpoint detection sources like Sysmon or Carbon Black, focusing on specific registry paths known to initiate applications or services during system startup. This activity is significant as unauthorized changes to these keys can indicate attempts to maintain persistence or execute malicious actions upon system boot. If confirmed malicious, this could allow attackers to achieve persistent access, execute arbitrary code, or maintain control over compromised systems, posing a severe threat to system integrity and security.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce OR Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\*" OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\*" OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=*\\SOFTWARE\\Microsoft\\Netsh\\* OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup" OR Registry.registry_path= *\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler OR Registry.registry_path= *\\Classes\\htmlfile\\shell\\open\\command OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_used_for_persistence_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" Registry.registry_key_name="Debugger*") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" Registry.registry_key_name="Security Packages*") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" Registry.registry_key_name="Security Packages*") OR (Registry.registry_path="*currentVersion\\Windows" Registry.registry_key_name="Load*") OR (Registry.registry_path="*\\CurrentVersion" Registry.registry_key_name="Svchost*") OR (Registry.registry_path="*\\CurrentControlSetControlSession Manager" Registry.registry_key_name="BootExecute*") OR (Registry.registry_path="*\\Software\\Run" Registry.registry_key_name="auto_update*") OR Registry.registry_path IN ("*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce", "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run", "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup", "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler", "*\\Classes\\htmlfile\\shell\\open\\command") OR Registry.registry_path IN ("*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\*", "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\*", "*\\currentversion\\run*", "*\\currentVersion\\Windows\\Appinit_Dlls*", "*\\CurrentVersion\\Winlogon\\Shell*", "*\\CurrentVersion\\Winlogon\\Notify*", "*\\CurrentVersion\\Winlogon\\Userinit*", "*\\CurrentVersion\\Winlogon\\VmApplet*", "*\\currentversion\\policies\\explorer\\run*", "*\\currentversion\\runservices*", "*\\SOFTWARE\\Microsoft\\Netsh\\*", "*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_used_for_persistence_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 known_false_positives: There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task.
 references:
diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml
index 10e5ebad02c..267b96752ef 100644
--- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml
+++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to registry keys under "Image File Execution Options" that can be used for privilege escalation. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths and values like GlobalFlag and Debugger. This activity is significant because attackers can use these modifications to intercept executable calls and attach malicious binaries to legitimate system binaries. If confirmed malicious, this could allow attackers to execute arbitrary code with elevated privileges, leading to potential system compromise and persistent access.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger)) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_used_for_privilege_escalation_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" Registry.registry_value_name IN ("*GlobalFlag", "*Debugger") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_used_for_privilege_escalation_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A registry activity in $registry_path$ related to privilege escalation in host $dest$
     entity:
diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
index 87f04574190..d393c7db9b1 100644
--- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
+++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
@@ -11,32 +11,12 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    FROM datamodel=Endpoint.Processes WHERE
-
-    `process_regsvr32`
-    Processes.process  IN ("*/i*", "*-i*")
-    Processes.process  IN ("*/s*", "*-s*")
-    NOT Processes.process="*Microsoft\\TeamsMeetingAddin*"
-
-    BY Processes.action Processes.dest Processes.original_file_name
-        Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-        Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-        Processes.process Processes.process_exec Processes.process_guid
-        Processes.process_hash Processes.process_id Processes.process_integrity_level
-        Processes.process_name Processes.process_path Processes.user
-        Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `regsvr32_silent_and_install_param_dll_loading_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*regsvr32.exe" OR Processes.original_file_name="REGSVR32.EXE" Processes.process IN ("*/i*", "*-i*") Processes.process IN ("*/s*", "*-s*") NOT Processes.process="*Microsoft\\TeamsMeetingAddin*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `regsvr32_silent_and_install_param_dll_loading_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    Other third part application may used this parameter.
-    One identified use case is Microsoft Teams. Apply the necessary filters before using this rule in production.
+known_false_positives: 'Other third part application may used this parameter.
+
+    One identified use case is Microsoft Teams. Apply the necessary filters before using this rule in production.'
 references:
     - https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/
     - https://attack.mitre.org/techniques/T1218/010/
@@ -49,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml
index c0bb3339d8f..573ae7740cc 100644
--- a/detections/endpoint/remcos_client_registry_install_entry.yml
+++ b/detections/endpoint/remcos_client_registry_install_entry.yml
@@ -10,7 +10,8 @@ description: The following analytic detects the presence of a registry key assoc
 data_source:
     - Sysmon EventID 12
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*\\Software\\Remcos*) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`remcos_client_registry_install_entry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Software\\Remcos*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remcos_client_registry_install_entry_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A registry entry $registry_path$ with registry keyname $registry_key_name$ related to Remcos RAT in host $dest$
     entity:
diff --git a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml
index 7e1231bf377..203757cc929 100644
--- a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml
+++ b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation of files in the Remcos folder within the AppData directory, specifically targeting keylog and clipboard log files. It leverages the Endpoint.Filesystem data model to identify .dat files created in paths containing "remcos." This activity is significant as it indicates the presence of the Remcos RAT, which performs keylogging, clipboard capturing, and audio recording. If confirmed malicious, this could lead to unauthorized data exfiltration and extensive surveillance capabilities for the attacker.
 data_source:
     - Sysmon EventID 11
-search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.dat") Filesystem.file_path = "*\\remcos\\*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remcos_rat_file_creation_in_remcos_folder_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.dat" Filesystem.file_path="*\\remcos\\*" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remcos_rat_file_creation_in_remcos_folder_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: file $file_name$ created in $file_path$ of $dest$
     entity:
diff --git a/detections/endpoint/remote_desktop_process_running_on_system.yml b/detections/endpoint/remote_desktop_process_running_on_system.yml
index 1051ae13562..089f52e3d38 100644
--- a/detections/endpoint/remote_desktop_process_running_on_system.yml
+++ b/detections/endpoint/remote_desktop_process_running_on_system.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process=*mstsc.exe
-        AND
-        Processes.dest_category!=common_rdp_source
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `drop_dm_object_name(Processes)`
-    | `remote_desktop_process_running_on_system_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*mstsc.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_desktop_process_running_on_system_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Remote Desktop may be used legitimately by users on the network.
 references: []
diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
index ad61e783859..e78d31aa8a5 100644
--- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_powershell` (Processes.process="*Document.ActiveView.ExecuteShellCommand*"
-        OR
-        Processes.process="*Document.Application.ShellExecute*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `remote_process_instantiation_via_dcom_and_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") Processes.process IN ("*Document.ActiveView.ExecuteShellCommand*", "*Document.Application.ShellExecute*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_process_instantiation_via_dcom_and_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may leverage DCOM to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
 references:
@@ -40,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process was started on a remote endpoint from $dest$ by abusing DCOM using PowerShell.exe
     entity:
diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
index d04129c124b..727a1088644 100644
--- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of PowerShell commands that initiate a process on a remote endpoint via the DCOM protocol. It leverages PowerShell Script Block Logging (EventCode=4104) to identify the use of ShellExecute and ExecuteShellCommand. This activity is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this behavior could allow attackers to execute arbitrary code on remote systems, potentially leading to further compromise and persistence within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText="*Document.Application.ShellExecute*" OR ScriptBlockText="*Document.ActiveView.ExecuteShellCommand*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `remote_process_instantiation_via_dcom_and_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*Document.Application.ShellExecute*", "*Document.ActiveView.ExecuteShellCommand*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_process_instantiation_via_dcom_and_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators may leverage DCOM to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process was started on a remote endpoint from $dest$ by abusing WMI using PowerShell.exe
     entity:
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
index a6530c6b802..ef54f3eff3e 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_powershell` (Processes.process="*Invoke-Command*"
-        AND
-        Processes.process="*-ComputerName*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `remote_process_instantiation_via_winrm_and_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") Processes.process="*Invoke-Command*" Processes.process="*-ComputerName*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start a process on remote systems for system administration or automation use cases. However, this activity is usually limited to a small set of hosts or users.
 references:
@@ -40,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process was started on a remote endpoint from $dest$ by abusing WinRM using PowerShell.exe
     entity:
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
index 68946b0b8f6..4e6d8379b41 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of PowerShell commands that use the `Invoke-Command` cmdlet to start a process on a remote endpoint via the WinRM protocol. It leverages PowerShell Script Block Logging (EventCode=4104) to identify such activities. This behavior is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this activity could allow attackers to execute arbitrary code on remote systems, potentially leading to further compromise and persistence within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText="*Invoke-Command*" AND ScriptBlockText="*-ComputerName*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Invoke-Command*" Processes.process="*-ComputerName*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start a process on remote systems for system administration or automation use cases. This activity is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process was started on a remote endpoint from $dest$ by abusing WinRM using PowerShell.exe
     entity:
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
index 2098d248563..aea18c017de 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=winrs.exe
-            OR
-            Processes.original_file_name=winrs.exe
-        )
-        (Processes.process="*-r:*" OR Processes.process="*-remote:*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `remote_process_instantiation_via_winrm_and_winrs_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*winrs.exe" OR Processes.original_file_name="winrs.exe" Processes.process IN ("*-r:*", "*-remote:*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_winrs_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may leverage WinRM and WinRs to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
 references:
@@ -43,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process was started on a remote endpoint from $dest$
     entity:
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml
index 2f1ac099df1..1c77ba53947 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml
@@ -11,26 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_wmic` (Processes.process="*/node:*"
-        AND
-        Processes.process="*process*"
-        AND
-        Processes.process="*call*"
-        AND
-        Processes.process="*create*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `remote_process_instantiation_via_wmi_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process="*/node:*" Processes.process="*process*" Processes.process="*call*" Processes.process="*create*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: The wmic.exe utility is a benign Windows application. It may be used legitimately by Administrators with these parameters for remote system administration, but it's relatively uncommon.
 references:
@@ -45,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A wmic.exe process $process$ contain process spawn commandline $process$ in host $dest$
     entity:
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
index 39e828d3120..6029b0aa404 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
@@ -11,26 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_powershell` (Processes.process="*Invoke-WmiMethod*"
-        AND
-        Processes.process="*-CN*"
-        AND
-        Processes.process="*-Class Win32_Process*"
-        AND
-        Processes.process="*-Name create*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `remote_process_instantiation_via_wmi_and_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") Processes.process="*Invoke-WmiMethod*" Processes.process="*-CN*" Processes.process="*-Class Win32_Process*" Processes.process="*-Name create*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_and_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may leverage WWMI and powershell.exe to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
 references:
@@ -44,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process was started on a remote endpoint from $dest$ by abusing WMI using PowerShell.exe
     entity:
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
index 75fe38b6c0b..036ffb63964 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Invoke-WmiMethod` commandlet with parameters used to start a process on a remote endpoint via WMI, leveraging PowerShell Script Block Logging (EventCode=4104). This method identifies specific script block text patterns associated with remote process instantiation. This activity is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this could allow attackers to execute arbitrary code on remote systems, potentially leading to further compromise and persistence within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText="*Invoke-WmiMethod*" AND (ScriptBlockText="*-CN*" OR ScriptBlockText="*-ComputerName*") AND ScriptBlockText="*-Class Win32_Process*" AND ScriptBlockText="*-Name create*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Invoke-WmiMethod*" Processes.process IN ("*-CN*", "*-ComputerName*") Processes.process="*-Class Win32_Process*" Processes.process="*-Name create*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators may leverage WWMI and powershell.exe to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process was started on a remote endpoint from $dest$ by abusing WMI using PowerShell.exe
     entity:
diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
index ee8f9d31a3f..7e39e5a6061 100644
--- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
+++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
@@ -9,17 +9,8 @@ type: TTP
 description: The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell scripts to query Active Directory for domain computers. It leverages PowerShell Script Block Logging (EventCode=4104) to identify specific script blocks containing `adsisearcher` and `objectcategory=computer` with methods like `findAll()` or `findOne()`. This activity is significant as it may indicate an attempt by adversaries or Red Teams to perform Active Directory discovery and gain situational awareness. If confirmed malicious, this could lead to further reconnaissance and potential lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*adsisearcher*" AND ScriptBlockText = "*objectcategory=computer*" AND ScriptBlockText IN ("*findAll()*","*findOne()*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `remote_system_discovery_with_adsisearcher_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*adsisearcher*" Processes.process="*objectcategory=computer*" Processes.process IN ("*findAll()*", "*findOne()*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_adsisearcher_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use Adsisearcher for troubleshooting.
 references:
@@ -34,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Remote system discovery enumeration with adsisearcher on $dest$ by $user_id$
     entity:
diff --git a/detections/endpoint/remote_system_discovery_with_dsquery.yml b/detections/endpoint/remote_system_discovery_with_dsquery.yml
index 5c1b1b8e529..b40a99e2dea 100644
--- a/detections/endpoint/remote_system_discovery_with_dsquery.yml
+++ b/detections/endpoint/remote_system_discovery_with_dsquery.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="dsquery.exe"
-        )
-        (Processes.process="*computer*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `remote_system_discovery_with_dsquery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*dsquery.exe" Processes.process="*computer*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_dsquery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -41,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/remote_system_discovery_with_wmic.yml b/detections/endpoint/remote_system_discovery_with_wmic.yml
index 15a98fda08e..831e0339844 100644
--- a/detections/endpoint/remote_system_discovery_with_wmic.yml
+++ b/detections/endpoint/remote_system_discovery_with_wmic.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap* AND Processes.process=*ds_computer* AND Processes.process="*GET ds_samaccountname*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_wmic_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" Processes.process="*/NAMESPACE:\\\\root\\directory\\ldap*" Processes.process="*ds_computer*" Processes.process="*GET ds_samaccountname*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_wmic_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Remote system discovery enumeration on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml
index b7f9a718a63..00fe9b77740 100644
--- a/detections/endpoint/remote_wmi_command_attempt.yml
+++ b/detections/endpoint/remote_wmi_command_attempt.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_wmic` Processes.process=*node*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `remote_wmi_command_attempt_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process="*node*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_wmi_command_attempt_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may use this legitimately to gather info from remote systems. Filter as needed.
 references:
@@ -40,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A wmic.exe process $process$ contain node commandline $process$ in host $dest$
     entity:
diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml
index f0450790d44..76e4fb24778 100644
--- a/detections/endpoint/resize_shadowstorage_volume.yml
+++ b/detections/endpoint/resize_shadowstorage_volume.yml
@@ -11,26 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) as process_name min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name = "cmd.exe"
-        OR
-        Processes.parent_process_name = "powershell.exe"
-        OR
-        Processes.parent_process_name = "powershell_ise.exe"
-        OR
-        Processes.parent_process_name =  "wmic.exe" Processes.process_name = "vssadmin.exe" Processes.process="*resize*" Processes.process="*shadowstorage*" Processes.process="*/maxsize*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `resize_shadowstorage_volume_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.parent_process_name="*wmic.exe" Processes.process_name="*vssadmin.exe" Processes.process="*resize*" Processes.process="*shadowstorage*" Processes.process="*/maxsize*") OR Processes.parent_process_name IN ("*cmd.exe", "*powershell.exe", "*powershell_ise.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `resize_shadowstorage_volume_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network admin can resize the shadowstorage for valid purposes.
 references:
@@ -48,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process $parent_process_name$ attempted to resize shadow copy with commandline $process$ in host $dest$
     entity:
diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml
index d59e7766660..efddf3e03a4 100644
--- a/detections/endpoint/revil_common_exec_parameter.yml
+++ b/detections/endpoint/revil_common_exec_parameter.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process = "* -nolan *"
-        OR
-        Processes.process = "* -nolocal *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `revil_common_exec_parameter_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("* -nolan *", "* -nolocal *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `revil_common_exec_parameter_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: third party tool may have same command line parameters as revil ransomware.
 references:
@@ -40,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process $process_name$ with commandline $process$ related to revil ransomware in host $dest$
     entity:
diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml
index cc87dc05554..b50cd61eb31 100644
--- a/detections/endpoint/revil_registry_entry.yml
+++ b/detections/endpoint/revil_registry_entry.yml
@@ -10,7 +10,8 @@ description: The following analytic identifies suspicious modifications in the r
 data_source:
     - Sysmon EventID 12
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `revil_registry_entry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*", "*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.status Registry.user Registry.vendor_product Registry.registry_value_name | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `revil_registry_entry_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A registry entry $registry_path$ with registry value $registry_value_name$ and $registry_value_name$ related to revil ransomware in host $dest$
     entity:
diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml
index ee215e29238..6aba716cbff 100644
--- a/detections/endpoint/rubeus_command_line_parameters.yml
+++ b/detections/endpoint/rubeus_command_line_parameters.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*" OR Processes.process = "* monitor /interval*" OR Processes.process ="* asktgt* /user:*" OR Processes.process ="* asktgs* /service:*" OR Processes.process ="* golden* /user:*" OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*" OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*" OR Processes.process = "* brute* /password:*" OR Processes.process = "* brute* /passwords:*" OR Processes.process ="* harvest*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rubeus_command_line_parameters_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*ptt /ticket*", "* monitor /interval*", "* asktgt* /user:*", "* asktgs* /service:*", "* golden* /user:*", "* silver* /service:*", "* kerberoast*", "* asreproast*", "* renew* /ticket:*", "* brute* /password:*", "* brute* /passwords:*", "* harvest*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rubeus_command_line_parameters_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, legitimate applications may use the same command line parameters as Rubeus. Filter as needed.
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Rubeus command line parameters were used on $dest$
     entity:
diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
index 28850f03f50..47799d133a7 100644
--- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
+++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
@@ -6,12 +6,12 @@ modification_date: '2026-09-08'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects an uncommon process requesting full access rights to winlogon.exe, which may indicate Rubeus exporting Kerberos tickets from memory.
-    It leverages Sysmon EventCode 10 and checks for full-access rights, specifically the value 0x1f3fff.
+description: 'The following analytic detects an uncommon process requesting full access rights to winlogon.exe, which may indicate Rubeus exporting Kerberos tickets from memory.
+
+    It leverages Sysmon EventCode 10 and checks for full-access rights, specifically the value 0x1f3fff.'
 data_source:
     - Sysmon EventID 10
-search: |-
+search: |
     `sysmon`
     EventCode=10
     TargetImage="*:\\Windows\\system32\\winlogon.exe"
@@ -45,10 +45,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`
-how_to_implement: |-
-    This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment.
-known_false_positives: |-
-    No false positives have been identified at this time.
+how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment.
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://github.com/GhostPack/Rubeus
     - https://web.archive.org/web/20210725005734/http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
@@ -61,7 +59,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The process [$SourceImage$] requested full access via the access mask [$granted_access$] to [$TargetImage$] on [$dest$].
     entity:
diff --git a/detections/endpoint/runas_execution_in_commandline.yml b/detections/endpoint/runas_execution_in_commandline.yml
index 4284d5a40f5..8939ce294d1 100644
--- a/detections/endpoint/runas_execution_in_commandline.yml
+++ b/detections/endpoint/runas_execution_in_commandline.yml
@@ -12,21 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    (Processes.process_name="runas.exe" OR Processes.original_file_name="runas.exe")
-    Processes.process ="*/user:*"
-    Processes.process = "*admin*"
-    by Processes.action Processes.dest
-       Processes.original_file_name Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
-       Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `runas_execution_in_commandline_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*runas.exe" OR Processes.original_file_name="runas.exe" Processes.process="*/user:*" Processes.process="*admin*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `runas_execution_in_commandline_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: A network operator or systems administrator may utilize an automated or manual execute this command that may generate false positives. filter is needed.
 references:
diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml
index 253a86ce924..91c40edb672 100644
--- a/detections/endpoint/rundll32_control_rundll_hunt.yml
+++ b/detections/endpoint/rundll32_control_rundll_hunt.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_rundll32` Processes.process=*Control_RunDLL*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `rundll32_control_rundll_hunt_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" Processes.process="*Control_RunDLL*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_control_rundll_hunt_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: This is a hunting detection, meant to provide a understanding of how voluminous control_rundll is within the environment.
 references:
diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
index 04f3cc740b6..5ee06c781f1 100644
--- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
+++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*Control_RunDLL* AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_control_rundll_world_writable_directory_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" Processes.process="*Control_RunDLL*" Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_control_rundll_world_writable_directory_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: This may be tuned, or a new one related, by adding .cpl to command-line. However, it's important to look for both. Tune/filter as needed.
 references:
@@ -29,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
     entity:
diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml
index 91c7b8484b3..51be1d7a2e7 100644
--- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml
+++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml
@@ -6,28 +6,15 @@ modification_date: '2026-06-29'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects the creation of a remote thread by rundll32.exe into another process. It leverages Sysmon EventCode 8 logs, specifically monitoring SourceImage and TargetImage fields.
+description: 'The following analytic detects the creation of a remote thread by rundll32.exe into another process. It leverages Sysmon EventCode 8 logs, specifically monitoring SourceImage and TargetImage fields.
+
     This activity is significant as it is a common technique used by malware, such as IcedID, to execute malicious code within legitimate processes, aiding in defense evasion and data theft.
-    If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, and exfiltrate sensitive information from the compromised host.
+
+    If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, and exfiltrate sensitive information from the compromised host.'
 data_source:
     - Sysmon EventID 8
-search: |-
-    `sysmon`
-    EventCode=8
-    SourceImage="*\\rundll32.exe"
-    TargetImage = "*.exe"
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-                  values(NewThreadId) as "NewThreadId"
-                  values(StartAddress) as "StartAddress"
-      by dest signature_id signature
-         SourceProcessGuid SourceProcessId SourceImage
-         TargetProcessGuid TargetProcessId TargetImage
-         StartModule StartFunction vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `rundll32_create_remote_thread_to_a_process_filter`
+search: |
+    `sysmon` EventCode=8 SourceImage="*\\rundll32.exe" TargetImage="*.exe" | stats count min(_time) as firstTime max(_time) as lastTime by dest signature_id signature SourceProcessGuid SourceProcessId SourceImage TargetProcessGuid TargetProcessId TargetImage StartModule StartFunction SourceUser TargetUser vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_create_remote_thread_to_a_process_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -40,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ in host $dest$
     entity:
diff --git a/detections/endpoint/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml
index 8e39050608c..fe3625cc0bc 100644
--- a/detections/endpoint/rundll32_lockworkstation.yml
+++ b/detections/endpoint/rundll32_lockworkstation.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=rundll32.exe Processes.process= "*user32.dll,LockWorkStation*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `rundll32_lockworkstation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" Processes.process="*user32.dll,LockWorkStation*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_lockworkstation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml
index b387f7a1bff..32f0f10e487 100644
--- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml
+++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic detects a rundll32 process creating executable (.exe) or dynamic link library (.dll) files. It leverages Sysmon EventCode 11 to identify instances where rundll32.exe generates these file types. This activity is significant because rundll32 is often exploited by malware, such as IcedID, to drop malicious payloads in directories like Temp, AppData, or ProgramData. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, establish persistence, or escalate privileges within the environment.
 data_source:
     - Sysmon EventID 11
-search: |-
-    `sysmon` EventCode=11 Image="*rundll32.exe" TargetFilename IN ("*.exe", "*.dll")
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY action dest file_name
-           file_path process_guid process_id
-           user_id vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `rundll32_process_creating_exe_dll_files_filter`
+search: |
+    `sysmon` EventCode=11 Image="*rundll32.exe" TargetFilename IN ("*.exe", "*.dll") | eval process_name=process_name, root_drive=root_drive | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name file_path process_guid process_id user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_process_creating_exe_dll_files_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, TargetFilename, and eventcode 11 executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -30,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: rundll32 process drops a file $file_name$ on host $dest$
     entity:
diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml
index fd17b068aa6..4fd774e25d3 100644
--- a/detections/endpoint/rundll32_shimcache_flush.yml
+++ b/detections/endpoint/rundll32_shimcache_flush.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_rundll32`
-        AND
-        Processes.process = "*apphelp.dll,ShimFlushCache*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `rundll32_shimcache_flush_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" Processes.process="*apphelp.dll,ShimFlushCache*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_shimcache_flush_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -39,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: rundll32 process execute $process$ to clear shim cache on $dest$
     entity:
diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
index 4c3d07c570b..41336bd8837 100644
--- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
+++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
@@ -56,7 +56,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $src$
     entity:
diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
index cf0aed06433..d03e1a3d305 100644
--- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml
+++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
@@ -11,21 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_rundll32`
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | where match(process,"rundll32.+\#\d+")
-    | `rundll_loading_dll_by_ordinal_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll_loading_dll_by_ordinal_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives are possible with native utilities and third party applications. Filtering may be needed based on command-line, or add world writeable paths to restrict query.
 references:
@@ -41,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ on host $dest$.
     entity:
diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml
index fdc14975db4..fb648a23007 100644
--- a/detections/endpoint/ryuk_test_files_detected.yml
+++ b/detections/endpoint/ryuk_test_files_detected.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies the presence of files containing the keyword "Ryuk" in any folder on the C drive, indicative of Ryuk ransomware activity. It leverages the Endpoint Filesystem data model to detect file paths matching this pattern. This activity is significant as Ryuk ransomware is known for its destructive impact, encrypting critical files and demanding ransom. If confirmed malicious, this could lead to significant data loss, operational disruption, and financial damage due to ransom payments and recovery efforts. Immediate investigation and response are crucial to mitigate potential damage.
 data_source:
     - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem WHERE "Filesystem.file_path"=C:\\*Ryuk* by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ryuk_test_files_detected_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem WHERE "Filesystem.file_path"=C:\\*Ryuk* by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ryuk_test_files_detected_filter`
 how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint Filesystem data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
 known_false_positives: If there are files with this keywoord as file names it might trigger false possitives, please make use of our filters to tune out potential FPs.
 references: []
@@ -21,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A creation of ryuk test file $file_path$ in host $dest$
     entity:
diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml
index 49471c50133..3bcd3c4f992 100644
--- a/detections/endpoint/ryuk_wake_on_lan_command.yml
+++ b/detections/endpoint/ryuk_wake_on_lan_command.yml
@@ -11,33 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    Processes.process IN (
-        "* 8 LAN",
-        "* 8 LAN *",
-        "* 9 REP",
-        "* 9 REP *"
-    )
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `ryuk_wake_on_lan_command_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("* 8 LAN", "* 8 LAN ", "* 9 REP", "* 9 REP ") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ryuk_wake_on_lan_command_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited to no known false positives.
 references:
@@ -52,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process $process_name$ with wake on LAN commandline $process$ on host $dest$
     entity:
diff --git a/detections/endpoint/sam_database_file_access_attempt.yml b/detections/endpoint/sam_database_file_access_attempt.yml
index e114971cc9c..49c209361d2 100644
--- a/detections/endpoint/sam_database_file_access_attempt.yml
+++ b/detections/endpoint/sam_database_file_access_attempt.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects attempts to access the SAM, SYSTEM, or SECURITY database files within the `windows\system32\config` directory using Windows Security EventCode 4663. This detection leverages Windows Security Event logs to identify unauthorized access attempts. Monitoring this activity is crucial as it indicates potential credential access attempts, possibly exploiting vulnerabilities like CVE-2021-36934. If confirmed malicious, an attacker could extract user passwords, leading to unauthorized access, privilege escalation, and further compromise of the system.
 data_source:
     - Windows Event Log Security 4663
-search: '`wineventlog_security` (EventCode=4663)  ProcessName!=*\\dllhost.exe ObjectName IN ("*\\Windows\\System32\\config\\SAM*","*\\Windows\\System32\\config\\SYSTEM*","*\\Windows\\System32\\config\\SECURITY*") | stats values(AccessList) count by ProcessName ObjectName dest src_user | rename ProcessName as process_name | `sam_database_file_access_attempt_filter`'
+search: |
+    `wineventlog_security` EventCode=4663 NOT ProcessName="*\\dllhost.exe" ObjectName="*\\system32\\*" | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sam_database_file_access_attempt_filter`
 how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
 known_false_positives: Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`.
 references:
diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml
index 9e4c86ec994..d5d8227f330 100644
--- a/detections/endpoint/samsam_test_file_write.yml
+++ b/detections/endpoint/samsam_test_file_write.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation of a file named "test.txt" within the Windows system directory, indicative of Samsam ransomware propagation. It leverages file-system activity data from the Endpoint data model, specifically monitoring file paths within the Windows System32 directory. This activity is significant as it aligns with known Samsam ransomware behavior, which uses such files for propagation and execution. If confirmed malicious, this could lead to ransomware deployment, resulting in data encryption, system disruption, and potential data loss. Immediate investigation and remediation are crucial to prevent further damage.
 data_source:
     - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name from datamodel=Endpoint.Filesystem where Filesystem.file_path=*\\windows\\system32\\test.txt by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `samsam_test_file_write_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\windows\\system32\\test.txt" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `samsam_test_file_write_filter`
 how_to_implement: You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
 known_false_positives: No false positives have been identified.
 references: []
@@ -21,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A samsam ransomware test file creation in $file_path$ in host $dest$
     entity:
diff --git a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
index 2be81a5eaa8..8bc6a9e7510 100644
--- a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
+++ b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
@@ -9,15 +9,8 @@ type: Anomaly
 description: The following analytic detects an application attempting to connect and create an ADSI object to perform an LDAP query. It leverages Sysmon EventCode 11 to identify changes in the Active Directory Schema cache files located in %LOCALAPPDATA%\Microsoft\Windows\SchCache or %systemroot%\SchCache. This activity is significant as it can indicate the presence of suspicious applications, such as ransomware, using ADSI object APIs for LDAP queries. If confirmed malicious, this behavior could allow attackers to gather sensitive directory information, potentially leading to further exploitation or lateral movement within the network.
 data_source:
     - Sysmon EventID 11
-search: |-
-    `sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename
-        = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe"))
-    | stats count min(_time)
-        as firstTime max(_time) as lastTime by action dest file_name file_path process_guid
-        process_id user_id vendor_product process_name
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `schcache_change_by_app_connect_and_create_adsi_object_filter`
+search: |
+    `sysmon` EventCode=11 TargetFilename="*\\Windows\\SchCache\\*" TargetFilename="*.sch*" NOT Image="*\\Windows\\system32\\mmc.exe" | eval process_name=process_name, root_drive=root_drive | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name file_path process_guid process_id user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schcache_change_by_app_connect_and_create_adsi_object_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: normal application like mmc.exe and other ldap query tool may trigger this detections.
 references:
@@ -31,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/schedule_task_with_http_command_arguments.yml b/detections/endpoint/schedule_task_with_http_command_arguments.yml
index 69380e365ef..9928bd58f15 100644
--- a/detections/endpoint/schedule_task_with_http_command_arguments.yml
+++ b/detections/endpoint/schedule_task_with_http_command_arguments.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the creation of scheduled tasks on Windows systems that include HTTP command arguments, using Windows Security EventCode 4698. It identifies tasks registered via schtasks.exe or TaskService with HTTP in their command arguments. This behavior is significant as it often indicates malware activity or the use of Living off the Land binaries (lolbins) to download additional payloads. If confirmed malicious, this activity could lead to data exfiltration, malware propagation, or unauthorized access to sensitive information, necessitating immediate investigation and mitigation.
 data_source:
     - Windows Event Log Security 4698
-search: |-
+search: |
     `wineventlog_security` EventCode=4698
       | xmlkv Message
       | search Arguments IN ("*http*")
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A scheduled task process commandline arguments $Arguments$ with http string in it on host $dest$
     entity:
diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml
index 7ed4a9829ac..428bd3a43be 100644
--- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml
+++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the creation of scheduled tasks in Windows that use the rundll32 command. It leverages Windows Security EventCode 4698, which logs the creation of scheduled tasks, and filters for tasks executed via rundll32. This activity is significant as it is a common technique used by malware, such as TrickBot, to persist in an environment or deliver additional payloads. If confirmed malicious, this could lead to data theft, ransomware deployment, or other damaging outcomes. Immediate investigation and mitigation are crucial to prevent further compromise.
 data_source:
     - Windows Event Log Security 4698
-search: |-
+search: |
     `wineventlog_security` EventCode=4698
       | xmlkv Message
       | search Command IN ("*rundll32*")
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A scheduled task process commandline rundll32 arguments $Arguments$ on host $dest$
     entity:
diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
index 7a51902afd1..e91a6fc13dc 100644
--- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
+++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=at.exe OR Processes.original_file_name=at.exe) (Processes.process=*\\\\*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_creation_on_remote_endpoint_using_at_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*at.exe" OR Processes.original_file_name="at.exe" Processes.process="*\\\\*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `scheduled_task_creation_on_remote_endpoint_using_at_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may create scheduled tasks on remote systems, but this activity is usually limited to a small set of hosts or users.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Windows Scheduled Task was created on a remote endpoint from $dest$
     entity:
diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
index 94b93cb98e9..78ab5f5994f 100644
--- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
+++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
@@ -12,49 +12,11 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-        count
-        min(_time) as firstTime
-        max(_time) as lastTime
-    FROM datamodel=Endpoint.Processes WHERE
-
-    Processes.parent_process_name="cmd.exe"
-    Processes.process_name="schtasks.exe"
-    Processes.process IN (
-        "*/create*",
-        "*-create*",
-        "*/delete*",
-        "*-delete*"
-    )
-    NOT Processes.process IN (
-        "* \"C:\\Program Files (x86)\\*",
-        "* \"C:\\Program Files\\*",
-        "* \"C:\\Windows\\System32\\*",
-        "* \"C:\\Windows\\SysWOW64\\*",
-        "* C:\\Program Files (x86)\\*",
-        "* C:\\Program Files\\*",
-        "* C:\\Windows\\System32\\*",
-        "* C:\\Windows\\SysWOW64\\*"
-    )
-    NOT Processes.user="*$"
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `scheduled_task_deleted_or_created_via_cmd_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*cmd.exe" Processes.process_name="*schtasks.exe" Processes.process IN ("*/create*", "*-create*", "*/delete*", "*-delete*") NOT (Processes.process IN ("* \"C:\\Program Files (x86)\\*", "* \"C:\\Program Files\\*", "*\\system32\\*", "*\\syswow64\\*", "* C:\\Program Files (x86)\\*", "* C:\\Program Files\\*")) NOT Processes.user="*$" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `scheduled_task_deleted_or_created_via_cmd_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    While it is possible for legitimate scripts or administrators to trigger this behavior, filtering can be applied based on the parent process and application to reduce false positives.
-    Analysts should reference the provided references to understand the context and threat landscape associated with this activity.
+known_false_positives: 'While it is possible for legitimate scripts or administrators to trigger this behavior, filtering can be applied based on the parent process and application to reduce false positives.
+
+    Analysts should reference the provided references to understand the context and threat landscape associated with this activity.'
 references:
     - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
     - https://www.joesandbox.com/analysis/691823/0/html
@@ -69,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
index 4a5ca53c4f1..25acc0a480c 100644
--- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
+++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=schtasks.exe
-            OR
-            Processes.original_file_name=schtasks.exe
-        )
-        (Processes.process= "* /S *" AND Processes.process=*/run*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `scheduled_task_initiation_on_remote_endpoint_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*schtasks.exe" OR Processes.original_file_name="schtasks.exe" Processes.process="* /S *" Processes.process="*/run*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `scheduled_task_initiation_on_remote_endpoint_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may start scheduled tasks on remote systems, but this activity is usually limited to a small set of hosts or users.
 references:
@@ -44,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Windows Scheduled Task was ran on a remote endpoint from $dest$
     entity:
diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml
index ebb0994fbfa..080f58d235a 100644
--- a/detections/endpoint/schtasks_run_task_on_demand.yml
+++ b/detections/endpoint/schtasks_run_task_on_demand.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "schtasks.exe" Processes.process = "*/run*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `schtasks_run_task_on_demand_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*schtasks.exe" Processes.process="*/run*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schtasks_run_task_on_demand_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Bear in mind, administrators debugging Scheduled Task entries may trigger this analytic, necessitating fine-tuning and filtering to distinguish between legitimate and potentially malicious use of 'schtasks.exe'.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
index e8269ce2321..83f751ecb4e 100644
--- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
+++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name = schtasks.exe
-            OR
-            Processes.original_file_name=schtasks.exe
-        )
-        (Processes.process="*/create*" AND Processes.process="*/s *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `schtasks_scheduling_job_on_remote_system_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*schtasks.exe" OR Processes.original_file_name="schtasks.exe" Processes.process="*/create*" Processes.process="*/s *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schtasks_scheduling_job_on_remote_system_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: While it is possible to have false positives, due to legitimate administrative tasks, these are usually limited and should still be validated and investigated as appropriate.
 references:
@@ -42,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A scheduled task process $process_name$ with remote job command-line $process$ on host $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
index af1f245fd1c..27c12960e06 100644
--- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
+++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `schtasks_used_for_forcing_a_reboot_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*schtasks.exe" Processes.process="*shutdown*" Processes.process="*/create *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schtasks_used_for_forcing_a_reboot_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: This analytic may also capture legitimate administrative activities such as system updates or maintenance tasks, which can be classified as false positives. Filter as needed.
 references: []
@@ -36,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A schedule task process $process_name$ with force reboot commandline $process$ in host $dest$
     entity:
diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml
index 42f9c090b2d..475c22a1a06 100644
--- a/detections/endpoint/screensaver_event_trigger_execution.yml
+++ b/detections/endpoint/screensaver_event_trigger_execution.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the SCRNSAVE.EXE registry entry, indicating potential event trigger execution via screensaver settings for persistence or privilege escalation. It leverages registry activity data from the Endpoint data model to identify changes to the specified registry path. This activity is significant as it is a known technique used by APT groups and malware to maintain persistence or escalate privileges. If confirmed malicious, this could allow an attacker to execute arbitrary code with elevated privileges, leading to further system compromise and persistent access.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control Panel\\Desktop\\SCRNSAVE.EXE*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `screensaver_event_trigger_execution_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control Panel\\Desktop\\SCRNSAVE.EXE*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `screensaver_event_trigger_execution_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Registry path $registry_path$ was modified, added, or deleted on $dest$.
     entity:
diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml
index 8ba9a4a1763..4be8c7aef45 100644
--- a/detections/endpoint/script_execution_via_wmi.yml
+++ b/detections/endpoint/script_execution_via_wmi.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=scrcons.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `script_execution_via_wmi_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*scrcons.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `script_execution_via_wmi_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, administrators may use wmi to launch scripts for legitimate purposes. Filter as needed.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A wmic.exe process $process_name$ that execute script in host $dest$
     entity:
diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml
index 4b6342b5a76..701ee6c08c6 100644
--- a/detections/endpoint/sdclt_uac_bypass.yml
+++ b/detections/endpoint/sdclt_uac_bypass.yml
@@ -10,7 +10,8 @@ description: The following analytic detects suspicious modifications to the sdcl
 data_source:
     - Sysmon EventID 12
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "IsolatedCommand")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdclt_uac_bypass_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Windows\\CurrentVersion\\App Paths\\control.exe*", "*\\exefile\\shell\\runas\\command\\*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.status Registry.user Registry.vendor_product Registry.registry_value_name | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdclt_uac_bypass_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited to no false positives are expected.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ on $dest$
     entity:
diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml
index ccba441d498..92cec2f41ce 100644
--- a/detections/endpoint/sdelete_application_execution.yml
+++ b/detections/endpoint/sdelete_application_execution.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="sdelete.exe"
-            OR
-            Processes.original_file_name="sdelete.exe"
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `sdelete_application_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sdelete.exe" OR Processes.original_file_name="sdelete.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdelete_application_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: user may execute and use this application
 references:
@@ -41,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: sdelete process $process_name$ executed on $dest$
     entity:
diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
index e84d91f6853..3a061718b03 100644
--- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
+++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
@@ -58,7 +58,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A searchprotocolhost.exe process $process_name$ with no commandline on host $dest$
     entity:
diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml
index f8eb25914ac..9664dcf7b8a 100644
--- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml
+++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml
@@ -11,26 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "python*.exe" Processes.process = "*.py*" Processes.process = "*-ntds*" (Processes.process = "*-system*"
-        OR
-        Processes.process = "*-sam*"
-        OR
-        Processes.process = "*-security*"
-        OR
-        Processes.process = "*-bootkey*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `secretdumps_offline_ntds_dumping_tool_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="python*.exe" Processes.process="*.py*" Processes.process="*-ntds*" Processes.process IN ("*-system*", "*-sam*", "*-security*", "*-bootkey*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `secretdumps_offline_ntds_dumping_tool_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -43,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A secretdump process $process_name$ with secretdump commandline $process$ to dump credentials on host $dest$
     entity:
diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
index 92e59eac2db..55a689136f0 100644
--- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
+++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the use of `powershell.exe` to query the domain for Service Principal Names (SPNs) using Script Block Logging EventCode 4104. It identifies the use of the KerberosRequestorSecurityToken class within the script block, which is equivalent to using setspn.exe. This activity is significant as it often precedes kerberoasting or silver ticket attacks, which can lead to credential theft. If confirmed malicious, attackers could leverage this information to escalate privileges or persist within the environment.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText="*KerberosRequestorSecurityToken*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `serviceprincipalnames_discovery_with_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*KerberosRequestorSecurityToken*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `serviceprincipalnames_discovery_with_powershell_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: False positives should be limited, however filter as needed.
 references:
@@ -46,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_id$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of attempting to identify service principle detected on $dest$ names.
     entity:
diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
index 90b3694e8c4..c58b211f93f 100644
--- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
+++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
@@ -11,30 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_setspn` (Processes.process="*-t*"
-        AND
-        Processes.process="*-f*")
-        OR
-        (Processes.process="*-q*"
-        AND
-        Processes.process="**/**")
-        OR
-        (Processes.process="*-q*")
-        OR
-        (Processes.process="*-s*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `serviceprincipalnames_discovery_with_setspn_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.process_name="*setspn.exe" OR Processes.original_file_name="setspn.exe" Processes.process="*-t*" Processes.process="*-f*") OR (Processes.process="*-q*" Processes.process="*/*") OR Processes.process IN ("*-q*", "*-s*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `serviceprincipalnames_discovery_with_setspn_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be caused by Administrators resetting SPNs or querying for SPNs. Filter as needed.
 references:
@@ -56,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principal names.
     entity:
diff --git a/detections/endpoint/services_escalate_exe.yml b/detections/endpoint/services_escalate_exe.yml
index 8bcc90cdcf0..b729feef0ad 100644
--- a/detections/endpoint/services_escalate_exe.yml
+++ b/detections/endpoint/services_escalate_exe.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=services.exe Processes.process_path=*admin$*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `services_escalate_exe_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*services.exe" Processes.process_path="*admin$*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `services_escalate_exe_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited as `services.exe` should never spawn a process from `ADMIN$`. Filter as needed.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A service process $parent_process_name$ with process path $process_path$ on host $dest$
     entity:
diff --git a/detections/endpoint/services_lolbas_execution_process_spawn.yml b/detections/endpoint/services_lolbas_execution_process_spawn.yml
index e35c46451e3..755de54bfe9 100644
--- a/detections/endpoint/services_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/services_lolbas_execution_process_spawn.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.parent_process_name=services.exe
-        )
-        (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe"))
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `services_lolbas_execution_process_spawn_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*services.exe" Processes.process_name IN ("*Regsvcs.exe", "*Ftp.exe", "*OfflineScannerShell.exe", "*Rasautou.exe", "*Schtasks.exe", "*Xwizard.exe", "*Dllhost.exe", "*Pnputil.exe", "*Atbroker.exe", "*Pcwrun.exe", "*Ttdinject.exe", "*Mshta.exe", "*Bitsadmin.exe", "*Certoc.exe", "*Ieexec.exe", "*Microsoft.Workflow.Compiler.exe", "*Runscripthelper.exe", "*Forfiles.exe", "*Msbuild.exe", "*Register-cimprovider.exe", "*Tttracer.exe", "*Ie4uinit.exe", "*Bash.exe", "*Hh.exe", "*SettingSyncHost.exe", "*Cmstp.exe", "*Mmc.exe", "*Stordiag.exe", "*Scriptrunner.exe", "*Odbcconf.exe", "*Extexport.exe", "*Msdt.exe", "*WorkFolders.exe", "*Diskshadow.exe", "*Mavinject.exe", "*Regasm.exe", "*Gpscript.exe", "*Rundll32.exe", "*Regsvr32.exe", "*Msiexec.exe", "*Wuauclt.exe", "*Presentationhost.exe", "*Wmic.exe", "*Runonce.exe", "*Syncappvpublishingserver.exe", "*Verclsid.exe", "*Infdefaultinstall.exe", "*Explorer.exe", "*Installutil.exe", "*Netsh.exe", "*Wab.exe", "*Dnscmd.exe", "*At.exe", "*Pcalua.exe", "*Msconfig.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `services_lolbas_execution_process_spawn_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate applications may trigger this behavior, filter as needed.
 references:
@@ -42,9 +27,9 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
-    title: "Services.exe spawned LOLBAS: $process_name$ located in $process_path$ on $dest$"
+    title: 'Services.exe spawned LOLBAS: $process_name$ located in $process_path$ on $dest$'
     entity:
         field: dest
         type: system
diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
index 41fe0969e96..7036c343d04 100644
--- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
+++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects changes to the PowerShell ExecutionPolicy in the registry to "Unrestricted" or "Bypass." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry modifications under the path *Software\Microsoft\Powershell\1\ShellIds\Microsoft.PowerShell*. This activity is significant because setting the ExecutionPolicy to these values can allow the execution of potentially malicious scripts without restriction. If confirmed malicious, this could enable an attacker to execute arbitrary code, leading to further compromise of the system and potential escalation of privileges.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted OR Registry.registry_value_data=Bypass)) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell*" Registry.registry_value_name="*ExecutionPolicy" Registry.registry_value_data IN ("Unrestricted", "Bypass") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may attempt to change the default execution policy on a system for a variety of reasons. However, setting the policy to "unrestricted" or "bypass" as this search is designed to identify, would be unusual. Hits should be reviewed and investigated as appropriate.
 references: []
@@ -21,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A registry modification in $registry_path$ with reg key $registry_key_name$ and reg value $registry_value_name$ in host $dest$
     entity:
diff --git a/detections/endpoint/shai_hulud_2_exfiltration_artifact_files.yml b/detections/endpoint/shai_hulud_2_exfiltration_artifact_files.yml
index 20f5bab1aad..4c198587c5e 100644
--- a/detections/endpoint/shai_hulud_2_exfiltration_artifact_files.yml
+++ b/detections/endpoint/shai_hulud_2_exfiltration_artifact_files.yml
@@ -6,11 +6,13 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    Detects creation of exfiltration artifact files associated with Shai-Hulud 2.0 npm supply
+description: 'Detects creation of exfiltration artifact files associated with Shai-Hulud 2.0 npm supply
+
     chain malware. The malware creates cloud.json, contents.json, environment.json, truffleSecrets.json,
+
     and actionsSecrets.json files containing harvested credentials from AWS, Azure, GCP, GitHub secrets,
-    and environment variables. These files are staged before being pushed to attacker-controlled repositories.
+
+    and environment variables. These files are staged before being pushed to attacker-controlled repositories.'
 data_source:
     - Sysmon for Linux EventID 11
     - Sysmon EventID 11
@@ -35,17 +37,22 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `shai_hulud_2_exfiltration_artifact_files_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain filesystem events, specifically file creation
+
     events. These logs must be processed using the appropriate Splunk Technology Add-ons
+
     that are specific to the EDR product. The logs must also be mapped to the `Filesystem`
+
     node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM)
-    to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    Low but possible. Generic filenames like cloud.json or environment.json may appear in legitimate contexts. Correlate with npm install activity or suspicious parent processes.
+
+    to normalize the field names and speed up the data modeling process.'
+known_false_positives: Low but possible. Generic filenames like cloud.json or environment.json may appear in legitimate contexts. Correlate with npm install activity or suspicious parent processes.
 references:
     - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
     - https://securelist.com/shai-hulud-worm-infects-500-npm-packages-in-a-supply-chain-attack/117547/
@@ -57,7 +64,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Shai-Hulud 2.0 exfiltration artifact $file_name$ created on $dest$
     entity:
diff --git a/detections/endpoint/shai_hulud_workflow_file_creation_or_modification.yml b/detections/endpoint/shai_hulud_workflow_file_creation_or_modification.yml
index 742bfe03eaa..eb725c1fc55 100644
--- a/detections/endpoint/shai_hulud_workflow_file_creation_or_modification.yml
+++ b/detections/endpoint/shai_hulud_workflow_file_creation_or_modification.yml
@@ -6,59 +6,38 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    Detects creation or deletion of malicious GitHub Actions workflow files associated with
+description: 'Detects creation or deletion of malicious GitHub Actions workflow files associated with
+
     Shai-Hulud worm variants on Linux or Windows endpoints. This includes the original shai-hulud-workflow.yml,
+
     the 2.0 backdoor discussion.yaml (enables command injection via GitHub Discussions on self-hosted
+
     runners named SHA1HULUD), and the secrets exfiltration workflow formatter_*.yml pattern. These
-    files are used to exfiltrate credentials and propagate across repositories.
+
+    files are used to exfiltrate credentials and propagate across repositories.'
 data_source:
     - Sysmon for Linux EventID 11
     - Sysmon EventID 11
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.file_path IN (
-      "*/.github/workflows/discussion.yaml",
-      "*/.github/workflows/discussion.yml",
-      "*/.github/workflows/formatter_*.yaml",
-      "*/.github/workflows/formatter_*.yml",
-      "*/.github/workflows/shai-hulud-workflow.yaml",
-      "*/.github/workflows/shai-hulud-workflow.yml",
-      "*/.github/workflows/shai-hulud.yaml",
-      "*/.github/workflows/shai-hulud.yml",
-      "*\\.github\\workflows\\discussion.yaml",
-      "*\\.github\\workflows\\discussion.yml",
-      "*\\.github\\workflows\\formatter_*.yaml",
-      "*\\.github\\workflows\\formatter_*.yml",
-      "*\\.github\\workflows\\shai-hulud-workflow.yaml",
-      "*\\.github\\workflows\\shai-hulud-workflow.yml",
-      "*\\.github\\workflows\\shai-hulud.yaml",
-      "*\\.github\\workflows\\shai-hulud.yml"
-    )
-
-    by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
-       Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user
-       Filesystem.vendor_product
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("/.github/workflows/discussion.yaml", "/.github/workflows/discussion.yml", "/.github/workflows/formatter_*.yaml", "/.github/workflows/formatter_*.yml", "/.github/workflows/shai-hulud-workflow.yaml", "/.github/workflows/shai-hulud-workflow.yml", "/.github/workflows/shai-hulud.yaml", "/.github/workflows/shai-hulud.yml", "\\.github\\workflows\\discussion.yaml", "\\.github\\workflows\\discussion.yml", "\\.github\\workflows\\formatter_*.yaml", "\\.github\\workflows\\formatter_*.yml", "\\.github\\workflows\\shai-hulud-workflow.yaml", "\\.github\\workflows\\shai-hulud-workflow.yml", "\\.github\\workflows\\shai-hulud.yaml", "\\.github\\workflows\\shai-hulud.yml") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shai_hulud_workflow_file_creation_or_modification_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `shai_hulud_workflow_file_creation_or_modification_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain filesystem events, specifically file creation
+
     and deletion events. These logs must be processed using the appropriate Splunk
+
     Technology Add-ons that are specific to the EDR product. The logs must also be
+
     mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common
+
     Information Model (CIM) to normalize the field names and speed up the data modeling
-    process.
-known_false_positives: |
-    Very low. Legitimate usage of a file with this exact name is unlikely; validate with repository owners.
+
+    process.'
+known_false_positives: Very low. Legitimate usage of a file with this exact name is unlikely; validate with repository owners.
 references:
     - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
     - https://securelist.com/shai-hulud-worm-infects-500-npm-packages-in-a-supply-chain-attack/117547/
@@ -72,7 +51,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Shai-Hulud malicious workflow file detected on endpoint $dest$ at $file_path$. Immediate investigation required.
     entity:
diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml
index d382049a835..2b920d67875 100644
--- a/detections/endpoint/shim_database_file_creation.yml
+++ b/detections/endpoint/shim_database_file_creation.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation of shim database files (.sdb) in default directories using the sdbinst.exe application. It leverages filesystem activity data from the Endpoint.Filesystem data model to identify file writes to the Windows\AppPatch\Custom directory. This activity is significant because shims can intercept and alter API calls, potentially allowing attackers to bypass security controls or execute malicious code. If confirmed malicious, this could lead to unauthorized code execution, privilege escalation, or persistent access within the environment.
 data_source:
     - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count values(Filesystem.action) values(Filesystem.file_hash) as file_hash values(Filesystem.file_path) as file_path  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*Windows\\AppPatch\\Custom* by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` |`drop_dm_object_name(Filesystem)` | `shim_database_file_creation_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*Windows\\AppPatch\\Custom*" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shim_database_file_creation_filter`
 how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
 known_false_positives: Because legitimate shim files are created and used all the time, this event, in itself, is not suspicious. However, if there are other correlating events, it may warrant further investigation.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process that possibly write shim database in $file_path$ in host $dest$
     entity:
diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml
index cc68f93c14a..0e0c3aa9ebe 100644
--- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml
+++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sdbinst.exe NOT Processes.process IN ("\"C:\\Windows\\System32\\sdbinst.exe\"", "C:\\Windows\\System32\\sdbinst.exe", "*-mm", "*-?", "*-m -bg") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sdbinst.exe" NOT (Processes.process IN ("\"C:\\Windows\\System32\\sdbinst.exe\"", "C:\\Windows\\System32\\sdbinst.exe", "-mm", "-*", "-m -bg")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process $process_name$ that possibly creates a shim db silently in host $dest$
     entity:
diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml
index e95de1b7aeb..1c83f2dc1a4 100644
--- a/detections/endpoint/short_lived_scheduled_task.yml
+++ b/detections/endpoint/short_lived_scheduled_task.yml
@@ -6,15 +6,17 @@ modification_date: '2026-07-07'
 author: Mauricio Velazco, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the creation and deletion of scheduled tasks within a short time frame (less than 30 seconds) using Windows Security EventCodes 4698 and 4699.
+description: 'The following analytic detects the creation and deletion of scheduled tasks within a short time frame (less than 30 seconds) using Windows Security EventCodes 4698 and 4699.
+
     This behavior is identified by analyzing Windows Security Event Logs and leveraging the Windows TA for parsing.
+
     Such activity may indicate lateral movement or remote code execution attempts by adversaries.
-    If confirmed malicious, this could lead to unauthorized access, data exfiltration, or execution of malicious payloads, necessitating prompt investigation and response by security analysts.
+
+    If confirmed malicious, this could lead to unauthorized access, data exfiltration, or execution of malicious payloads, necessitating prompt investigation and response by security analysts.'
 data_source:
     - Windows Event Log Security 4698
     - Windows Event Log Security 4699
-search: |-
+search: |
     `wineventlog_security`
     EventCode IN (4698, 4699)
     | xmlkv object_attrs
@@ -25,10 +27,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `short_lived_scheduled_task_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
-known_false_positives: |-
-    Although uncommon, legitimate applications may create and delete a Scheduled Task within 30 seconds. Filter as needed.
+how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
+known_false_positives: Although uncommon, legitimate applications may create and delete a Scheduled Task within 30 seconds. Filter as needed.
 references:
     - https://attack.mitre.org/techniques/T1053/005/
     - https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler
@@ -40,7 +40,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml
index e645476aa65..0f819855593 100644
--- a/detections/endpoint/short_lived_windows_accounts.yml
+++ b/detections/endpoint/short_lived_windows_accounts.yml
@@ -10,7 +10,7 @@ description: The following analytic detects the rapid creation and deletion of W
 data_source:
     - Windows Event Log System 4720
     - Windows Event Log System 4726
-search: |-
+search: |
     | tstats `security_content_summariesonly` values(All_Changes.result_id) as result_id count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change
       WHERE All_Changes.result_id=4720
         OR
@@ -42,7 +42,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A user account $user$ is created and deleted within a short time period on host $dest$ by user $src_user$
     entity:
diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml
index 564abb21cfd..3f8db87356e 100644
--- a/detections/endpoint/silentcleanup_uac_bypass.yml
+++ b/detections/endpoint/silentcleanup_uac_bypass.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects suspicious modifications to the registry that may indicate a UAC (User Account Control) bypass attempt via the SilentCleanup task. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry changes in the path "*\\Environment\\windir" with executable values. This activity is significant as it can allow an attacker to gain high-privilege execution without user consent, bypassing UAC protections. If confirmed malicious, this could lead to unauthorized administrative access, enabling further system compromise and persistence.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_data = "*.exe*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `silentcleanup_uac_bypass_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Environment\\windir" Registry.registry_value_data="*.exe*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `silentcleanup_uac_bypass_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ on $dest$
     entity:
diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml
index c5e1b36fedf..6a738b0e307 100644
--- a/detections/endpoint/single_letter_process_on_endpoint.yml
+++ b/detections/endpoint/single_letter_process_on_endpoint.yml
@@ -95,7 +95,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A suspicious process $process_name$ with single letter on host $dest$
     entity:
diff --git a/detections/endpoint/slui_runas_elevated.yml b/detections/endpoint/slui_runas_elevated.yml
index f7c4eb43cbc..9a42a3c794a 100644
--- a/detections/endpoint/slui_runas_elevated.yml
+++ b/detections/endpoint/slui_runas_elevated.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=slui.exe (Processes.process=*-verb* Processes.process=*runas*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `slui_runas_elevated_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*slui.exe" Processes.process="*-verb*" Processes.process="*runas*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `slui_runas_elevated_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives should be present as this is not commonly used by legitimate applications.
 references:
@@ -41,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A slui process $process_name$ with elevated commandline $process$ on host $dest$
     entity:
diff --git a/detections/endpoint/slui_spawning_a_process.yml b/detections/endpoint/slui_spawning_a_process.yml
index 05ede9a2f93..254cc5a6341 100644
--- a/detections/endpoint/slui_spawning_a_process.yml
+++ b/detections/endpoint/slui_spawning_a_process.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=slui.exe AND NOT Processes.process_name=slui.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `slui_spawning_a_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*slui.exe" NOT Processes.process_name="*slui.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `slui_spawning_a_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Certain applications may spawn from `slui.exe` that are legitimate. Filtering will be needed to ensure proper monitoring.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A slui process $parent_process_name$ spawning child process $process_name$ on host $dest$
     entity:
diff --git a/detections/endpoint/socat_network_listener_binding_an_executable.yml b/detections/endpoint/socat_network_listener_binding_an_executable.yml
index 2ff67a8fe48..a58c066dfe6 100644
--- a/detections/endpoint/socat_network_listener_binding_an_executable.yml
+++ b/detections/endpoint/socat_network_listener_binding_an_executable.yml
@@ -6,13 +6,13 @@ modification_date: '2026-08-27'
 author: Maria Jose Erquiaga, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections.
-    Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement.
+description: 'The following analytic detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections.
+
+    Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement.'
 data_source:
     - Osquery Results
     - Sysmon for Linux EventID 1
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count
       min(_time) as firstTime
@@ -35,11 +35,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `socat_network_listener_binding_an_executable_filter`
-how_to_implement: |-
-    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
-    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
-known_false_positives: |-
-    Developers, network engineers, and system administrators may use socat to expose benign executables for protocol testing, debugging, data transformation, or troubleshooting.
+how_to_implement: 'This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+
+    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.'
+known_false_positives: Developers, network engineers, and system administrators may use socat to expose benign executables for protocol testing, debugging, data transformation, or troubleshooting.
 references:
     - https://attack.mitre.org/tactics/TA0002/
     - https://attack.mitre.org/techniques/T1059
@@ -54,7 +53,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Socat was executed with a TCP or OpenSSL listener configured to pass inbound connections to an executable via [$process$] on endpoint [$dest$] by user [$user$].
     entity:
@@ -77,9 +76,9 @@ mitre_attack_id:
     - T1059
     - T1572
 product:
-    - Splunk Cloud
     - Splunk Enterprise
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: endpoint
 security_domain: endpoint
 tests:
diff --git a/detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml b/detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml
index cc264218561..aee0e3b2e5a 100644
--- a/detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml
+++ b/detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml
@@ -6,14 +6,15 @@ modification_date: '2026-08-27'
 author: Maria Jose Erquiaga, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects execution of the socat utility with a remote TCP or OpenSSL connection and local terminal echo disabled.
+description: 'The following analytic detects execution of the socat utility with a remote TCP or OpenSSL connection and local terminal echo disabled.
+
     This configuration may be used for interactive terminal sessions, password handling, automation, or network debugging.
-    When observed in an unexpected context, such as execution by an unusual parent process or connection to an untrusted endpoint, it may indicate suspicious remote access activity.
+
+    When observed in an unexpected context, such as execution by an unusual parent process or connection to an untrusted endpoint, it may indicate suspicious remote access activity.'
 data_source:
     - Osquery Results
     - Sysmon for Linux EventID 1
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -40,11 +41,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `socat_remote_tcp_connection_with_local_echo_disabled_filter`
-how_to_implement: |-
-    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
-    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
-known_false_positives: |-
-    Developers and network engineers may use socat with local echo disabled for legitimate TCP debugging, protocol testing, terminal handling, or troubleshooting.
+how_to_implement: 'This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
+
+    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.'
+known_false_positives: Developers and network engineers may use socat with local echo disabled for legitimate TCP debugging, protocol testing, terminal handling, or troubleshooting.
 references:
     - https://attack.mitre.org/tactics/TA0002/
     - https://attack.mitre.org/techniques/T1059
@@ -59,7 +59,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -76,9 +76,9 @@ mitre_attack_id:
     - T1059
     - T1572
 product:
-    - Splunk Cloud
     - Splunk Enterprise
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: endpoint
 security_domain: endpoint
 tests:
diff --git a/detections/endpoint/spike_in_file_writes.yml b/detections/endpoint/spike_in_file_writes.yml
index 7a09a3c6224..1460165d62b 100644
--- a/detections/endpoint/spike_in_file_writes.yml
+++ b/detections/endpoint/spike_in_file_writes.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects a sharp increase in the number of files written to a specific host. It leverages the Endpoint.Filesystem data model, focusing on 'created' actions and comparing current file write counts against historical averages and standard deviations. This activity is significant as a sudden spike in file writes can indicate malicious activities such as ransomware encryption or data exfiltration. If confirmed malicious, this behavior could lead to significant data loss, system compromise, or further propagation of malware within the network.
 data_source:
     - Sysmon EventID 11
-search: |-
+search: |
     | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem
       WHERE Filesystem.action=created
       BY _time span=1h, Filesystem.dest
diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml
index 8a78fc24ccb..d81f25d334e 100644
--- a/detections/endpoint/spoolsv_spawning_rundll32.yml
+++ b/detections/endpoint/spoolsv_spawning_rundll32.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=spoolsv.exe `process_rundll32`
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `spoolsv_spawning_rundll32_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*spoolsv.exe" Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_spawning_rundll32_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives have been identified. There are limited instances where `rundll32.exe` may be spawned by a legitimate print driver.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $parent_process_name$ has spawned $process_name$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare.
     entity:
diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml
index 52b88bdb52a..56b205895df 100644
--- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml
+++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the suspicious loading of DLLs by spoolsv.exe, potentially indicating PrintNightmare exploitation. It leverages Sysmon EventCode 7 to identify instances where spoolsv.exe loads multiple DLLs from the Windows System32 spool drivers x64 directory. This activity is significant as it may signify an attacker exploiting the PrintNightmare vulnerability to execute arbitrary code. If confirmed malicious, this could lead to unauthorized code execution, privilege escalation, and persistent access within the environment, posing a severe security risk.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImageLoaded values(loaded_file) as loaded_file values(loaded_file_path) as loaded_file_path values(original_file_name) as original_file_name values(process_exec) as process_exec values(process_guid) as process_guid values(process_hash) as process_hash values(process_name) as process_name values(service_dll_signature_exists) as service_dll_signature_exists values(service_dll_signature_verified) as service_dll_signature_verified values(signature) as signature values(signature_id) as signature_id values(user_id) as user_id values(vendor_product) as vendor_product values(Image) as Image count min(_time) as firstTime max(_time) as lastTime by process_path dest process_id | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter`'
+search: |
+    `sysmon` EventCode=7 Image="*\\spoolsv.exe" ImageLoaded="*\\system32\\*" ImageLoaded="*.dll" | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare.
     entity:
diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml
index 68780906a80..d2fc0ec5589 100644
--- a/detections/endpoint/spoolsv_suspicious_process_access.yml
+++ b/detections/endpoint/spoolsv_suspicious_process_access.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects suspicious process access by spoolsv.exe, potentially indicating exploitation of the PrintNightmare vulnerability (CVE-2021-34527). It leverages Sysmon EventCode 10 to identify when spoolsv.exe accesses critical system files or processes like rundll32.exe with elevated privileges. This activity is significant as it may signal an attempt to gain unauthorized privilege escalation on a vulnerable machine. If confirmed malicious, an attacker could achieve elevated privileges, leading to further system compromise, persistent access, or unauthorized control over the affected environment.
 data_source:
     - Sysmon EventID 10
-search: '`sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*" TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_process_access_filter`'
+search: |
+    `sysmon` EventCode=10 SourceImage="*\\spoolsv.exe" CallTrace="*\\system32\\*" TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess="0x1fffff" | eval granted_access=granted_access, parent_process_path=parent_process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest user_id process_name process_guid process_id signature SourceImage TargetImage GrantedAccess CallTrace ProcessID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_process_access_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with process access event where SourceImage, TargetImage, GrantedAccess and CallTrace executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of spoolsv.exe.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare.
     entity:
diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml
index 6134cf3f70b..1bbf322ff3b 100644
--- a/detections/endpoint/spoolsv_writing_a_dll.yml
+++ b/detections/endpoint/spoolsv_writing_a_dll.yml
@@ -10,7 +10,8 @@ description: The following analytic detects `spoolsv.exe` writing a `.dll` file,
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 11
     - Windows Event Log Security 4688 AND Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=spoolsv.exe by _time Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\spool\\drivers\\x64\\*" Filesystem.file_name="*.dll" by _time Filesystem.dest Filesystem.process_guid Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process_guid process] | dedup file_create_time | table  dest file_create_time, file_name, file_path, process_name process_guid | `spoolsv_writing_a_dll_filter`'
+search: |
+    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=spoolsv.exe by _time Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\spool\\drivers\\x64\\*" Filesystem.file_name="*.dll" by _time Filesystem.dest Filesystem.process_guid Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process_guid process] | dedup file_create_time | table  dest file_create_time, file_name, file_path, process_name process_guid | `spoolsv_writing_a_dll_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare.
     entity:
diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml
index 906a502ccf4..0f58a9dd1a2 100644
--- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml
+++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects `spoolsv.exe` writing a `.dll` file, which is unusual behavior and may indicate exploitation of vulnerabilities like CVE-2021-34527 (PrintNightmare). This detection leverages Sysmon EventID 11 to monitor file creation events in the `\spool\drivers\x64\` directory. This activity is significant because `spoolsv.exe` typically does not write DLL files, and such behavior could signify an ongoing attack. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence on the compromised system.
 data_source:
     - Sysmon EventID 11
-search: '`sysmon` EventID=11 process_name=spoolsv.exe file_path="*\\spool\\drivers\\x64\\*" file_name=*.dll | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name file_path  process_guid process_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_writing_a_dll___sysmon_filter`'
+search: |
+    `sysmon` EventCode=11 process_name="spoolsv.exe" TargetFilename="*\\spool\\drivers\\x64\\*" TargetFilename="*.dll" | eval process_name=process_name, root_drive=root_drive | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name file_path process_guid process_id user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_writing_a_dll___sysmon_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 known_false_positives: Limited false positives. Filter as needed.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare.
     entity:
diff --git a/detections/endpoint/sqlite_module_in_temp_folder.yml b/detections/endpoint/sqlite_module_in_temp_folder.yml
index bc11a630ba8..444463b09e1 100644
--- a/detections/endpoint/sqlite_module_in_temp_folder.yml
+++ b/detections/endpoint/sqlite_module_in_temp_folder.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation of sqlite3.dll files in the %temp% folder. It leverages Sysmon EventCode 11 to identify when these files are written to the temporary directory. This activity is significant because it is associated with IcedID malware, which uses the sqlite3 module to parse browser databases and steal sensitive information such as banking details, credit card information, and credentials. If confirmed malicious, this behavior could lead to significant data theft and compromise of user accounts.
 data_source:
     - Sysmon EventID 11
-search: '`sysmon` EventCode=11 (TargetFilename = "*\\sqlite32.dll" OR TargetFilename = "*\\sqlite64.dll") (TargetFilename = "*\\temp\\*") | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name file_path  process_guid process_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sqlite_module_in_temp_folder_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\sqlite32.dll", "*\\sqlite64.dll") Filesystem.file_path="*\\temp\\*" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sqlite_module_in_temp_folder_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Process creates a file $file_name$ in host $dest$
     entity:
diff --git a/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml b/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml
index 18647c0001a..adb1b276782 100644
--- a/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml
+++ b/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml
@@ -8,7 +8,7 @@ status: production
 type: Correlation
 description: The following analytic identifies potential threats related to the theft or forgery of authentication certificates. It detects when five or more analytics from the Windows Certificate Services story trigger within a specified timeframe. This detection leverages aggregated risk scores and event counts from the Risk data model. This activity is significant as it may indicate an ongoing attack aimed at compromising authentication mechanisms. If confirmed malicious, attackers could gain unauthorized access to sensitive systems and data, potentially leading to severe security breaches.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
       WHERE All_Risk.analyticstories="Windows Certificate Services" All_Risk.risk_object_type="system"
       BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$risk_object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Steal or Forge Authentication Certificates Behavior Identified - $risk_object$
     entity:
diff --git a/detections/endpoint/sunburst_correlation_dll_and_network_event.yml b/detections/endpoint/sunburst_correlation_dll_and_network_event.yml
index 26b9b30de84..576830004f3 100644
--- a/detections/endpoint/sunburst_correlation_dll_and_network_event.yml
+++ b/detections/endpoint/sunburst_correlation_dll_and_network_event.yml
@@ -10,7 +10,7 @@ description: The following analytic identifies the loading of the malicious Sola
 data_source:
     - Sysmon EventID 7
     - Sysmon EventID 22
-search: |-
+search: |
     `sysmon`
     (
         EventCode=7
diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml
index f34bd1fc702..43e87067c95 100644
--- a/detections/endpoint/suspicious_computer_account_name_change.yml
+++ b/detections/endpoint/suspicious_computer_account_name_change.yml
@@ -9,11 +9,8 @@ type: TTP
 description: The following analytic detects a suspicious computer account name change in Active Directory. It leverages Event ID 4781, which logs account name changes, to identify instances where a computer account name is changed to one that does not end with a `$`. This behavior is significant as it may indicate an attempt to exploit CVE-2021-42278 and CVE-2021-42287, which can lead to domain controller impersonation and privilege escalation. If confirmed malicious, this activity could allow an attacker to gain elevated privileges and potentially control the domain.
 data_source:
     - Windows Event Log Security 4781
-search: |-
-    `wineventlog_security` EventCode=4781 OldTargetUserName="*$" NewTargetUserName!="*$"
-      | table _time, Computer, Caller_User_Name, OldTargetUserName, NewTargetUserName
-      | rename Computer as dest
-      | `suspicious_computer_account_name_change_filter`
+search: |
+    `wineventlog_security` EventCode=4781 OldTargetUserName="*$" NOT NewTargetUserName="*$" | eval OldTargetUserName=OldTargetUserName, NewTargetUserName=NewTargetUserName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_computer_account_name_change_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
 known_false_positives: Renaming a computer account name to a name that not end with '$' is highly unsual and may not have any legitimate scenarios.
 references:
@@ -28,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$OldTargetUserName$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$OldTargetUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A computer account $OldTargetUserName$ was renamed with a suspicious computer name on $dest$
     entity:
diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml
index 3aeea0446d0..4264b28b04f 100644
--- a/detections/endpoint/suspicious_copy_on_system32.yml
+++ b/detections/endpoint/suspicious_copy_on_system32.yml
@@ -6,63 +6,46 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects potentially suspicious file copy operations targeting the
+description: 'The following analytic detects potentially suspicious file copy operations targeting the
+
     System32 or SysWow64 directories as source, often indicative of malicious activity.
+
     It leverages data from Endpoint Detection and Response (EDR) agents,
+
     focusing on activity initiated by command-line tools like cmd.exe or PowerShell.
+
     This behavior is significant as it may indicate an attempt to evade defenses by copying
+
     an existing binary from the system directory and renaming it.
+
     If confirmed malicious, this activity could allow an attacker to execute
+
     code undetected and potentially leading to system compromise or further lateral movement
-    within the network.
+
+    within the network.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    Processes.parent_process_name IN (
-      "cmd.exe",
-      "powershell.exe",
-      "pwsh.exe",
-      "sqlps.exe",
-      "sqltoolsps.exe"
-    )
-    (
-      Processes.process_name IN ("copy.exe", "xcopy.exe")
-      OR
-      Processes.original_file_name IN ("copy.exe", "xcopy.exe")
-    )
-    Processes.process IN (
-      "* \"C:\\Windows\\System32\\*",
-      "* \'C:\\Windows\\System32\\*",
-      "* C:\\Windows\\System32\\*",
-      "* \"C:\\Windows\\SysWow64\\*",
-      "* \'C:\\Windows\\SysWow64\\*",
-      "* C:\\Windows\\SysWow64\\*"
-    )
-    by Processes.action Processes.dest Processes.original_file_name
-    Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-    Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-    Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
-    Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
-    Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_copy_on_system32_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*cmd.exe", "*powershell.exe", "*pwsh.exe", "*sqlps.exe", "*sqltoolsps.exe") Processes.process_name IN ("*copy.exe", "*xcopy.exe") OR Processes.original_file_name IN ("copy.exe", "xcopy.exe") Processes.process IN ("*\\system32\\*", "*\\syswow64\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_copy_on_system32_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
+
+    names and speed up the data modeling process.'
 known_false_positives: Copying files from System directories can happen for multiple admin reasons, allbeit rare without approval. Apply additional filters where needed.
 references:
     - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
@@ -75,7 +58,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/suspicious_curl_network_connection.yml b/detections/endpoint/suspicious_curl_network_connection.yml
index 3023129ecfc..3f742d9b416 100644
--- a/detections/endpoint/suspicious_curl_network_connection.yml
+++ b/detections/endpoint/suspicious_curl_network_connection.yml
@@ -13,22 +13,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("curl", "curl.exe")
-    Processes.process IN ("*s3.amazonaws.com*")
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user Processes.user_id
-       Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_curl_network_connection_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*curl", "*curl.exe") Processes.process="*s3.amazonaws.com*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_curl_network_connection_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
index 3863a440e87..a7997241ab7 100644
--- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
@@ -12,18 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where
-    (Processes.process_name=dllhost.exe OR Processes.original_file_name=dllhost.exe)
-    Processes.process IN ("*dllhost","*dllhost.exe", "*dllhost.exe\"")
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
-       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
-       Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_dllhost_no_command_line_arguments_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*dllhost.exe" OR Processes.original_file_name="dllhost.exe" Processes.process IN ("*dllhost", "*dllhost.exe", "*dllhost.exe\"") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_dllhost_no_command_line_arguments_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives may be present in small environments. Tuning may be required based on parent process.
 references:
@@ -37,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious dllhost.exe process with no command line arguments executed on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
index 989aad95e7a..790a1834439 100644
--- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
@@ -12,18 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where
-    (Processes.process_name=gpupdate.exe OR Processes.original_file_name=GPUpdate.exe)
-    Processes.process IN ("*gpupdate","*gpupdate.exe", "*gpupdate.exe\"")
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
-       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
-       Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_gpupdate_no_command_line_arguments_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*gpupdate.exe" OR Processes.original_file_name="GPUpdate.exe" Processes.process IN ("*gpupdate", "*gpupdate.exe", "*gpupdate.exe\"") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_gpupdate_no_command_line_arguments_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives may be present in small environments. Tuning may be required based on parent process.
 references:
@@ -37,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious gpupdate.exe process with no command line arguments executed on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml
index 2cd37206536..1944b78cc54 100644
--- a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml
+++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_rundll32` Processes.process=*/i:*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_icedid_rundll32_cmdline_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" Processes.process="*/i:*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_icedid_rundll32_cmdline_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: limitted. this parameter is not commonly used by windows application but can be used by the network operator.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: rundll32 process $process_name$ with commandline $process$ in host $dest$
     entity:
diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
index c7b22b36bf0..22573938226 100644
--- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
+++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation of image files in the AppData folder by processes that also have a file reference in the same folder. It leverages data from the Endpoint.Processes and Endpoint.Filesystem datamodels to identify this behavior. This activity is significant because it is commonly associated with malware, such as the Remcos RAT, which captures screenshots and stores them in the AppData folder before exfiltrating them to a command-and-control server. If confirmed malicious, this activity could indicate unauthorized data capture and exfiltration, compromising sensitive information and user privacy.
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path= "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] | `suspicious_image_creation_in_appdata_folder_filter`'
+search: |
+    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path= "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] | `suspicious_image_creation_in_appdata_folder_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Process $process_name$ creating image file $file_path$ on $dest$
     entity:
diff --git a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
index 36fd9085f77..c0326ebbdb9 100644
--- a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
+++ b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects suspicious Kerberos Service Ticket (TGS) requests where the requesting account name matches the service name, potentially indicating an exploitation attempt of CVE-2021-42278 and CVE-2021-42287. This detection leverages Event ID 4769 from Domain Controller and Kerberos events. Such activity is significant as it may represent an adversary attempting to escalate privileges by impersonating a domain controller. If confirmed malicious, this could allow an attacker to take control of the domain controller, leading to complete domain compromise and unauthorized access to sensitive information.
 data_source:
     - Windows Event Log Security 4769
-search: |-
+search: |
     `wineventlog_security` EventCode=4769
       | eval isSuspicious = if(lower(ServiceName) = lower(mvindex(split(TargetUserName,"@"),0)),1,0)
       | where isSuspicious = 1
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A suspicious Kerberos Service Ticket was requested by $user$ on host $dest$
     entity:
diff --git a/detections/endpoint/suspicious_linux_discovery_commands.yml b/detections/endpoint/suspicious_linux_discovery_commands.yml
index b9e8c04a3fa..dfab2371380 100644
--- a/detections/endpoint/suspicious_linux_discovery_commands.yml
+++ b/detections/endpoint/suspicious_linux_discovery_commands.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the execution of suspicious bash commands commonly used in scripts like AutoSUID, LinEnum, and LinPeas for system discovery on a Linux host. It leverages Endpoint Detection and Response (EDR) data, specifically looking for a high number of distinct commands executed within a short time frame. This activity is significant as it often precedes privilege escalation or other malicious actions. If confirmed malicious, an attacker could gain detailed system information, identify vulnerabilities, and potentially escalate privileges, posing a severe threat to the environment.
 data_source:
     - Sysmon for Linux EventID 1
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product dc(Processes.process) as distinct_commands dc(Processes.process_name) as distinct_process_names FROM datamodel=Endpoint.Processes
       WHERE [
     | inputlookup linux_tool_discovery_process
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious Linux Discovery Commands detected on $dest$
     entity:
diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
index a06f18a25fd..6a9dee84191 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=microsoft.workflow.compiler.exe
-            OR
-            Processes.original_file_name=Microsoft.Workflow.Compiler.exe
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_microsoft_workflow_compiler_usage_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*microsoft.workflow.compiler.exe" OR Processes.original_file_name="Microsoft.Workflow.Compiler.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_usage_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, limited instances have been identified coming from native Microsoft utilities similar to SCCM.
 references:
@@ -43,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
index b421a4093d8..e98720c90c7 100644
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_msbuild` AND (Processes.process_path!=*\\framework*\\v*\\*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `suspicious_msbuild_path_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*msbuild.exe" OR Processes.original_file_name="MSBuild.exe" NOT Processes.process_path="*\\framework*\\v*\\*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_msbuild_path_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate applications may use a moved copy of msbuild.exe, triggering a false positive. Baselining of MSBuild.exe usage is recommended to better understand it's path usage. Visual Studio runs an instance out of a path that will need to be filtered on.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$
     entity:
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
index cde15a96eec..6cacfe6f622 100644
--- a/detections/endpoint/suspicious_msbuild_spawn.yml
+++ b/detections/endpoint/suspicious_msbuild_spawn.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=wmiprvse.exe
-        AND
-        `process_msbuild`
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_msbuild_spawn_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*wmiprvse.exe" Processes.process_name="*msbuild.exe" OR Processes.original_file_name="MSBuild.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_msbuild_spawn_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
 references:
@@ -40,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious msbuild.exe process executed on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml
index abb3eb65e56..36c0eb8e527 100644
--- a/detections/endpoint/suspicious_mshta_child_process.yml
+++ b/detections/endpoint/suspicious_mshta_child_process.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=mshta.exe
-        AND
-        Processes.process_name IN ("powershell.exe","colorcpl.exe", "msbuild.exe", "microsoft.workflow.compiler.exe", "searchprotocolhost.exe", "scrcons.exe", "cscript.exe", "wscript.exe", "cmd.exe", "bitsadmin.exe")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_mshta_child_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*mshta.exe" Processes.process_name IN ("*powershell.exe", "*colorcpl.exe", "*msbuild.exe", "*microsoft.workflow.compiler.exe", "*searchprotocolhost.exe", "*scrcons.exe", "*cscript.exe", "*wscript.exe", "*cmd.exe", "*bitsadmin.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_mshta_child_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
 references:
@@ -42,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious mshta child process $process_name$ detected on host $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml
index 998cb0dc062..14792622ede 100644
--- a/detections/endpoint/suspicious_mshta_spawn.yml
+++ b/detections/endpoint/suspicious_mshta_spawn.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.parent_process_name=svchost.exe
-            OR
-            Processes.parent_process_name=wmiprvse.exe
-        )
-        AND `process_mshta`
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_mshta_spawn_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*svchost.exe", "*wmiprvse.exe") Processes.process_name="*mshta.exe" OR Processes.original_file_name="MSHTA.EXE" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_mshta_spawn_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
 references:
@@ -44,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: mshta.exe spawned by wmiprvse.exe on $dest$
     entity:
diff --git a/detections/endpoint/suspicious_plistbuddy_usage.yml b/detections/endpoint/suspicious_plistbuddy_usage.yml
index 7953100947a..d927d40f0aa 100644
--- a/detections/endpoint/suspicious_plistbuddy_usage.yml
+++ b/detections/endpoint/suspicious_plistbuddy_usage.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=PlistBuddy (Processes.process=*LaunchAgents*
-        OR
-        Processes.process=*RunAtLoad*
-        OR
-        Processes.process=*true*)
-      BY Processes.dest Processes.user Processes.parent_process
-         Processes.process_name Processes.process Processes.process_id
-         Processes.parent_process_id
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_plistbuddy_usage_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*PlistBuddy" Processes.process IN ("*LaunchAgents*", "*RunAtLoad*", "*true*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_plistbuddy_usage_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate applications may use PlistBuddy to create or modify property lists and possibly generate false positives. Review the property list being modified or created to confirm.
 references:
diff --git a/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml b/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml
index c2c83838e62..3bbc848dec2 100644
--- a/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml
+++ b/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml
@@ -9,9 +9,9 @@ type: TTP
 description: The following analytic detects the use of the PlistBuddy utility on macOS to create or modify property list (.plist) files. It leverages OSQuery to monitor process events, specifically looking for commands that interact with LaunchAgents and set properties like RunAtLoad. This activity is significant because PlistBuddy can be used to establish persistence mechanisms, as seen in malware like Silver Sparrow. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary commands, and potentially escalate privileges on the compromised system.
 data_source:
     - Osquery Results
-search: |-
+search: |
     `osquery_process` "columns.cmdline"="*LaunchAgents*" OR "columns.cmdline"="*RunAtLoad*" OR "columns.cmdline"="*true*"
-      | `suspicious_plistbuddy_usage_via_osquery_filter`
+      | `suspicious_plistbuddy_usage_via_osquery_filter` | stats count by host
 how_to_implement: OSQuery must be installed and configured to pick up process events (info at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402. Modify the macro and validate fields are correct.
 known_false_positives: Some legitimate applications may use PlistBuddy to create or modify property lists and possibly generate false positives. Review the property list being modified or created to confirm.
 references:
diff --git a/detections/endpoint/suspicious_process_executed_from_container_file.yml b/detections/endpoint/suspicious_process_executed_from_container_file.yml
index 714db930e46..ed2d56af56a 100644
--- a/detections/endpoint/suspicious_process_executed_from_container_file.yml
+++ b/detections/endpoint/suspicious_process_executed_from_container_file.yml
@@ -11,7 +11,7 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly`
     count
     min(_time) as firstTime
@@ -69,7 +69,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A suspicious file [$container_file_name$] was launched from container file [$file_name$] by process [$process_name$] on [$dest$].
     entity:
diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml
index f563ea52fd0..17e738a1271 100644
--- a/detections/endpoint/suspicious_reg_exe_process.yml
+++ b/detections/endpoint/suspicious_reg_exe_process.yml
@@ -11,7 +11,7 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
       WHERE Processes.parent_process_name != explorer.exe Processes.process_name =cmd.exe
       BY Processes.action Processes.dest Processes.original_file_name
@@ -48,7 +48,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
index b37daabf5ca..6de0bb8f19f 100644
--- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
+++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process IN ("*\\appdata\\*", "*\\programdata\\*","*\\windows\\temp\\*") NOT (Processes.process IN ("*.dll*", "*.ax*", "*.ocx*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*regsvr32.exe" OR Processes.original_file_name="REGSVR32.EXE" Processes.process IN ("*\\appdata\\*", "*\\programdata\\*", "*\\windows\\temp\\*") NOT (Processes.process IN ("*.dll*", "*.ax*", "*.ocx*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives with the query restricted to specified paths. Add more world writeable paths as tuning continues.
 references:
@@ -28,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to evade detection by using a non-standard file extension.
     entity:
diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
index 19a58786e05..3c083727463 100644
--- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
+++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_rundll32` Processes.process=*dllregisterserver*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_rundll32_dllregisterserver_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" Processes.process="*dllregisterserver*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_rundll32_dllregisterserver_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: This is likely to produce false positives and will require some filtering. Tune the query by adding command line paths to known good DLLs, or filtering based on parent process names.
 references:
@@ -43,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a DLL. code
     entity:
diff --git a/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml
index e9be0c3738a..4426cc15770 100644
--- a/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml
@@ -6,42 +6,21 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects the execution of rundll32.exe without any command line arguments.
+description: 'The following analytic detects the execution of rundll32.exe without any command line arguments.
+
     This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process execution logs.
+
     It is significant because rundll32.exe typically requires command line arguments to function properly, and its absence is often associated with malicious activities, such as those performed by Cobalt Strike.
-    If confirmed malicious, this activity could indicate an attempt to execute arbitrary code, potentially leading to credential dumping, unauthorized file writes, or other malicious actions.
+
+    If confirmed malicious, this activity could indicate an attempt to execute arbitrary code, potentially leading to credential dumping, unauthorized file writes, or other malicious actions.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    `process_rundll32`
-    Processes.process IN ("*rundll32","*rundll32.exe", "*rundll32.exe\"")
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_rundll32_no_command_line_arguments_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" Processes.process IN ("*rundll32", "*rundll32.exe", "*rundll32.exe\"") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_rundll32_no_command_line_arguments_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive.
 references:
     - https://attack.mitre.org/techniques/T1218/011/
     - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
@@ -55,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml
index 41cb6e0ed6a..e8cd5d4f891 100644
--- a/detections/endpoint/suspicious_rundll32_plugininit.yml
+++ b/detections/endpoint/suspicious_rundll32_plugininit.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_rundll32` Processes.process=*PluginInit*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_rundll32_plugininit_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" Processes.process="*PluginInit*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_rundll32_plugininit_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: third party application may used this dll export name to execute function.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: rundll32 process $process_name$ with commandline $process$ in host $dest$
     entity:
diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml
index eae3bc1abe6..55d131756ed 100644
--- a/detections/endpoint/suspicious_rundll32_startw.yml
+++ b/detections/endpoint/suspicious_rundll32_startw.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_rundll32` Processes.process IN ("*startw", "*startw *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_rundll32_startw_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" Processes.process IN ("*startw", "*startw ") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_rundll32_startw_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate applications may use Start as a function and call it via the command line. Filter as needed.
 references:
@@ -42,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: rundll32.exe running with suspicious StartW parameters on $dest$
     entity:
diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
index 321d335a971..d4261839f6f 100644
--- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
+++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe (Processes.process=*\\users\\public\\* OR Processes.process=*\\programdata\\* OR Processes.process=*windows\\temp*)  Processes.process=*/create* by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `suspicious_scheduled_task_from_public_directory_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*schtasks.exe" Processes.process IN ("*\\users\\public\\*", "*\\programdata\\*", "*windows\\temp*") Processes.process="*/create*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_scheduled_task_from_public_directory_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: The main source of false positives could be the legitimate use of scheduled tasks from these directories. Careful tuning of this search may be necessary to suit the specifics of your environment, reducing the rate of false positives.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
index 725d4292efd..9031bb20787 100644
--- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
@@ -6,47 +6,23 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects instances of searchprotocolhost.exe running without command line arguments.
+description: 'The following analytic detects instances of searchprotocolhost.exe running without command line arguments.
+
     This behavior is unusual and often associated with malicious activities, such as those performed by Cobalt Strike.
+
     The detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process execution data.
+
     This activity is significant because searchprotocolhost.exe typically runs with specific arguments, and its absence may indicate an attempt to evade detection.
-    If confirmed malicious, this could lead to unauthorized code execution, potential credential dumping, or other malicious actions within the environment.
+
+    If confirmed malicious, this could lead to unauthorized code execution, potential credential dumping, or other malicious actions within the environment.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    (
-        Processes.process_name=searchprotocolhost.exe
-        OR
-        Processes.original_file_name=searchprotocolhost.exe
-    )
-    Processes.process IN ("*searchprotocolhost","*searchprotocolhost.exe", "*searchprotocolhost.exe\"")
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_searchprotocolhost_no_command_line_arguments_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    No false positives have been identified at this time.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*searchprotocolhost.exe" OR Processes.original_file_name="searchprotocolhost.exe" Processes.process IN ("*searchprotocolhost", "*searchprotocolhost.exe", "*searchprotocolhost.exe\"") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_searchprotocolhost_no_command_line_arguments_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://github.com/mandiant/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc
 drilldown_searches:
@@ -57,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
index aded6e02ac6..40a2d813b10 100644
--- a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
+++ b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=sqlite3 Processes.process=*LSQuarantine*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_sqlite3_lsquarantine_behavior_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sqlite3" Processes.process="*LSQuarantine*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_sqlite3_lsquarantine_behavior_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml
index db6a184f7ae..069653431d3 100644
--- a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml
+++ b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml
@@ -10,7 +10,7 @@ description: The following analytic detects suspicious Kerberos Ticket Granting
 data_source:
     - Windows Event Log Security 4768
     - Windows Event Log Security 4781
-search: |-
+search: |
     `wineventlog_security` (EventCode=4781 OldTargetUserName="*$" NewTargetUserName!="*$") OR (EventCode=4768 TargetUserName!="*$")
       | eval RenamedComputerAccount = coalesce(NewTargetUserName, TargetUserName)
       | transaction RenamedComputerAccount startswith=(EventCode=4781) endswith=(EventCode=4768)
diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml
index b53e414eec1..4c085a800a6 100644
--- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml
+++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml
@@ -10,7 +10,8 @@ description: The following analytic detects the creation of .wav files in the Ap
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 11
     - Windows Event Log Security 4688 AND Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields file_name file_path process_name process_path process dest file_create_time _time proc_guid] | `suspicious_wav_file_in_appdata_folder_filter`'
+search: |
+    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields file_name file_path process_name process_path process dest file_create_time _time proc_guid] | `suspicious_wav_file_in_appdata_folder_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, file_name, file_path and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: process $process_name$ creating image file $file_path$ on $dest$
     entity:
diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml
index 09efb091a46..6514e75c63b 100644
--- a/detections/endpoint/suspicious_wevtutil_usage.yml
+++ b/detections/endpoint/suspicious_wevtutil_usage.yml
@@ -6,68 +6,20 @@ modification_date: '2026-10-02'
 author: David Dorsey, Michael Haag, Teoderick Contreras, Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects the usage of wevtutil.exe with parameters for clearing event logs such as Application, Security, Setup, Trace, or System.
+description: 'The following analytic detects the usage of wevtutil.exe with parameters for clearing event logs such as Application, Security, Setup, Trace, or System.
+
     It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments.
+
     This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations.
-    If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise.
+
+    If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    (
-        Processes.process_name="wevtutil.exe"
-        OR
-        Processes.original_file_name="wevtutil.exe"
-    )
-
-    Processes.process IN ("* cl *", "*clear-log*")
-    Processes.process IN (
-        "*/Trace*",
-        "*AMSI/Debug*",
-        "*Application*",
-        "*CiscoSecureEndpoint*",
-        "*Microsoft-Windows-BitLocker*",
-        "*Microsoft-Windows-Bits*",
-        "*Microsoft-Windows-CAPI2*",
-        "*Microsoft-Windows-Kernel-File*",
-        "*Microsoft-Windows-Kernel-Process*",
-        "*Microsoft-Windows-LDAP*",
-        "*Microsoft-Windows-PowerShell*",
-        "*Microsoft-Windows-Sysmon*",
-        "*Microsoft-Windows-TerminalServices-LocalSessionManager*",
-        "*Microsoft-Windows-TerminalServices-RemoteConnectionManager*",
-        "*Microsoft-Windows-WMI-Activity*",
-        "*OpenSSH/*",
-        "*PowerShellCore/*",
-        "*Security*",
-        "*Setup*",
-        "*System*",
-        "*Windows Firewall With Advanced Security*",
-        "*Windows PowerShell*"
-    )
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `suspicious_wevtutil_usage_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wevtutil.exe" OR Processes.original_file_name="wevtutil.exe" Processes.process IN ("* cl *", "*clear-log*") Processes.process IN ("*/Trace*", "*AMSI/Debug*", "*Application*", "*CiscoSecureEndpoint*", "*Microsoft-Windows-BitLocker*", "*Microsoft-Windows-Bits*", "*Microsoft-Windows-CAPI2*", "*Microsoft-Windows-Kernel-File*", "*Microsoft-Windows-Kernel-Process*", "*Microsoft-Windows-LDAP*", "*Microsoft-Windows-PowerShell*", "*Microsoft-Windows-Sysmon*", "*Microsoft-Windows-TerminalServices-LocalSessionManager*", "*Microsoft-Windows-TerminalServices-RemoteConnectionManager*", "*Microsoft-Windows-WMI-Activity*", "*OpenSSH/*", "*PowerShellCore/*", "*Security*", "*Setup*", "*System*", "*Windows Firewall With Advanced Security*", "*Windows PowerShell*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_wevtutil_usage_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md
@@ -80,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The EventLog was cleared using the [$process_name$] utility with the Command Line [$process$] on [$dest$] by [$user$].
     entity:
diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml
index b378c2f118d..2d5d67625b6 100644
--- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml
+++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects when a process other than explorer.exe writes to the Windows Recycle Bin. It leverages the Endpoint.Filesystem and Endpoint.Processes data models in Splunk to identify any process writing to the "*$Recycle.Bin*" file path, excluding explorer.exe. This activity is significant because it may indicate an attacker attempting to hide their actions, potentially leading to data theft, ransomware, or other malicious outcomes. If confirmed malicious, this behavior could allow an attacker to persist in the environment and evade detection by security tools.
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 11
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.file_path) as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem
       WHERE Filesystem.file_path = "*$Recycle.Bin*"
       BY Filesystem.process_name Filesystem.process_id Filesystem.dest
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious writes to windows Recycle Bin process $process_name$ on $dest$
     entity:
diff --git a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml
index d0ab2e98694..03222a10944 100644
--- a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml
@@ -6,59 +6,13 @@ modification_date: '2026-10-09'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects instances of 'svchost.exe' spawning Living Off The Land Binaries and Scripts (LOLBAS) processes. It leverages Endpoint Detection and Response (EDR) data to monitor child processes of 'svchost.exe' that match known LOLBAS executables. This activity is significant as adversaries often use LOLBAS techniques to execute malicious code stealthily, potentially indicating lateral movement or code execution attempts.
-    If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
+description: 'The following analytic detects instances of ''svchost.exe'' spawning Living Off The Land Binaries and Scripts (LOLBAS) processes. It leverages Endpoint Detection and Response (EDR) data to monitor child processes of ''svchost.exe'' that match known LOLBAS executables. This activity is significant as adversaries often use LOLBAS techniques to execute malicious code stealthily, potentially indicating lateral movement or code execution attempts.
+
+    If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk.'
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    Processes.parent_process = "*"
-    Processes.parent_process_name = "svchost.exe"
-    Processes.process_name IN (
-        "At.exe", "Atbroker.exe", "Bash.exe", "Bitsadmin.exe", "Certoc.exe", "Cmstp.exe",
-        "Diskshadow.exe", "Dnscmd.exe", "Extexport.exe", "Forfiles.exe", "Ftp.exe",
-        "Gpscript.exe", "Hh.exe", "Ie4uinit.exe", "Ieexec.exe", "Infdefaultinstall.exe",
-        "Installutil.exe", "Mavinject.exe", "Microsoft.Workflow.Compiler.exe",
-        "Msbuild.exe", "Msconfig.exe", "Msdt.exe", "Msiexec.exe", "Netsh.exe",
-        "Odbcconf.exe", "OfflineScannerShell.exe", "Pcalua.exe", "Pcwrun.exe",
-        "Pnputil.exe", "PresentationHost.exe", "Rasautou.exe", "Regasm.exe",
-        "Register-cimprovider.exe", "Regsvcs.exe", "Regsvr32.exe", "Runonce.exe",
-        "Runscripthelper.exe", "Schtasks.exe", "Scriptrunner.exe", "SettingSyncHost.exe",
-        "Stordiag.exe", "Syncappvpublishingserver.exe", "Ttdinject.exe", "Mshta.exe",
-        "Tttracer.exe", "Verclsid.exe", "Wab.exe", "Wmic.exe",
-        "WorkFolders.exe", "Wuauclt.exe", "Xwizard.exe"
-    )
-    NOT (
-        Processes.parent_process IN ("*-k GPSvcGroup*", "*-k netsvcs", "*-k netsvcs -p","*-k netsvcs -p -s gpsvc")
-        Processes.process_name = "Gpscript.exe"
-    )
-    NOT (
-        Processes.parent_process IN ("*-k netsvcs", "*-k netsvcs -p", "*-k netsvcs -p -s wuauserv", "-k netsvcs -p -s Schedule")
-        Processes.process_name IN ("Wuauclt.exe", "Schtasks.exe")
-    )
-    NOT (
-        Processes.parent_process = "*-k DcomLaunch*"
-        Processes.process_name IN ("PresentationHost.exe", "SettingSyncHost.exe")
-    )
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `svchost_lolbas_execution_process_spawn_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process="*" Processes.parent_process_name="*svchost.exe" Processes.process_name IN ("*At.exe", "*Atbroker.exe", "*Bash.exe", "*Bitsadmin.exe", "*Certoc.exe", "*Cmstp.exe", "*Diskshadow.exe", "*Dnscmd.exe", "*Extexport.exe", "*Forfiles.exe", "*Ftp.exe", "*Gpscript.exe", "*Hh.exe", "*Ie4uinit.exe", "*Ieexec.exe", "*Infdefaultinstall.exe", "*Installutil.exe", "*Mavinject.exe", "*Microsoft.Workflow.Compiler.exe", "*Msbuild.exe", "*Msconfig.exe", "*Msdt.exe", "*Msiexec.exe", "*Netsh.exe", "*Odbcconf.exe", "*OfflineScannerShell.exe", "*Pcalua.exe", "*Pcwrun.exe", "*Pnputil.exe", "*PresentationHost.exe", "*Rasautou.exe", "*Regasm.exe", "*Register-cimprovider.exe", "*Regsvcs.exe", "*Regsvr32.exe", "*Runonce.exe", "*Runscripthelper.exe", "*Schtasks.exe", "*Scriptrunner.exe", "*SettingSyncHost.exe", "*Stordiag.exe", "*Syncappvpublishingserver.exe", "*Ttdinject.exe", "*Mshta.exe", "*Tttracer.exe", "*Verclsid.exe", "*Wab.exe", "*Wmic.exe", "*WorkFolders.exe", "*Wuauclt.exe", "*Xwizard.exe") NOT (Processes.parent_process IN ("*-k GPSvcGroup*", "*-k netsvcs*", "*-k netsvcs -p*", "*-k netsvcs -p -s gpsvc*")) Processes.process_name="*Gpscript.exe" NOT (Processes.parent_process IN ("*-k netsvcs", "*-k netsvcs -p", "*-k netsvcs -p -s wuauserv", "*-k netsvcs -p -s Schedule")) Processes.process_name IN ("*Wuauclt.exe", "*Schtasks.exe") NOT Processes.parent_process="*-k DcomLaunch*" Processes.process_name IN ("*PresentationHost.exe", "*SettingSyncHost.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `svchost_lolbas_execution_process_spawn_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate applications may trigger this behavior, filter as needed.
 references:
@@ -73,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The parent process[$parent_process$] spawned a Living Off The Land process [$process_name$] on [$dest$]
     entity:
diff --git a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml
index 40015e4c00d..0f417033915 100644
--- a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml
+++ b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml
@@ -12,17 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    (Processes.process_name=dxdiag.exe OR Processes.original_file_name=dxdiag.exe)
-    Processes.process = "* /t *"
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-    | `system_info_gathering_using_dxdiag_application_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*dxdiag.exe" OR Processes.original_file_name="dxdiag.exe" Processes.process="* /t *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_info_gathering_using_dxdiag_application_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: This commandline can be used by a network administrator to audit host machine specifications. Thus, a filter is needed.
 references:
diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml
index 1cda3a4ce34..49889528d93 100644
--- a/detections/endpoint/system_information_discovery_detection.yml
+++ b/detections/endpoint/system_information_discovery_detection.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*" OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest > 2 | stats values(process) as process values(action) as action values(original_file_name) as original_file_name values(parent_process) as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_path) as parent_process_path values(process_exec) as process_exec values(process_guid) as process_guid values(.process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) as process_integrity_level values(process_path) as process_path values(user_id) as user_id values(vendor_product) as vendor_product  min(firstTime) as firstTime max(lastTime) as lastTime by user, dest parent_process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_information_discovery_detection_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*" OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest > 2 | stats values(process) as process values(action) as action values(original_file_name) as original_file_name values(parent_process) as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_path) as parent_process_path values(process_exec) as process_exec values(process_guid) as process_guid values(.process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) as process_integrity_level values(process_path) as process_path values(user_id) as user_id values(vendor_product) as vendor_product  min(firstTime) as firstTime max(lastTime) as lastTime by user, dest parent_process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_information_discovery_detection_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators debugging servers
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential system information discovery behavior on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
index 1de08f7f7e3..e1e4a2ce667 100644
--- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml
+++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
@@ -52,7 +52,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml
index f2f2511cf5e..76d0e93c254 100644
--- a/detections/endpoint/system_user_discovery_with_query.yml
+++ b/detections/endpoint/system_user_discovery_with_query.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="query.exe"
-            OR
-            Processes.original_file_name="query.exe"
-        )
-        AND Processes.process="*user*" AND ((NOT Processes.process="*/server*") OR Processes.process IN ("*/server:localhost*", "*/server:127.0.0.1*"))
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `system_user_discovery_with_query_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*query.exe" OR Processes.original_file_name="query.exe" Processes.process="*user*" NOT Processes.process="*/server*" OR Processes.process IN ("*/server:localhost*", "*/server:127.0.0.1*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_user_discovery_with_query_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml
index 79d629583e5..6a77ea5bfd1 100644
--- a/detections/endpoint/system_user_discovery_with_whoami.yml
+++ b/detections/endpoint/system_user_discovery_with_whoami.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="whoami.exe"
-            OR
-            Processes.original_file_name="whoami.exe"
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `system_user_discovery_with_whoami_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*whoami.exe" OR Processes.original_file_name="whoami.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_user_discovery_with_whoami_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml
index 2510d5a640f..b8ea21252a8 100644
--- a/detections/endpoint/time_provider_persistence_registry.yml
+++ b/detections/endpoint/time_provider_persistence_registry.yml
@@ -6,38 +6,15 @@ modification_date: '2026-07-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
 type: TTP
-description: |-
-    The following analytic detects suspicious modifications to the time provider registry for persistence and autostart. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CurrentControlSet\\Services\\W32Time\\TimeProviders" registry path.
+description: 'The following analytic detects suspicious modifications to the time provider registry for persistence and autostart. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CurrentControlSet\\Services\\W32Time\\TimeProviders" registry path.
+
     This activity is significant because such modifications are uncommon and can indicate an attempt to establish persistence on a compromised host.
-    If confirmed malicious, this technique allows an attacker to maintain access and execute code automatically upon system boot, potentially leading to further exploitation and control over the affected system.
+
+    If confirmed malicious, this technique allows an attacker to maintain access and execute code automatically upon system boot, potentially leading to further exploitation and control over the affected system.'
 data_source:
     - Sysmon EventID 13
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Registry WHERE
-
-    Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders\\*"
-    Registry.registry_value_name = "DllName"
-    NOT Registry.registry_value_data IN
-    (
-        "%SystemRoot%\\System32\\vmictimeprovider.dll",
-        "%SystemRoot%\\System32\\w32time.dll",
-        "C:\\Windows\\System32\\vmictimeprovider.dll",
-        "C:\\Windows\\System32\\w32time.dll"
-    )
-
-    by Registry.action Registry.dest Registry.process_guid Registry.process_id
-       Registry.registry_hive Registry.registry_path Registry.registry_key_name
-       Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type
-       Registry.status Registry.user Registry.vendor_product
-
-    | `drop_dm_object_name(Registry)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `time_provider_persistence_registry_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders\\*" Registry.registry_value_name="*DllName" NOT (Registry.registry_value_data IN ("%SystemRoot%\\System32\\vmictimeprovider.dll", "%SystemRoot%\\System32\\w32time.dll", "C:\\Windows\\System32\\vmictimeprovider.dll", "C:\\Windows\\System32\\w32time.dll")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `time_provider_persistence_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -51,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: modified/added/deleted registry entry $registry_path$ on $dest$
     entity:
diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml
index 0e32426fde4..84120eec210 100644
--- a/detections/endpoint/trickbot_named_pipe.yml
+++ b/detections/endpoint/trickbot_named_pipe.yml
@@ -10,7 +10,8 @@ description: The following analytic detects the creation or connection to a name
 data_source:
     - Sysmon EventID 17
     - Sysmon EventID 18
-search: '`sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" | stats  min(_time) as firstTime max(_time) as lastTime count by dest dvc pipe_name process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product Image PipeName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `trickbot_named_pipe_filter`'
+search: |
+    `sysmon` EventCode=17 EventCode="18" PipeName="\\pipe\*lacesomepipe" | eval PipeName=PipeName | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc pipe_name process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `trickbot_named_pipe_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. .
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible Trickbot namedpipe created on $dest$ by $process_name$
     entity:
diff --git a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
index bdb550a92da..13c56c7c3d1 100644
--- a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
+++ b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the loading of an unsigned DLL by the MMC.exe application, which is indicative of a potential UAC bypass or privilege escalation attempt. It leverages Sysmon EventCode 7 to identify instances where MMC.exe loads a non-Microsoft, unsigned DLL. This activity is significant because attackers often use this technique to modify CLSID registry entries, causing MMC.exe to load malicious DLLs, thereby bypassing User Account Control (UAC) and gaining elevated privileges. If confirmed malicious, this could allow an attacker to execute arbitrary code with higher privileges, leading to further system compromise and persistence.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7  ImageLoaded = "*.dll" Image = "*\\mmc.exe" Signed=false Company != "Microsoft Corporation" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_mmc_load_unsigned_dll_filter`'
+search: |
+    `sysmon` EventCode=7 ImageLoaded="*.dll" Image="*\\mmc.exe" Signed="false" NOT Company="Microsoft Corporation" | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_mmc_load_unsigned_dll_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time. dll.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $dest$
     entity:
diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml
index f0fd722256a..c87d13aada3 100644
--- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml
+++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a potential UAC bypass using the colorui.dll COM Object. It leverages Sysmon EventCode 7 to identify instances where colorui.dll is loaded by a process other than colorcpl.exe, excluding common system directories. This activity is significant because UAC bypass techniques are often used by malware, such as LockBit ransomware, to gain elevated privileges without user consent. If confirmed malicious, this could allow an attacker to execute code with higher privileges, leading to further system compromise and persistence within the environment.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" NOT(Image IN("*\\windows\\*", "*\\program files*")) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_with_colorui_com_object_filter`'
+search: |
+    `sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" NOT process_name="colorcpl.exe" NOT (Image IN ("*\\windows\\*", "*\\program files*")) | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_with_colorui_com_object_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: not so common. but 3rd part app may load this dll.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $dest$.
     entity:
diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml
index b486f538a91..4e756bbb687 100644
--- a/detections/endpoint/uninstall_app_using_msiexec.yml
+++ b/detections/endpoint/uninstall_app_using_msiexec.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=msiexec.exe Processes.process= "* /qn *" Processes.process= "*/X*" Processes.process= "*REBOOT=*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `uninstall_app_using_msiexec_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*msiexec.exe" Processes.process="* /qn *" Processes.process="*/X*" Processes.process="*REBOOT=*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uninstall_app_using_msiexec_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: process $process_name$ with a cmdline $process$ in host $dest$
     entity:
diff --git a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
index 4820acf5889..4ac0bd0919c 100644
--- a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
+++ b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies a non-lsass.exe process making an outbound connection on port 88, which is typically used by the Kerberos authentication protocol. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and network traffic logs. This activity is significant because, under normal circumstances, only the lsass.exe process should interact with the Kerberos Distribution Center. If confirmed malicious, this behavior could indicate an adversary attempting to abuse the Kerberos protocol, potentially leading to unauthorized access or lateral movement within the network.
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 3
-search: |-
+search: |
     | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
       WHERE Processes.process_name!=lsass.exe
       BY _time Processes.action Processes.dest
@@ -49,7 +49,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Unknown process $process_name$ using the kerberos protocol detected on host $dest$
     entity:
diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml
index 0761ee9525e..32d28efd58f 100644
--- a/detections/endpoint/unload_sysmon_filter_driver.yml
+++ b/detections/endpoint/unload_sysmon_filter_driver.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=fltMC.exe
-        AND
-        Processes.process=*unload*
-        AND
-        Processes.process=*SysmonDrv*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table firstTime lastTime dest user count process_name process_id parent_process_name process
-    | `unload_sysmon_filter_driver_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*fltMC.exe" Processes.process="*unload*" Processes.process="*SysmonDrv*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `unload_sysmon_filter_driver_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -43,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible Sysmon filter driver unloading on $dest$
     entity:
diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml
index 19751a18860..744e5eb268f 100644
--- a/detections/endpoint/unloading_amsi_via_reflection.yml
+++ b/detections/endpoint/unloading_amsi_via_reflection.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the tampering of AMSI (Antimalware Scan Interface) via PowerShell reflection. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze suspicious PowerShell commands, specifically those involving `system.management.automation.amsi`. This activity is significant as it indicates an attempt to bypass AMSI, a critical security feature that helps detect and block malicious scripts. If confirmed malicious, this could allow an attacker to execute harmful code undetected, leading to potential system compromise and data exfiltration.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = *system.management.automation.amsi*
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `unloading_amsi_via_reflection_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*system.management.automation.amsi*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `unloading_amsi_via_reflection_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Potential for some third party applications to disable AMSI upon invocation. Filter as needed.
 references:
@@ -36,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible AMSI Unloading via Reflection using PowerShell on $dest$
     entity:
diff --git a/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml
index f62ffa5516b..41f33fffc3f 100644
--- a/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml
+++ b/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic identifies an unusual number of computer service ticket requests from a single source, leveraging Event ID 4769, "A Kerberos service ticket was requested." It uses statistical analysis, including standard deviation and the 3-sigma rule, to detect anomalies in service ticket requests. This activity is significant as it may indicate malicious behavior such as lateral movement, malware staging, or reconnaissance. If confirmed malicious, an attacker could gain unauthorized access to multiple endpoints, facilitating further compromise and potential data exfiltration.
 data_source:
     - Windows Event Log Security 4769
-search: |-
+search: |
     `wineventlog_security` EventCode=4769 Service_Name="*$" Account_Name!="*$*"
       | bucket span=2m _time
       | stats dc(Service_Name) AS unique_targets values(Service_Name) as host_targets
diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
index 08b54c5613d..a6be3055fd0 100644
--- a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
+++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies an unusual number of Kerberos service ticket requests, potentially indicating a kerberoasting attack. It leverages Kerberos Event 4769 and calculates the standard deviation for each host, using the 3-sigma rule to detect anomalies. This activity is significant as kerberoasting allows adversaries to request service tickets and crack them offline, potentially gaining privileged access to the domain. If confirmed malicious, this could lead to unauthorized access to sensitive accounts and escalation of privileges within the Active Directory environment.
 data_source:
     - Windows Event Log Security 4769
-search: |-
+search: |
     `wineventlog_security` EventCode=4769 ServiceName!="*$" TicketEncryptionType=0x17
       | bucket span=2m _time
       | stats dc(ServiceName) AS unique_services values(ServiceName) as requested_services values(user_category) as user_category values(src_category) as src_category values(dest) as dest
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml b/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml
index e52b2b58dad..159afefa6b0 100644
--- a/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml
+++ b/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic identifies an unusual number of remote authentication attempts from a single source by leveraging Windows Event ID 4624, which logs successful account logons. It uses statistical analysis, specifically the 3-sigma rule, to detect deviations from normal behavior. This activity is significant for a SOC as it may indicate lateral movement, malware staging, or reconnaissance. If confirmed malicious, this behavior could allow an attacker to move laterally within the network, escalate privileges, or gather information for further attacks.
 data_source:
     - Windows Event Log Security 4624
-search: |-
+search: |
     `wineventlog_security` EventCode=4624 Logon_Type=3 Account_Name!="*$"
       | eval Source_Account = mvindex(Account_Name, 1)
       | bucket span=2m _time
diff --git a/detections/endpoint/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml
index 5af4f8d3475..0193fe09bfd 100644
--- a/detections/endpoint/unusually_long_command_line.yml
+++ b/detections/endpoint/unusually_long_command_line.yml
@@ -11,7 +11,7 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
       BY Processes.action Processes.dest Processes.original_file_name
          Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell.yml b/detections/endpoint/user_discovery_with_env_vars_powershell.yml
index 57b0d50680c..d39bc09b9cf 100644
--- a/detections/endpoint/user_discovery_with_env_vars_powershell.yml
+++ b/detections/endpoint/user_discovery_with_env_vars_powershell.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="powershell.exe"
-        )
-        (Processes.process="*$env:UserName*" OR Processes.process="*[System.Environment]::UserName*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `user_discovery_with_env_vars_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*powershell.exe" Processes.process IN ("*$env:UserName*", "*[System.Environment]::UserName*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `user_discovery_with_env_vars_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
index 5d3c9681ab5..ee5c746c3f8 100644
--- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
+++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects the use of PowerShell environment variables to identify the current logged user by leveraging PowerShell Script Block Logging (EventCode=4104). This method monitors script blocks containing `$env:UserName` or `[System.Environment]::UserName`. Identifying this activity is significant as adversaries and Red Teams may use it for situational awareness and Active Directory discovery on compromised endpoints. If confirmed malicious, this activity could allow attackers to gain insights into user context, aiding in further exploitation and lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText = "*$env:UserName*" OR ScriptBlockText = "*[System.Environment]::UserName*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `user_discovery_with_env_vars_powershell_script_block_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*$env:UserName*", "*[System.Environment]::UserName*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `user_discovery_with_env_vars_powershell_script_block_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
 references:
diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml
index 634a025820c..08aecad9079 100644
--- a/detections/endpoint/usn_journal_deletion.yml
+++ b/detections/endpoint/usn_journal_deletion.yml
@@ -12,28 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count values(Processes.process) as process
-            values(Processes.parent_process) as parent_process
-            min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_name=fsutil.exe
-    Processes.process = "*usn*"
-    Processes.process = "*deletejournal*"
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `usn_journal_deletion_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*fsutil.exe" Processes.process="*usn*" Processes.process="*deletejournal*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `usn_journal_deletion_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -47,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible USN journal deletion on $dest$ via $process$
     entity:
diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml
index 628db714370..488e251e0e2 100644
--- a/detections/endpoint/vbscript_execution_using_wscript_app.yml
+++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml
@@ -9,25 +9,8 @@ type: TTP
 description: The following analytic detects the execution of VBScript using the wscript.exe application. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant because wscript.exe is typically not used to execute VBScript, which is usually associated with cscript.exe. This deviation can indicate an attempt to evade traditional process monitoring and antivirus defenses. If confirmed malicious, this technique could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.parent_process_name = "wscript.exe"
-            AND
-            Processes.parent_process = "*//e:vbscript*"
-        )
-        OR (Processes.process_name = "wscript.exe" AND Processes.process = "*//e:vbscript*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `vbscript_execution_using_wscript_app_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.parent_process_name="*wscript.exe" Processes.parent_process="*//e:vbscript*") OR (Processes.process_name="*wscript.exe" Processes.process="*//e:vbscript*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `vbscript_execution_using_wscript_app_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -41,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Process name $process_name$ with commandline $process$ to execute vbsscript
     entity:
diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml
index 5eb6ff0a07a..f8f2866aeb6 100644
--- a/detections/endpoint/verclsid_clsid_execution.yml
+++ b/detections/endpoint/verclsid_clsid_execution.yml
@@ -12,24 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` values(Processes.process) as process
-    values(Processes.parent_process) as parent_process values(Processes.process_id)
-    as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where
-    (Processes.process_name="verclsid.exe" OR Processes.original_file_name="verclsid.exe")
-    Processes.process="*/S*"
-    Processes.process="*/C*"
-    Processes.process="*{*"
-    Processes.process="*}*"
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
-       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
-       Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `verclsid_clsid_execution_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*verclsid.exe" OR Processes.original_file_name="verclsid.exe" Processes.process="*/S*" Processes.process="*/C*" Processes.process="*{*" Processes.process="*}*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `verclsid_clsid_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: windows can used this application for its normal COM object validation.
 references:
diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml
index 2667b4b122f..4a6f5771466 100644
--- a/detections/endpoint/wbadmin_delete_system_backups.yml
+++ b/detections/endpoint/wbadmin_delete_system_backups.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=wbadmin.exe
-            OR
-            Processes.original_file_name=WBADMIN.EXE
-        )
-        Processes.process="*delete*" ( Processes.process="*catalog*" OR Processes.process="*backup*" )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `wbadmin_delete_system_backups_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wbadmin.exe" OR Processes.original_file_name="WBADMIN.EXE" Processes.process="*delete*" Processes.process IN ("*catalog*", "*backup*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wbadmin_delete_system_backups_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may modify the boot configuration.
 references:
@@ -47,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: System backups deletion on $dest$
     entity:
diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml
index 455b66d9bbe..010cbf5795f 100644
--- a/detections/endpoint/wbemprox_com_object_execution.yml
+++ b/detections/endpoint/wbemprox_com_object_execution.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a suspicious process loading a COM object from wbemprox.dll, fastprox.dll, or wbemcomn.dll. It leverages Sysmon EventCode 7 to identify instances where these DLLs are loaded by processes not typically associated with them, excluding known legitimate processes and directories. This activity is significant as it may indicate an attempt by threat actors to abuse COM objects for privilege escalation or evasion of detection mechanisms. If confirmed malicious, this could allow attackers to gain elevated privileges or maintain persistence within the environment, posing a significant security risk.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7  ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll", "*\\wbemcomn.dll") NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe")) NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wbemprox_com_object_execution_filter`'
+search: |
+    `sysmon` EventCode=7 ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll", "*\\wbemcomn.dll") NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe")) NOT (Image IN ("*\\windows\\*", "*\\program files*", "*\\wbem\\*")) | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wbemprox_com_object_execution_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: legitimate process that are not in the exception list may trigger this event.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious COM Object Execution on $dest$
     entity:
diff --git a/detections/endpoint/web_or_application_server_spawning_a_shell.yml b/detections/endpoint/web_or_application_server_spawning_a_shell.yml
index 1c5e3171f08..807ec63ccf0 100644
--- a/detections/endpoint/web_or_application_server_spawning_a_shell.yml
+++ b/detections/endpoint/web_or_application_server_spawning_a_shell.yml
@@ -6,57 +6,44 @@ modification_date: '2026-05-13'
 author: Michael Haag, Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects instances where Java, or Tomcat
+description: 'The following analytic detects instances where Java, or Tomcat
+
     processes spawn a Linux shell, which may indicate exploitation attempts, such as
+
     those related to CVE-2021-44228 (Log4Shell). This detection leverages Endpoint Detection
+
     and Response (EDR) telemetry, focusing on process names and parent-child process
+
     relationships. This activity is significant as it can signify a compromised Java
+
     application, potentially leading to unauthorized shell access. If confirmed malicious,
+
     attackers could execute arbitrary commands, escalate privileges, or maintain persistent
-    access, posing a severe threat to the environment.
+
+    access, posing a severe threat to the environment.'
 data_source:
     - Sysmon for Linux EventID 1
     - Sysmon EventID 1
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    (
-      Processes.parent_process_name IN ("java", "tomcat*", "httpd", "lighttpd", "apache2", "nginx", "node", "caddy")
-      `linux_shells`
-    )
-    OR
-    (
-      Processes.parent_process_name IN ("httpd.exe", "nginx.exe", "php*.exe", "php-cgi.exe", "tomcat*.exe", "caddy.exe", "UMWorkerProcess.exe", "w3wp.exe", "ws_TomcatService.exe", "node.exe", "java.exe")
-      `windows_shells`
-    )
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.parent_process_name IN ("java", "tomcat", "httpd", "lighttpd", "apache2", "nginx", "node", "caddy") Processes.process_name IN ("*sh", "*ksh", "*zsh", "*bash", "*dash", "*rbash", "*fish", "*csh", "*tcsh", "*ion", "*eshell")) OR (Processes.parent_process_name IN ("httpd.exe", "nginx.exe", "php*.exe", "php-cgi.exe", "tomcat*.exe", "caddy.exe", "UMWorkerProcess.exe", "w3wp.exe", "ws_TomcatService.exe", "node.exe", "java.exe") Processes.process_name IN ("*cmd.exe", "*powershell.exe", "*powershell_ise.exe", "*pwsh.exe", "*sh.exe", "*bash.exe", "*wscript.exe", "*cscript.exe", "*wt.exe", "*WindowsTerminal.exe", "*mshta.exe")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `web_or_application_server_spawning_a_shell_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `web_or_application_server_spawning_a_shell_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    Filtering may be required on internal developer build systems or classify assets as web facing and restrict the analytic based on asset type.
+
+    names and speed up the data modeling process.'
+known_false_positives: Filtering may be required on internal developer build systems or classify assets as web facing and restrict the analytic based on asset type.
 references:
     - https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
     - https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72
@@ -68,7 +55,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ spawning a Linux shell, potentially indicative of exploitation.
     entity:
diff --git a/detections/endpoint/web_servers_executing_suspicious_processes.yml b/detections/endpoint/web_servers_executing_suspicious_processes.yml
index bcc300d0a1f..69f1585d4ef 100644
--- a/detections/endpoint/web_servers_executing_suspicious_processes.yml
+++ b/detections/endpoint/web_servers_executing_suspicious_processes.yml
@@ -9,32 +9,8 @@ type: TTP
 description: The following analytic detects the execution of suspicious processes on systems identified as web servers. It leverages the Splunk data model "Endpoint.Processes" to search for specific process names such as "whoami", "ping", "iptables", "wget", "service", and "curl". This activity is significant because these processes are often used by attackers for reconnaissance, persistence, or data exfiltration. If confirmed malicious, this could lead to data theft, deployment of additional malware, or even ransomware attacks. Immediate investigation is required to determine the legitimacy of the activity and mitigate potential threats.
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.dest_category="web_server"
-        AND
-        (Processes.process="*whoami*"
-        OR
-        Processes.process="*ping*"
-        OR
-        Processes.process="*iptables*"
-        OR
-        Processes.process="*wget*"
-        OR
-        Processes.process="*service*"
-        OR
-        Processes.process="*curl*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `web_servers_executing_suspicious_processes_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*whoami*", "*ping*", "*iptables*", "*wget*", "*service*", "*curl*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `web_servers_executing_suspicious_processes_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some of these processes may be used legitimately on web servers during maintenance or other administrative tasks.
 references: []
diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml
index 49df569c28d..2c8150ae440 100644
--- a/detections/endpoint/wermgr_process_create_executable_file.yml
+++ b/detections/endpoint/wermgr_process_create_executable_file.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic detects the wermgr.exe process creating an executable file. It leverages Sysmon EventCode 11 to identify instances where wermgr.exe generates a .exe file. This behavior is unusual because wermgr.exe is typically associated with error reporting, not file creation. Such activity is significant as it may indicate TrickBot malware, which injects code into wermgr.exe to execute malicious actions like downloading additional payloads. If confirmed malicious, this could lead to further malware infections, data exfiltration, or system compromise.
 data_source:
     - Sysmon EventID 11
-search: |-
-    `sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe"
-      | stats  min(_time) as firstTime max(_time) as lastTime count
-        BY action dest file_name
-           file_path process_guid process_id
-           user_id vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `wermgr_process_create_executable_file_filter`
+search: |
+    `sysmon` EventCode=11 process_name="wermgr.exe" TargetFilename="*.exe" | eval process_name=process_name, root_drive=root_drive | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name file_path process_guid process_id user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_create_executable_file_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -31,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Wermgr.exe writing executable files on $dest$
     entity:
diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
index 8abb0bee2b1..2d19b2fae0b 100644
--- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
+++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as cmdline min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name = "wermgr.exe" `process_cmd`
-        OR
-        `process_powershell`
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `wermgr_process_spawned_cmd_or_powershell_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.parent_process_name="*wermgr.exe" Processes.process_name="*cmd.exe" OR Processes.original_file_name="Cmd.Exe") OR Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_spawned_cmd_or_powershell_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -40,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Wermgr.exe spawning suspicious processes on $dest$
     entity:
diff --git a/detections/endpoint/windows__key_file_creation_in_root_directory.yml b/detections/endpoint/windows__key_file_creation_in_root_directory.yml
index bce102c1ac8..6fc6c65be25 100644
--- a/detections/endpoint/windows__key_file_creation_in_root_directory.yml
+++ b/detections/endpoint/windows__key_file_creation_in_root_directory.yml
@@ -6,31 +6,13 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects the creation of a .key file in the root directory of the system drive.
-    This activity was seen with various ransomware before performing encryption of files.
+description: 'Detects the creation of a .key file in the root directory of the system drive.
+
+    This activity was seen with various ransomware before performing encryption of files.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-    count min(_time) as firstTime
-          max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.file_name="*.key"
-
-    by Filesystem.dest Filesystem.file_create_time
-       Filesystem.process_path Filesystem.process_guid
-       Filesystem.process_id Filesystem.file_path
-       Filesystem.action Filesystem.file_name
-       Filesystem.user Filesystem.vendor_product
-
-    | `drop_dm_object_name(Filesystem)`
-    | where match(file_path, "^[A-Za-z]:\\\\[^\\\\]+\.key$")
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows__key_file_creation_in_root_directory_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.key" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows__key_file_creation_in_root_directory_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may occur if legitimate software or administrative tools create key files in the root directory, although this is uncommon in normal operations. Filter alerts based on known approved applications.
 references:
@@ -43,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
index f13ca4cd96e..092298c1464 100644
--- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
+++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects a process enabling the "SeDebugPrivilege" privilege token. It leverages Windows Security Event Logs with EventCode 4703, filtering out common legitimate processes. This activity is significant because SeDebugPrivilege allows a process to inspect and modify the memory of other processes, potentially leading to credential dumping or code injection. If confirmed malicious, an attacker could gain extensive control over system processes, enabling them to escalate privileges, persist in the environment, or access sensitive information.
 data_source:
     - Windows Event Log Security 4703
-search: '`wineventlog_security` EventCode=4703 EnabledPrivilegeList = "*SeDebugPrivilege*" AND NOT(ProcessName IN ("*\\Program File*", "*\\System32\\lsass.exe*", "*\\SysWOW64\\lsass.exe*", "*\\SysWOW64\\svchost.exe*", "*\\System32\\svchost.exe*")) | stats count min(_time) as firstTime max(_time) as lastTime by Computer ProcessName ProcessId SubjectDomainName SubjectUserName SubjectUserSid TargetUserName TargetLogonId TargetDomainName EnabledPrivilegeList action dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_manipulation_sedebugprivilege_filter`'
+search: |
+    `wineventlog_security` EventCode=4703 EnabledPrivilegeList="*SeDebugPrivilege*" NOT (ProcessName IN ("*\\Program File*", "*\\System32\\lsass.exe*", "*\\SysWOW64\\lsass.exe*", "*\\SysWOW64\\svchost.exe*", "*\\System32\\svchost.exe*")) | eval Computer=Computer | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_manipulation_sedebugprivilege_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4703 EventCode enabled. The Windows TA is also required.
 known_false_positives: Some native binaries and browser applications may request SeDebugPrivilege. Filter as needed.
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: Computer
diff --git a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml
index b29ba78c190..facb8d8615c 100644
--- a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml
+++ b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml
@@ -6,12 +6,12 @@ modification_date: '2026-09-08'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
-description: |-
-    The following analytic detects a process requesting duplicate-handle and query-limited-information access to winlogon.exe.
-    It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000).
+description: 'The following analytic detects a process requesting duplicate-handle and query-limited-information access to winlogon.exe.
+
+    It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000).'
 data_source:
     - Sysmon EventID 10
-search: |-
+search: |
     `sysmon`
     EventCode=10
     TargetImage="*:\\Windows\\system32\\winlogon.exe"
@@ -49,10 +49,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter`
-how_to_implement: |-
-    To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: |-
-    It is possible legitimate applications will request access to winlogon, filter as needed.
+how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed.
 references:
     - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle
     - https://attack.mitre.org/techniques/T1134/001/
diff --git a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml
index c6f811f2d9e..d4ef685ffb0 100644
--- a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml
+++ b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml
@@ -6,12 +6,12 @@ modification_date: '2026-09-08'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects duplicate-handle and query-limited-information access to winlogon.exe from an uncommon or public source path.
-    It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000).
+description: 'The following analytic detects duplicate-handle and query-limited-information access to winlogon.exe from an uncommon or public source path.
+
+    It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000).'
 data_source:
     - Sysmon EventID 10
-search: |-
+search: |
     `sysmon`
     EventCode=10
     TargetImage="*:\\Windows\\System32\\winlogon.exe"
@@ -46,8 +46,7 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter`
-how_to_implement: |-
-    To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed.
 references:
     - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle
@@ -60,7 +59,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_account_access_removal_via_logoff_exec.yml b/detections/endpoint/windows_account_access_removal_via_logoff_exec.yml
index 6667bc8d221..e7132581f45 100644
--- a/detections/endpoint/windows_account_access_removal_via_logoff_exec.yml
+++ b/detections/endpoint/windows_account_access_removal_via_logoff_exec.yml
@@ -6,23 +6,11 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: "The following analytic detects the process of logging off a user through the use of the quser and logoff commands. By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. This detection helps identify potential misuse or malicious activity where a user’s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation."
+description: The following analytic detects the process of logging off a user through the use of the quser and logoff commands. By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. This detection helps identify potential misuse or malicious activity where a user’s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation.
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = logoff.exe Processes.parent_process_name IN ("cmd.exe", "powershell.exe", "pwsh.exe")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_account_access_removal_via_logoff_exec_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*logoff.exe" Processes.parent_process_name IN ("*cmd.exe", "*powershell.exe", "*pwsh.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_account_access_removal_via_logoff_exec_filter`
 how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators or power users may use this command.
 references:
@@ -35,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_account_discovery_for_none_disable_user_account.yml b/detections/endpoint/windows_account_discovery_for_none_disable_user_account.yml
index ef305f73c29..b75a02cef48 100644
--- a/detections/endpoint/windows_account_discovery_for_none_disable_user_account.yml
+++ b/detections/endpoint/windows_account_discovery_for_none_disable_user_account.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects the execution of the PowerView PowerShell cmdlet Get-NetUser with the UACFilter parameter set to NOT_ACCOUNTDISABLE, indicating an attempt to enumerate Active Directory user accounts that are not disabled. This detection leverages PowerShell Script Block Logging (EventCode 4104) to identify the specific script block text. Monitoring this activity is significant as it may indicate reconnaissance efforts by an attacker to identify active user accounts for further exploitation. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, or lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104  ScriptBlockText = "*Get-NetUser*" ScriptBlockText = "*NOT_ACCOUNTDISABLE*" ScriptBlockText = "*-UACFilter*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_account_discovery_for_none_disable_user_account_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-NetUser*" Processes.process="*NOT_ACCOUNTDISABLE*" Processes.process="*-UACFilter*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_account_discovery_for_none_disable_user_account_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.=
 known_false_positives: Administrators may leverage PowerView for legitimate purposes, filter as needed.
 references:
diff --git a/detections/endpoint/windows_account_discovery_for_sam_account_name.yml b/detections/endpoint/windows_account_discovery_for_sam_account_name.yml
index 56faedd9896..802d845fb82 100644
--- a/detections/endpoint/windows_account_discovery_for_sam_account_name.yml
+++ b/detections/endpoint/windows_account_discovery_for_sam_account_name.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the PowerView PowerShell cmdlet Get-NetUser, specifically querying for "samaccountname" and "pwdlastset" attributes. It leverages Event ID 4104 from PowerShell Script Block Logging to identify this activity. This behavior is significant as it may indicate an attempt to gather user account information from Active Directory, which is a common reconnaissance step in lateral movement or privilege escalation attacks. If confirmed malicious, this activity could allow an attacker to map out user accounts, potentially leading to further exploitation and unauthorized access within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104  ScriptBlockText = "*Get-NetUser*" ScriptBlockText IN ("*samaccountname*", "*pwdlastset*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_account_discovery_for_sam_account_name_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-NetUser*" Processes.process IN ("*samaccountname*", "*pwdlastset*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_account_discovery_for_sam_account_name_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.=
 known_false_positives: Administrators may leverage PowerView for legitimate purposes, filter as needed.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_account_discovery_with_netuser_preauthnotrequire.yml b/detections/endpoint/windows_account_discovery_with_netuser_preauthnotrequire.yml
index c4aee0bd79f..a13b0feaa82 100644
--- a/detections/endpoint/windows_account_discovery_with_netuser_preauthnotrequire.yml
+++ b/detections/endpoint/windows_account_discovery_with_netuser_preauthnotrequire.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects the execution of the PowerView PowerShell cmdlet Get-NetUser with the -PreauthNotRequire parameter, leveraging Event ID 4104. This method identifies attempts to query Active Directory user accounts that do not require Kerberos preauthentication. Monitoring this activity is crucial as it can indicate reconnaissance efforts by an attacker to identify potentially vulnerable accounts. If confirmed malicious, this behavior could lead to further exploitation, such as unauthorized access or privilege escalation within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104  ScriptBlockText = "*Get-NetUser*" ScriptBlockText = "*-PreauthNotRequire*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_account_discovery_with_netuser_preauthnotrequire_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-NetUser*" Processes.process="*-PreauthNotRequire*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_account_discovery_with_netuser_preauthnotrequire_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.=
 known_false_positives: Administrators may leverage PowerView for legitimate purposes, filter as needed.
 references:
diff --git a/detections/endpoint/windows_ad_abnormal_object_access_activity.yml b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml
index 96cb9fa2aea..9c14af14e42 100644
--- a/detections/endpoint/windows_ad_abnormal_object_access_activity.yml
+++ b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a statistically significant increase in access to Active Directory objects, which may indicate attacker enumeration. It leverages Windows Security Event Code 4662 to monitor and analyze access patterns, comparing them against historical averages to detect anomalies. This activity is significant for a SOC because abnormal access to AD objects can be an early indicator of reconnaissance efforts by an attacker. If confirmed malicious, this behavior could lead to unauthorized access, privilege escalation, or further compromise of the Active Directory environment.
 data_source:
     - Windows Event Log Security 4662
-search: |-
+search: |
     `wineventlog_security` EventCode=4662
       | stats min(_time) AS firstTime, max(_time) AS lastTime, dc(ObjectName) AS ObjectName_count, values(ObjectType) AS ObjectType, latest(Computer) AS dest count
         BY SubjectUserName
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_ad_add_self_to_group.yml b/detections/endpoint/windows_ad_add_self_to_group.yml
index 8917a0c2b9f..bef73be8437 100644
--- a/detections/endpoint/windows_ad_add_self_to_group.yml
+++ b/detections/endpoint/windows_ad_add_self_to_group.yml
@@ -9,13 +9,8 @@ type: TTP
 description: This analytic detects instances where a user adds themselves to an Active Directory (AD) group. This activity is a common indicator of privilege escalation, where a user attempts to gain unauthorized access to higher privileges or sensitive resources. By monitoring AD logs, this detection identifies such suspicious behavior, which could be part of a larger attack strategy aimed at compromising critical systems and data.
 data_source:
     - Windows Event Log Security 4728
-search: |-
-    `wineventlog_security` EventCode IN (4728)
-      | where lower(user)=lower(src_user)
-      | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc
-        BY signature, Group_Name, src_user,
-           dest
-      | `windows_ad_add_self_to_group_filter`
+search: |
+    `wineventlog_security` EventCode="4728" | eval user=user, Group_Name=Group_Name | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ad_add_self_to_group_filter`
 how_to_implement: This analytic requires eventCode 4728 to be ingested.
 known_false_positives: No false positives have been identified at this time.
 references: []
@@ -27,7 +22,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $user$ added themselves to AD Group $Group_Name$
     entity:
diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml
index 22272eb1e64..9f44234fe8c 100644
--- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml
+++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Access Control List (ACL) of the AdminSDHolder object in a Windows domain, specifically the addition of new rules. It leverages EventCode 5136 from the Security Event Log, focusing on changes to the nTSecurityDescriptor attribute. This activity is significant because the AdminSDHolder object secures privileged group members, and unauthorized changes can allow attackers to establish persistence and escalate privileges. If confirmed malicious, this could enable an attacker to control domain-level permissions, compromising the entire Active Directory environment.
 data_source:
     - Windows Event Log Security 5136
-search: '`wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN="CN=AdminSDHolder,CN=System*"  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"  | mvexpand new_ace | where NOT new_ace IN (old_values)  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$" | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value  | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group``` | lookup local=t builtin_groups_lookup builtin_group_string  as aceSid OUTPUTNEW builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_adminsdholder_acl_modified_filter`'
+search: |
+    `wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN="CN=AdminSDHolder,CN=System*"  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"  | mvexpand new_ace | where NOT new_ace IN (old_values)  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$" | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value  | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group``` | lookup local=t builtin_groups_lookup builtin_group_string  as aceSid OUTPUTNEW builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_adminsdholder_acl_modified_filter`
 how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for the AdminSDHolder object in order to log modifications.
 known_false_positives: Adding new users or groups to the AdminSDHolder ACL is not usual. Filter as needed
 references:
@@ -29,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The AdminSDHolder domain object $ObjectDN$ has been modified by $src_user$
     entity:
diff --git a/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml b/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml
index a2fef1d15e8..69cf553e917 100644
--- a/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml
+++ b/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml
@@ -6,49 +6,23 @@ modification_date: '2026-09-25'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects a user account (non-machine account) adding or removing a servicePrincipalName (SPN) on a computer object in Active Directory, via Windows Security Event 5136.
+description: 'The following analytic detects a user account (non-machine account) adding or removing a servicePrincipalName (SPN) on a computer object in Active Directory, via Windows Security Event 5136.
+
     In normal AD operations, SPN values on computer objects are managed exclusively by the computer account itself (during domain join or name change), by Domain Controllers during replication, or by the SYSTEM/NETWORK SERVICE context — all of which appear as accounts ending in the dollar sign ($) convention.
-    A named user account writing to the servicePrincipalName attribute of a computer object is anomalous and may indicate an attacker with delegated WriteProperty rights over computer accounts performing SPN manipulation.
+
+    A named user account writing to the servicePrincipalName attribute of a computer object is anomalous and may indicate an attacker with delegated WriteProperty rights over computer accounts performing SPN manipulation.'
 data_source:
     - Windows Event Log Security 5136
-search: |-
-    `wineventlog_security`
-    EventCode=5136
-    AttributeLDAPDisplayName=servicePrincipalName
-    ObjectClass=computer
-    NOT SubjectUserName="*$"
-    NOT SubjectUserSid IN (
-        "S-1-5-18",
-        "S-1-5-19",
-        "S-1-5-20"
-    )
-    NOT SubjectUserName IN (
-        "*ANONYMOUS*",
-        "*NT AUTHORITY*",
-        "*SYSTEM"
-    )
-
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-                  values(AttributeValue) as spn_values
-                  values(OperationType) as operation_types
-      by Computer SubjectUserName SubjectDomainName SubjectUserSid ObjectDN
-
-    | eval operation_types=mvmap(operation_types, case(operation_types="%%14675", "Deleted", operation_types="%%14674", "Added", true(), operation_types))
+search: |
+    `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName="servicePrincipalName" ObjectClass="computer" NOT SubjectUserName="*$" NOT (SubjectUserSid IN ("S-1-5-18", "S-1-5-19", "S-1-5-20")) NOT (SubjectUserName IN ("*ANONYMOUS*", "*NT AUTHORITY*", "*SYSTEM*")) | eval ObjectDN=ObjectDN, SubjectUserName=SubjectUserName, SubjectUserSid=SubjectUserSid, Computer=Computer, User=SubjectUserSid, user=SubjectUserName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ad_computer_spn_modified_by_user_account_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller Security event logs. Enable the Advanced Security Audit policy `DS Access > Audit Directory Service Changes` for Success events. A WriteProperty audit SACL must also be configured on the computer object class (or CN=Computers container with inheritance) to generate Event 5136 when servicePrincipalName is modified.
+known_false_positives: 'Administrators using tools such as setspn.exe, ADSI Edit, or PowerShell AD modules to manually manage SPNs on computer objects will trigger this detection.
 
-    | rename Computer as dest
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_ad_computer_spn_modified_by_user_account_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting Domain Controller Security event logs. Enable the Advanced Security Audit policy `DS Access > Audit Directory Service Changes` for Success events. A WriteProperty audit SACL must also be configured on the computer object class (or CN=Computers container with inheritance) to generate Event 5136 when servicePrincipalName is modified.
-known_false_positives: |-
-    Administrators using tools such as setspn.exe, ADSI Edit, or PowerShell AD modules to manually manage SPNs on computer objects will trigger this detection.
     Service account provisioning workflows and some third-party identity management platforms may also legitimately modify computer SPNs.
+
     Review the SubjectUserName, ObjectDN, and spn_values fields to determine if the change is expected.
-    Consider adding known administrative accounts to the filter macro.
+
+    Consider adding known administrative accounts to the filter macro.'
 references:
     - https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/
     - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25177
@@ -61,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$SubjectUserName$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: SubjectUserName
diff --git a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml
index ea8934990b3..224823e5b7e 100644
--- a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml
+++ b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml
@@ -10,7 +10,8 @@ description: The following analytic detects changes to the sIDHistory attribute
 data_source:
     - Windows Event Log Security 4742
     - Windows Event Log Security 4738
-search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P<SidHistoryMatch>.*)(\-|\\\)" | rex field=TargetSid "^(?P<TargetSidmatch>.*)(\-|\\\)" | where SidHistoryMatch!=TargetSidmatch AND SidHistoryMatch!=TargetDomainName | rename TargetSid as userSid | table _time action status host user userSid SidHistory Logon_ID src_user dest | `windows_ad_cross_domain_sid_history_addition_filter`'
+search: |
+    `wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P<SidHistoryMatch>.*)(\-|\\\)" | rex field=TargetSid "^(?P<TargetSidmatch>.*)(\-|\\\)" | where SidHistoryMatch!=TargetSidmatch AND SidHistoryMatch!=TargetDomainName | rename TargetSid as userSid | table _time action status host user userSid SidHistory Logon_ID src_user dest | `windows_ad_cross_domain_sid_history_addition_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting eventcodes `4738` and `4742`. The Advanced Security Audit policy settings `Audit User Account Management` and  `Audit Computer Account Management` within `Account Management` all need to be enabled.
 known_false_positives: Domain mergers and migrations may generate large volumes of false positives for this analytic.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Active Directory SID History Attribute was added to $user$ by $src_user$
     entity:
diff --git a/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml
index 2ec0999809b..ab500ac972a 100644
--- a/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml
+++ b/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml
@@ -9,7 +9,8 @@ type: TTP
 description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies permissions that deny the ability to enumerate permissions of the object.
 data_source:
     - Windows Event Log Security 5136
-search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"  | mvexpand new_ace  | where NOT new_ace IN (old_values)  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights  | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) | `windows_ad_dangerous_deny_acl_modification_filter`'
+search: |
+    `wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"  | mvexpand new_ace  | where NOT new_ace IN (old_values)  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights  | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) | `windows_ad_dangerous_deny_acl_modification_filter`
 how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $src_user$ has added ACL rights to deny $user$ $aceControlAccessRights$ $aceAccessRights$ to $ObjectDN$
     entity:
diff --git a/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml
index bb3d90f6285..572ff55844f 100644
--- a/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml
+++ b/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml
@@ -9,7 +9,8 @@ type: TTP
 description: 'This detection monitors the addition of the following ACLs to an Active Directory group object: "Full control", "All extended rights", "All validated writes",  "Create all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify permissions", "Modify owner", and "Write all properties".  Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.'
 data_source:
     - Windows Event Log Security 5136
-search: '`wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"  | mvexpand new_ace  | where NOT new_ace IN (old_values)  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter`'
+search: |
+    `wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"  | mvexpand new_ace  | where NOT new_ace IN (old_values)  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter`
 how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to group $ObjectDN$
     entity:
diff --git a/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml
index efaba46b0d9..906836703fb 100644
--- a/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml
+++ b/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml
@@ -9,7 +9,8 @@ type: TTP
 description: 'This detection monitors the addition of the following ACLs to an Active Directory user object: "Full control","All extended rights","All validated writes", "Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties".  Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.'
 data_source:
     - Windows Event Log Security 5136
-search: '`wineventlog_security` EventCode=5136 ObjectClass=user  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"  | mvexpand new_ace  | where NOT new_ace IN (old_values)  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights  | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_user_acl_modification_filter`'
+search: |
+    `wineventlog_security` EventCode=5136 ObjectClass=user  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"  | mvexpand new_ace  | where NOT new_ace IN (old_values)  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights  | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_user_acl_modification_filter`
 how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to user $ObjectDN$
     entity:
diff --git a/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml b/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml
index 6722e417c57..e571f9470e9 100644
--- a/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml
+++ b/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml
@@ -9,7 +9,7 @@ type: TTP
 description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies the minimum required extended rights to perform the DCShadow attack.
 data_source:
     - Windows Event Log Security 5136
-search: |-
+search: |
     `wineventlog_security` EventCode=5136 ObjectClass=domainDNS
       | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest
         BY ObjectClass ObjectDN OpCorrelationID
@@ -50,7 +50,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: ACL modification Event Initiated by $src_user$ applying $user$ the minimum required extended rights to perform a DCShadow attack.
     entity:
diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml
index 4ae8bbf8237..f8a221ab403 100644
--- a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml
+++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the disabling of audit policies on a domain controller. It leverages EventCode 4719 from Windows Security Event Logs to identify changes where success or failure auditing is removed. This activity is significant as it suggests an attacker may have gained access to the domain controller and is attempting to evade detection by tampering with audit policies. If confirmed malicious, this could lead to severe consequences, including data theft, privilege escalation, and full network compromise. Immediate investigation is required to determine the source and intent of the change.
 data_source:
     - Windows Event Log Security 4719
-search: |-
+search: |
     `wineventlog_security` EventCode=4719 (AuditPolicyChanges IN ("%%8448","%%8450","%%8448, %%8450") OR Changes IN ("Failure removed","Success removed","Success removed, Failure removed")) dest_category="domain_controller"
       | replace "%%8448" with "Success removed", "%%8450" with "Failure removed", "%%8448, %%8450" with "Success removed, Failure removed" in AuditPolicyChanges
       | eval AuditPolicyChanges=coalesce(AuditPolicyChanges,Changes), SubcategoryGuid=coalesce(SubcategoryGuid,Subcategory_GUID)
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: GPO $SubCategory$ of $Category$ was disabled on $dest$
     entity:
diff --git a/detections/endpoint/windows_ad_domain_controller_promotion.yml b/detections/endpoint/windows_ad_domain_controller_promotion.yml
index dad868ccded..4e14c3711e0 100644
--- a/detections/endpoint/windows_ad_domain_controller_promotion.yml
+++ b/detections/endpoint/windows_ad_domain_controller_promotion.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies a genuine Domain Controller (DC) promotion event by detecting when a computer assigns itself the necessary Service Principal Names (SPNs) to function as a domain controller. It leverages Windows Security Event Code 4742 to monitor existing domain controllers for these changes. This activity is significant as it can help identify rogue DCs added to the network, which could indicate a DCShadow attack. If confirmed malicious, this could allow an attacker to manipulate Active Directory, leading to potential privilege escalation and persistent access within the environment.
 data_source:
     - Windows Event Log Security 4742
-search: |-
+search: |
     `wineventlog_security` EventCode=4742 ServicePrincipalNames IN ("*E3514235-4B06-11D1-AB04-00C04FC2DCD2/*","*GC/*")
       | stats min(_time) as _time latest(ServicePrincipalNames) as ServicePrincipalNames,values(signature) as signature, values(src_user) as src_user, values(user) as user
         BY Logon_ID, dvc
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: AD Domain Controller Promotion Event Detected for $dest$
     entity:
diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml
index 008078814aa..f3b9ced1b4b 100644
--- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml
+++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the addition of permissions required for a DCSync attack, specifically DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, and DS-Replication-Get-Changes-In-Filtered-Set. It leverages EventCode 5136 from the Windows Security Event Log to identify when these permissions are granted. This activity is significant because it indicates potential preparation for a DCSync attack, which can be used to replicate AD objects and exfiltrate sensitive data. If confirmed malicious, an attacker could gain extensive access to Active Directory, leading to severe data breaches and privilege escalation.
 data_source:
     - Windows Event Log Security 5136
-search: |-
+search: |
     `wineventlog_security` EventCode=5136 ObjectClass=domainDNS
       | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType
           BY ObjectClass ObjectDN OpCorrelationID
@@ -46,7 +46,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $src_user$ has granted $user$ permission to replicate AD objects
     entity:
diff --git a/detections/endpoint/windows_ad_domain_root_acl_deletion.yml b/detections/endpoint/windows_ad_domain_root_acl_deletion.yml
index f4c529ed511..3c6a6ea9332 100644
--- a/detections/endpoint/windows_ad_domain_root_acl_deletion.yml
+++ b/detections/endpoint/windows_ad_domain_root_acl_deletion.yml
@@ -9,7 +9,8 @@ type: TTP
 description: ACL deletion performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage.
 data_source:
     - Windows Event Log Security 5136
-search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_values>.*?)\)"  | mvexpand old_values  | where NOT old_values IN (new_values)  | rex field=old_values "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$"  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights  | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value  | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_deletion_filter`'
+search: |
+    `wineventlog_security` EventCode=5136 ObjectClass=domainDNS  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_values>.*?)\)"  | mvexpand old_values  | where NOT old_values IN (new_values)  | rex field=old_values "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$"  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights  | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value  | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') | `windows_ad_domain_root_acl_deletion_filter`
 how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $src_user$ has removed $user$ $aceAccessRights$ ACL rights to domain root $ObjectDN$
     entity:
diff --git a/detections/endpoint/windows_ad_domain_root_acl_modification.yml b/detections/endpoint/windows_ad_domain_root_acl_modification.yml
index e3e9320ce78..13862df6741 100644
--- a/detections/endpoint/windows_ad_domain_root_acl_modification.yml
+++ b/detections/endpoint/windows_ad_domain_root_acl_modification.yml
@@ -9,7 +9,8 @@ type: TTP
 description: ACL modification performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage.
 data_source:
     - Windows Event Log Security 5136
-search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"  | mvexpand new_ace | where NOT new_ace IN (old_values)  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$" | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value  | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group | eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",''access_rights_value''), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid)  | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_modification_filter`'
+search: |
+    `wineventlog_security` EventCode=5136 ObjectClass=domainDNS  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"  | mvexpand new_ace | where NOT new_ace IN (old_values)  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$" | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value  | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group | eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",'access_rights_value'), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid)  | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') | `windows_ad_domain_root_acl_modification_filter`
 how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $src_user$ has granted $user$ $aceAccessRights$ ACL rights to domain root $ObjectDN$
     entity:
diff --git a/detections/endpoint/windows_ad_dsrm_account_changes.yml b/detections/endpoint/windows_ad_dsrm_account_changes.yml
index cbbcc55eb3d..1e9e462120d 100644
--- a/detections/endpoint/windows_ad_dsrm_account_changes.yml
+++ b/detections/endpoint/windows_ad_dsrm_account_changes.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies changes to the Directory Services Restore Mode (DSRM) account behavior via registry modifications. It detects alterations in the registry path "*\\System\\CurrentControlSet\\Control\\Lsa\\DSRMAdminLogonBehavior" with specific values indicating potential misuse. This activity is significant because the DSRM account, if misconfigured, can be exploited to persist within a domain, similar to a local administrator account. If confirmed malicious, an attacker could gain persistent administrative access to a Domain Controller, leading to potential domain-wide compromise and unauthorized access to sensitive information.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Control\\Lsa\\DSRMAdminLogonBehavior" Registry.registry_value_data IN ("*1","*2") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ad_dsrm_account_changes_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\Lsa\\DSRMAdminLogonBehavior" Registry.registry_value_data IN ("*1", "*2") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ad_dsrm_account_changes_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Disaster recovery events.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: DSRM Account Changes Initiated on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/windows_ad_dsrm_password_reset.yml b/detections/endpoint/windows_ad_dsrm_password_reset.yml
index 7ad5873bbb8..919b36369dc 100644
--- a/detections/endpoint/windows_ad_dsrm_password_reset.yml
+++ b/detections/endpoint/windows_ad_dsrm_password_reset.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic detects attempts to reset the Directory Services Restore Mode (DSRM) administrator password on a Domain Controller. It leverages event code 4794 from the Windows Security Event Log, specifically looking for events where the DSRM password reset is attempted. This activity is significant because the DSRM account can be used similarly to a local administrator account, providing potential persistence for an attacker. If confirmed malicious, this could allow an attacker to maintain administrative access to the Domain Controller, posing a severe risk to the domain's security.
 data_source:
     - Windows Event Log Security 4794
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as _time FROM datamodel=Change
-      WHERE All_Changes.result_id="4794"
-        AND
-        All_Changes.result="set the Directory Services Restore Mode administrator password"
-      BY All_Changes.action, All_Changes.dest, All_Changes.src,
-         All_Changes.user
-    | `drop_dm_object_name(All_Changes)`
-    | `windows_ad_dsrm_password_reset_filter`
+search: |
+    `wineventlog_security` EventCode=None All_Changes.result_id="4794" All_Changes.result="set the Directory Services Restore Mode administrator password" | eval user=user | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ad_dsrm_password_reset_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting eventcode `4794` and  have the Advanced Security Audit policy `Audit User Account Management` within `Account Management` enabled.
 known_false_positives: Resetting the DSRM password for legitamate reasons, i.e. forgot the password. Disaster recovery. Deploying AD backdoor deliberately.
 references:
@@ -31,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: DSRM Account Password was reset on $dest$ by $user$
     entity:
diff --git a/detections/endpoint/windows_ad_gpo_deleted.yml b/detections/endpoint/windows_ad_gpo_deleted.yml
index b5ef59e8786..f3311792d05 100644
--- a/detections/endpoint/windows_ad_gpo_deleted.yml
+++ b/detections/endpoint/windows_ad_gpo_deleted.yml
@@ -9,7 +9,7 @@ type: TTP
 description: This detection identifies when an Active Directory Group Policy is deleted using the Group Policy Management Console.
 data_source:
     - Windows Event Log Security 5136
-search: |-
+search: |
     `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=gpLink
       | eval  ObjectDN=upper(ObjectDN)
       | stats min(_time) as eventTime values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(src_user) as src_user values(dest) as dest
@@ -39,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: GPO $policyName$ was deleted by $src_user$
     entity:
diff --git a/detections/endpoint/windows_ad_gpo_disabled.yml b/detections/endpoint/windows_ad_gpo_disabled.yml
index 0eb30e06fa0..c35d6f50563 100644
--- a/detections/endpoint/windows_ad_gpo_disabled.yml
+++ b/detections/endpoint/windows_ad_gpo_disabled.yml
@@ -9,7 +9,7 @@ type: TTP
 description: This detection identifies when an Active Directory Group Policy is disabled using the Group Policy Management Console.
 data_source:
     - Windows Event Log Security 5136
-search: |-
+search: |
     `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=flags OperationType="%%14674" AttributeValue!=0
       | eval AttributeValueExp=case(AttributeValue==0,"Enabled",AttributeValue==1,"User configuration settings disabled",AttributeValue==2,"Computer configuration settings disabled",AttributeValue==3,"Disabled"), ObjectDN=upper(ObjectDN)
       | join ObjectDN type=inner [
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $src_user$ has disabled GPO $policyName$
     entity:
diff --git a/detections/endpoint/windows_ad_gpo_new_cse_addition.yml b/detections/endpoint/windows_ad_gpo_new_cse_addition.yml
index 7ee0d8c86b5..6aeac0eafcc 100644
--- a/detections/endpoint/windows_ad_gpo_new_cse_addition.yml
+++ b/detections/endpoint/windows_ad_gpo_new_cse_addition.yml
@@ -9,7 +9,7 @@ type: TTP
 description: This detection identifies when a a new client side extension is added to an Active Directory Group Policy using the Group Policy Management Console.
 data_source:
     - Windows Event Log Security 5136
-search: |-
+search: |
     `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames
       | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest
         BY ObjectClass ObjectDN OpCorrelationID
@@ -49,7 +49,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $src_user$ has added new GPO Client Side Extensions $newPolicy$ to the policy $policyName$
     entity:
diff --git a/detections/endpoint/windows_ad_hidden_ou_creation.yml b/detections/endpoint/windows_ad_hidden_ou_creation.yml
index f3b1f2b8cc0..7394f820c71 100644
--- a/detections/endpoint/windows_ad_hidden_ou_creation.yml
+++ b/detections/endpoint/windows_ad_hidden_ou_creation.yml
@@ -9,7 +9,8 @@ type: TTP
 description: This analytic is looking for when an ACL is applied to an OU which denies listing the objects residing in the OU. This activity combined with modifying the owner of the OU will hide AD objects even from domain administrators.
 data_source:
     - Windows Event Log Security 5136
-search: '`wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"  | mvexpand new_ace  | where NOT new_ace IN (old_values)  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights  | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) | `windows_ad_hidden_ou_creation_filter`'
+search: |
+    `wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"  | mvexpand new_ace  | where NOT new_ace IN (old_values)  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights  | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) | `windows_ad_hidden_ou_creation_filter`
 how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $src_user$ has hidden the contents of OU $ObjectDN$ from $user$
     entity:
diff --git a/detections/endpoint/windows_ad_object_owner_updated.yml b/detections/endpoint/windows_ad_object_owner_updated.yml
index d26cae513be..f5d533e0c56 100644
--- a/detections/endpoint/windows_ad_object_owner_updated.yml
+++ b/detections/endpoint/windows_ad_object_owner_updated.yml
@@ -9,7 +9,7 @@ type: TTP
 description: AD Object Owner Updated. The owner provides Full control level privileges over the target AD Object. This event has significant impact alone and is also a precursor activity for hiding an AD object.
 data_source:
     - Windows Event Log Security 5136
-search: |-
+search: |
     `wineventlog_security` EventCode=5136
       | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest
         BY ObjectClass ObjectDN OpCorrelationID
@@ -43,7 +43,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $src_user$ has made $user$ the owner of AD object $ObjectDN$
     entity:
diff --git a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml
index 4d065865c8f..e5eb981b2fb 100644
--- a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml
+++ b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml
@@ -10,7 +10,7 @@ description: The following analytic identifies when the SID of a privileged user
 data_source:
     - Windows Event Log Security 4742
     - Windows Event Log Security 4738
-search: |-
+search: |
     `wineventlog_security`
     EventCode IN (4742, 4738)
     NOT SidHistory IN ("%%1793", -)
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Privileged User Account SID History Attribute was added to $userSid$ by $src_user$
     entity:
diff --git a/detections/endpoint/windows_ad_privileged_group_modification.yml b/detections/endpoint/windows_ad_privileged_group_modification.yml
index 0feccfdd2fb..faccc1f8b06 100644
--- a/detections/endpoint/windows_ad_privileged_group_modification.yml
+++ b/detections/endpoint/windows_ad_privileged_group_modification.yml
@@ -6,17 +6,22 @@ modification_date: '2026-09-22'
 author: Dean Luxton
 status: production
 type: TTP
-description: |
-    This detection identifies when users are added to privileged Active Directory
+description: 'This detection identifies when users are added to privileged Active Directory
+
     groups by leveraging the Windows Security Event Code 4728 along with a lookup
+
     of privileged AD groups provided by Splunk Enterprise Security.
+
     Attackers often add user accounts to privileged AD groups to escalate privileges
+
     or maintain persistence within an Active Directory environment.
+
     Monitoring for modifications to privileged groups can help identify potential security breaches
-    and unauthorized access attempts.
+
+    and unauthorized access attempts.'
 data_source:
     - Windows Event Log Security 4728
-search: |-
+search: |
     `wineventlog_security` EventCode IN (4728)
       | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc
         BY signature, Group_Name,src_user dest
@@ -35,7 +40,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $user$ was added to privileged AD Group $Group_Name$ by $src_user$
     entity:
diff --git a/detections/endpoint/windows_ad_privileged_object_access_activity.yml b/detections/endpoint/windows_ad_privileged_object_access_activity.yml
index c4fb560f363..fe33dfa2ce4 100644
--- a/detections/endpoint/windows_ad_privileged_object_access_activity.yml
+++ b/detections/endpoint/windows_ad_privileged_object_access_activity.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects access attempts to privileged Active Directory objects, such as Domain Admins or Enterprise Admins. It leverages Windows Security Event Code 4662 to identify when these sensitive objects are accessed. This activity is significant because such objects should rarely be accessed by normal users or processes, and unauthorized access attempts may indicate attacker enumeration or lateral movement within the domain. If confirmed malicious, this activity could allow attackers to escalate privileges, persist in the environment, or gain control over critical domain resources.
 data_source:
     - Windows Event Log Security 4662
-search: |-
+search: |
     `wineventlog_security` EventCode=4662 ObjectName IN ( "CN=Account Operators,*", "CN=Administrators,*", "CN=Backup Operators,*", "CN=Cert Publishers,*", "CN=Certificate Service DCOM Access,*", "CN=Domain Admins,*", "CN=Domain Controllers,*", "CN=Enterprise Admins,*", "CN=Enterprise Read-only Domain Controllers,*", "CN=Group Policy Creator Owners,*", "CN=Incoming Forest Trust Builders,*", "CN=Microsoft Exchange Servers,*", "CN=Network Configuration Operators,*", "CN=Power Users,*", "CN=Print Operators,*", "CN=Read-only Domain Controllers,*", "CN=Replicators,*", "CN=Schema Admins,*", "CN=Server Operators,*", "CN=Exchange Trusted Subsystem,*", "CN=Exchange Windows Permission,*", "CN=Organization Management,*")
       | rex field=ObjectName "CN\=(?<object_name>[^,]+)"
       | stats values(Computer) as dest, values(object_name) as object_name, dc(ObjectName) as object_count, min(_time) as firstTime, max(_time) as lastTime, count
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The account $user$ accessed $object_count$ privileged AD object(s).
     entity:
diff --git a/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml
index ab261dc8fba..f992dcbaf01 100644
--- a/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml
+++ b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml
@@ -10,7 +10,7 @@ description: The following analytic detects a user account initiating an Active
 data_source:
     - Windows Event Log Security 4662
     - Windows Event Log Security 4624
-search: |-
+search: |
     `wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}","domainDNS")
       AND Properties IN ("*Replicating Directory Changes All*","*Manage Replication Topology*","*Remove Replica In Domain*","*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*","*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*")
       AND AccessMask="0x100" AND NOT (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18" OR SubjectDomainName="Window Manager" OR SubjectUserName="*$")
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Active Directory Replication Request Initiated by User Account $user$ from $src_ip$
     entity:
diff --git a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml
index ce96ca9b365..db67c46b20d 100644
--- a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml
+++ b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml
@@ -10,7 +10,7 @@ description: The following analytic identifies unauthorized Active Directory rep
 data_source:
     - Windows Event Log Security 4662
     - Windows Event Log Security 4624
-search: |-
+search: |
     `wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}",
       "domainDNS") AND Properties IN ("*Replicating Directory Changes All*","*Manage Replication Topology*","*Remove Replica In Domain*","*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*","*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*")
       AND AccessMask="0x100" AND (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18"
@@ -41,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Active Directory Replication Request Initiated from Unsanctioned Location $src_ip$ by $user$
     entity:
diff --git a/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml b/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml
index 27e35e336b6..19ad71b2dc6 100644
--- a/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml
+++ b/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml
@@ -10,7 +10,8 @@ description: The following analytic detects changes to the sIDHistory attribute
 data_source:
     - Windows Event Log Security 4742
     - Windows Event Log Security 4738
-search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P<SidHistoryMatch>.*)(\-|\\\)" | rex field=TargetSid "^(?P<TargetSidmatch>.*)(\-|\\\)" | where SidHistoryMatch=TargetSidmatch OR SidHistoryMatch=TargetDomainName | rename TargetSid as userSid, TargetDomainName as userDomainName | table _time action status host user userSid userDomainName SidHistory Logon_ID src_user dest | `windows_ad_same_domain_sid_history_addition_filter`'
+search: |
+    `wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P<SidHistoryMatch>.*)(\-|\\\)" | rex field=TargetSid "^(?P<TargetSidmatch>.*)(\-|\\\)" | where SidHistoryMatch=TargetSidmatch OR SidHistoryMatch=TargetDomainName | rename TargetSid as userSid, TargetDomainName as userDomainName | table _time action status host user userSid userDomainName SidHistory Logon_ID src_user dest | `windows_ad_same_domain_sid_history_addition_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting eventcodes `4738` and `4742`. The Advanced Security Audit policy settings `Audit User Account Management` and  `Audit Computer Account Management` within `Account Management` all need to be enabled. SID resolution is not required..
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Active Directory SID History Attribute was added to $user$ by $src_user$
     entity:
diff --git a/detections/endpoint/windows_ad_self_dacl_assignment.yml b/detections/endpoint/windows_ad_self_dacl_assignment.yml
index cc4b4578cdd..dd29b925378 100644
--- a/detections/endpoint/windows_ad_self_dacl_assignment.yml
+++ b/detections/endpoint/windows_ad_self_dacl_assignment.yml
@@ -98,7 +98,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $user$ has created a DACL on $ObjectDN$ to grant themselves $aceControlAccessRights$ across $aceAccessRights$
     entity:
diff --git a/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml b/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml
index a34569ea8ff..41273c3b002 100644
--- a/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml
+++ b/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml
@@ -9,12 +9,8 @@ type: TTP
 description: The following analytic detects the addition of a Service Principal Name (SPN) to a domain account. It leverages Windows Event Code 5136 and monitors changes to the servicePrincipalName attribute. This activity is significant because it may indicate an attempt to perform Kerberoasting, a technique where attackers extract and crack service account passwords offline. If confirmed malicious, this could allow an attacker to obtain cleartext passwords, leading to unauthorized access and potential lateral movement within the domain environment.
 data_source:
     - Windows Event Log Security 5136
-search: >-
-    `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName
-    OperationType="%%14674" ObjectClass=user
-    | stats values(ObjectDN) as ObjectDN by _time, Computer, SubjectUserName, AttributeValue
-    | rex field=ObjectDN "^CN=(?P<user>[a-zA-Z0-9!#$%&'@^_{}~.-]+),"
-    | rename Computer as dest, SubjectUserName as src_user  | `windows_ad_serviceprincipalname_added_to_domain_account_filter`
+search: |
+    `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName OperationType="%%14674" ObjectClass=user | stats values(ObjectDN) as ObjectDN by _time, Computer, SubjectUserName, AttributeValue | rex field=ObjectDN "^CN=(?P<user>[a-zA-Z0-9!#$%&'@^_{}~.-]+)," | rename Computer as dest, SubjectUserName as src_user  | `windows_ad_serviceprincipalname_added_to_domain_account_filter`
 how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for AD objects in order to ingest attribute modifications.
 known_false_positives: A Service Principal Name should only be added to an account when an application requires it. While infrequent, this detection may trigger on legitimate actions. Filter as needed.
 references:
@@ -30,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$ObjectDN$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$ObjectDN$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Servince Principal Name for $ObjectDN$ was set by $user$
     entity:
diff --git a/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml
index 04f3a93ed39..51a229d88c9 100644
--- a/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml
+++ b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies the addition and quick deletion of a Service Principal Name (SPN) to a domain account within 5 minutes. This detection leverages EventCode 5136 from the Windows Security Event Log, focusing on changes to the servicePrincipalName attribute. This activity is significant as it may indicate an attempt to perform Kerberoasting, a technique used to crack the cleartext password of a domain account offline. If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive information or escalate privileges within the domain environment.
 data_source:
     - Windows Event Log Security 5136
-search: |-
+search: |
     `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName
       | transaction ObjectDN AttributeValue startswith=(EventCode=5136 OperationType="%%14674") endswith=(EventCode=5136 OperationType="%%14675")
       | eval short_lived=case((duration<300),"TRUE")
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Servince Principal Name for $user$ was set and shortly deleted
     entity:
diff --git a/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml b/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml
index 0e0595d62bf..810aeea6474 100644
--- a/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml
+++ b/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml
@@ -10,7 +10,7 @@ description: The following analytic detects the temporary addition of a global c
 data_source:
     - Windows Event Log Security 5136
     - Windows Event Log Security 4624
-search: |-
+search: |
     `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName (AttributeValue="GC/*" OR AttributeValue="E3514235-4B06-11D1-AB04-00C04FC2DCD2/*")
       | stats min(_time) as _time range(_time) as duration values(OperationType) as OperationType values(user) as user values(src_ip) as src_ip values(src_nt_domain) as src_nt_domain values(src_user) as src_user values(Computer) as dest, values(ObjectDN) as ObjectDN values(action) as action values(app) as app values(authentication_method) as authentication_method values(signature) as signature values(signature_id) as signature_id values(src) as src
         BY Logon_ID
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Short Lived Domain Controller SPN AD Attribute Triggered by $src_user$
     entity:
diff --git a/detections/endpoint/windows_ad_short_lived_server_object.yml b/detections/endpoint/windows_ad_short_lived_server_object.yml
index 248266af4ff..5075bbbbcfc 100644
--- a/detections/endpoint/windows_ad_short_lived_server_object.yml
+++ b/detections/endpoint/windows_ad_short_lived_server_object.yml
@@ -10,7 +10,7 @@ description: The following analytic identifies the creation and quick deletion o
 data_source:
     - Windows Event Log Security 5137
     - Windows Event Log Security 5141
-search: |-
+search: |
     `wineventlog_security` EventCode=5137 OR EventCode=5141 ObjectDN="*CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration*"
       | transaction ObjectDN startswith=(EventCode=5137) endswith=(EventCode=5141)
       | eval short_lived=case((duration<30),"TRUE")
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A short-lived server object was created and deleted on $Computer$
     entity:
diff --git a/detections/endpoint/windows_ad_sid_history_attribute_modified.yml b/detections/endpoint/windows_ad_sid_history_attribute_modified.yml
index a2412e18c49..8704f64d170 100644
--- a/detections/endpoint/windows_ad_sid_history_attribute_modified.yml
+++ b/detections/endpoint/windows_ad_sid_history_attribute_modified.yml
@@ -9,13 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the SID History attribute in Active Directory by leveraging event code 5136. This detection uses logs from the `wineventlog_security` data source to identify changes to the sIDHistory attribute. Monitoring this activity is crucial as the SID History attribute can be exploited by adversaries to inherit permissions from other accounts, potentially granting unauthorized access. If confirmed malicious, this activity could allow attackers to maintain persistent access and escalate privileges within the domain, posing a significant security risk.
 data_source:
     - Windows Event Log Security 5136
-search: |-
-    `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=sIDHistory OperationType="%%14674"
-      | stats values(ObjectDN) as ObjectDN
-        BY _time, Computer, SubjectUserName,
-           AttributeValue
-      | rename Computer as dest
-      | `windows_ad_sid_history_attribute_modified_filter`
+search: |
+    `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName="sIDHistory" OperationType="%%14674" | eval ObjectDN=ObjectDN, SubjectUserName=SubjectUserName, SubjectUserSid=SubjectUserSid, Computer=Computer, User=SubjectUserSid, user=SubjectUserName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ad_sid_history_attribute_modified_filter`
 how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for AD objects in order to ingest attribute modifications.
 known_false_positives: Domain mergers and migrations may generate large volumes of false positives for this analytic.
 references:
@@ -31,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: SID History AD attribute modified by $SubjectUserName$ for $ObjectDN$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml
index 95de6c73ae6..c637234d932 100644
--- a/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml
+++ b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml
@@ -6,14 +6,16 @@ modification_date: '2026-09-25'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects the addition or modification of a servicePrincipalName (SPN) containing invisible Unicode characters to an Active Directory computer object via Windows Security Event 5136.
-    This is the key indicator of the KerberLoss attack (CVE-2026-25177), where an attacker with write access to a machine account's SPN attribute injects a collision SPN that contains a Zero Width or other invisible Unicode character (e.g. U+200C Zero Width Non-Joiner).
-    LDAP's string preparation rules (RFC 4518) cause these characters to be ignored during uniqueness checking, allowing the write to succeed even when an identical SPN already exists on another machine account.
-    The Kerberos KDC, however, does not apply the same normalisation — it finds two accounts with matching SPNs and returns KDC_ERR_S_PRINCIPAL_UNKNOWN, causing a Kerberos denial-of-service or forcing clients to fall back to NTLM downgrade.
+description: 'The following analytic detects the addition or modification of a servicePrincipalName (SPN) containing invisible Unicode characters to an Active Directory computer object via Windows Security Event 5136.
+
+    This is the key indicator of the KerberLoss attack (CVE-2026-25177), where an attacker with write access to a machine account''s SPN attribute injects a collision SPN that contains a Zero Width or other invisible Unicode character (e.g. U+200C Zero Width Non-Joiner).
+
+    LDAP''s string preparation rules (RFC 4518) cause these characters to be ignored during uniqueness checking, allowing the write to succeed even when an identical SPN already exists on another machine account.
+
+    The Kerberos KDC, however, does not apply the same normalisation — it finds two accounts with matching SPNs and returns KDC_ERR_S_PRINCIPAL_UNKNOWN, causing a Kerberos denial-of-service or forcing clients to fall back to NTLM downgrade.'
 data_source:
     - Windows Event Log Security 5136
-search: |-
+search: |
     `wineventlog_security`
     EventCode=5136
     AttributeValue=*
@@ -52,12 +54,12 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_ad_spn_unicode_collision_injection_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting Domain Controller Security event logs. Enable the Advanced Security Audit policy `DS Access > Audit Directory Service Changes` for Success events. Additionally, a WriteProperty audit SACL must be configured on the computer object class (or the CN=Computers container with inheritance) to generate Event 5136 when servicePrincipalName is modified.
-known_false_positives: |-
-    Legitimate use of invisible Unicode characters in SPN values is not expected. This detection should have a very low false positive rate.
+how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller Security event logs. Enable the Advanced Security Audit policy `DS Access > Audit Directory Service Changes` for Success events. Additionally, a WriteProperty audit SACL must be configured on the computer object class (or the CN=Computers container with inheritance) to generate Event 5136 when servicePrincipalName is modified.
+known_false_positives: 'Legitimate use of invisible Unicode characters in SPN values is not expected. This detection should have a very low false positive rate.
+
     Provisioning tools or scripts that incorrectly encode SPN strings from certain character sets may trigger this.
-    Verify the SubjectUserName and ObjectDN to confirm intent.
+
+    Verify the SubjectUserName and ObjectDN to confirm intent.'
 references:
     - https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/
     - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25177
@@ -70,7 +72,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$SubjectUserName$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User [$SubjectUserName$] injected an invisible-Unicode SPN [$matched_invisible_chars$] onto [$ObjectDN$] on $dest$
     entity:
diff --git a/detections/endpoint/windows_ad_suspicious_attribute_modification.yml b/detections/endpoint/windows_ad_suspicious_attribute_modification.yml
index d9f330d17bd..cedade70b37 100644
--- a/detections/endpoint/windows_ad_suspicious_attribute_modification.yml
+++ b/detections/endpoint/windows_ad_suspicious_attribute_modification.yml
@@ -9,7 +9,7 @@ type: TTP
 description: 'This detection monitors changes to the following Active Directory attributes: "msDS-AllowedToDelegateTo", "msDS-AllowedToActOnBehalfOfOtherIdentity", "msDS-KeyCredentialLink", "scriptPath", and "msTSInitialProgram".  Modifications to these attributes can indicate potential malicious activity or privilege escalation attempts. Immediate investigation is recommended upon alert.'
 data_source:
     - Windows Event Log Security 5136
-search: |-
+search: |
     `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName IN ("msDS-AllowedToDelegateTo","msDS-AllowedToActOnBehalfOfOtherIdentity","scriptPath","msTSInitialProgram") OperationType=%%14674  ```Changes to the attribute "msDS-KeyCredentialLink" are also worth moniroting, however tuning will need to be applied```
       | table _time ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId DSName AttributeValue AttributeLDAPDisplayName
       | rename SubjectLogonId as TargetLogonId, src_user as initiator, _time as eventTime
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $src_user$ has added $AttributeLDAPDisplayName$ ACL rights to $ObjectClass$ $ObjectDN$
     entity:
diff --git a/detections/endpoint/windows_ad_user_suspicious_upn_change.yml b/detections/endpoint/windows_ad_user_suspicious_upn_change.yml
index aa955d2dd76..cc61eff729b 100644
--- a/detections/endpoint/windows_ad_user_suspicious_upn_change.yml
+++ b/detections/endpoint/windows_ad_user_suspicious_upn_change.yml
@@ -6,47 +6,21 @@ modification_date: '2026-09-23'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects a user account modifying its own userPrincipalName (UPN) to match the sAMAccountName of another account via Windows Security Event 4738.
-    This is the setup step of the ResetNightmare attack (CVE-2026-27912), where an attacker with WriteProperty rights on their own UPN attribute spoofs their identity to a target account.
-    The KDC then resolves a ptype=10 (NT-ENTERPRISE) Kerberos pre-authentication request against the spoofed UPN, issuing a kadmin/changepw TGT that can be used to change the target account's password via kpasswd (port 464).
-    Event 4738 is generated when a user account attribute is changed. This analytic filters to events where the SubjectUserSid equals the TargetSid (self-modification), the new UPN value is not a standard UPN (no @ sign), and the value is not a Windows placeholder.
-    A non-UPN value set on one's own account is anomalous and has no legitimate administrative use case.
-data_source:
-    - Windows Event Log Security 4738
-search: |-
-    `wineventlog_security`
-    EventCode=4738
-    UserPrincipalName="*"
-    NOT UserPrincipalName IN (
-        "-",
-        "",
-        "*@*",
-        "%%1793"
-    )
-    NOT SubjectUserSid IN (
-        "S-1-5-18",
-        "S-1-5-7"
-    )
-    NOT SubjectUserName IN (
-        "ANONYMOUS*",
-        "NT AUTHORITY*"
-    )
+description: 'The following analytic detects a user account modifying its own userPrincipalName (UPN) to match the sAMAccountName of another account via Windows Security Event 4738.
 
-    | where SubjectUserSid=TargetSid
+    This is the setup step of the ResetNightmare attack (CVE-2026-27912), where an attacker with WriteProperty rights on their own UPN attribute spoofs their identity to a target account.
 
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
+    The KDC then resolves a ptype=10 (NT-ENTERPRISE) Kerberos pre-authentication request against the spoofed UPN, issuing a kadmin/changepw TGT that can be used to change the target account''s password via kpasswd (port 464).
 
-      by dest SubjectUserName SubjectUserSid TargetUserName TargetSid UserPrincipalName
+    Event 4738 is generated when a user account attribute is changed. This analytic filters to events where the SubjectUserSid equals the TargetSid (self-modification), the new UPN value is not a standard UPN (no @ sign), and the value is not a Windows placeholder.
 
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_ad_user_suspicious_upn_change_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `User Account Management` within `Account Management` needs to be enabled.
-known_false_positives: |-
-    Administrators or identity management tools may legitimately set a UPN that does not contain an @ sign during account provisioning or migration workflows. Investigate the SubjectUserName and context to confirm.
+    A non-UPN value set on one''s own account is anomalous and has no legitimate administrative use case.'
+data_source:
+    - Windows Event Log Security 4738
+search: |
+    `wineventlog_security` EventCode=4738 UserPrincipalName="*" NOT (UserPrincipalName IN ("-", "", "@", "%%1793")) NOT (SubjectUserSid IN ("S-1-5-18", "S-1-5-7")) NOT (SubjectUserName IN ("ANONYMOUS*", "NT AUTHORITY*")) | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ad_user_suspicious_upn_change_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `User Account Management` within `Account Management` needs to be enabled.
+known_false_positives: Administrators or identity management tools may legitimately set a UPN that does not contain an @ sign during account provisioning or migration workflows. Investigate the SubjectUserName and context to confirm.
 references:
     - https://cravaterouge.com/articles/resetnightmare/
     - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27912
@@ -59,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$SubjectUserName$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User [$SubjectUserName$] set their UPN to [$UserPrincipalName$] on $dest$
     entity:
diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml
index e03658266cf..6adf1f20045 100644
--- a/detections/endpoint/windows_adfind_exe.yml
+++ b/detections/endpoint/windows_adfind_exe.yml
@@ -12,53 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    from datamodel=Endpoint.Processes where
-
-    (
-      Processes.process_name = "AdFind.exe"
-      OR
-      Processes.original_file_name = "AdFind.exe"
-    )
-    OR
-    (
-      Processes.process IN ("* -f *", "* /f*")
-      Processes.process = "*objectcategory=*"
-    )
-    OR
-    (
-      Processes.process IN ("* -sc *", "* /sc *")
-      Processes.process IN ("* -gcb *", "* /gcb *")
-    )
-    OR
-    (
-      Processes.process IN ("* -sc *", "* /sc *")
-      Processes.process IN (
-            "* trustdmp*",
-            "* dclist*",
-            "* dcdmp*",
-            "* adobjcnt*",
-            "* adamobjcnt*",
-            "* sdump*",
-            "* exchaddresses*",
-            "* getacl*",
-            "* domainlist*",
-            "* export_user*",
-            "* export_group*",
-            "* admincountdmp*"
-      )
-    )
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_adfind_exe_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.process IN ("* -f *", "* /f*") Processes.process="*objectcategory=*") OR (Processes.process IN ("* -sc *", "* /sc *") Processes.process IN ("* -gcb *", "* /gcb *")) OR (Processes.process IN ("* -sc *", "* /sc *") Processes.process IN ("* trustdmp*", "* dclist*", "* dcdmp*", "* adobjcnt*", "* adamobjcnt*", "* sdump*", "* exchaddresses*", "* getacl*", "* domainlist*", "* export_user*", "* export_group*", "* admincountdmp*")) OR Processes.process_name="*AdFind.exe" OR Processes.original_file_name="AdFind.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_adfind_exe_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: ADfind is a command-line tool for AD administration and management that is seen to be leveraged by various adversaries. Filter out legitimate administrator usage using the filter macro.
 references:
@@ -80,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $user$ spawned $process$ indicative of Active Directory discovery on machine - [$dest$]
     entity:
diff --git a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml
index 1d6ad8ec27f..999aa79d043 100644
--- a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml
+++ b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml
@@ -6,11 +6,10 @@ modification_date: '2026-09-23'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects when a unprivileged user changes an Admin accounts password. This is a common artifact of successful exploitation of the BlueHammer Windows Defender privilege escalation. The attacker's process momentarily changes the passwords of high-value local accounts including the built-in Administrator to spawn an authenticated shell session, then immediately reverts the passwords to avoid detection. This uses EventID 4723 to log this activity.
+description: The following analytic detects when a unprivileged user changes an Admin accounts password. This is a common artifact of successful exploitation of the BlueHammer Windows Defender privilege escalation. The attacker's process momentarily changes the passwords of high-value local accounts including the built-in Administrator to spawn an authenticated shell session, then immediately reverts the passwords to avoid detection. This uses EventID 4723 to log this activity.
 data_source:
     - Windows Event Log Security 4723
-search: |-
+search: |
     `wineventlog_security`
     EventCode=4723
     TargetSid IN (
@@ -37,10 +36,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_admin_password_changed_by_non_admin_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Some IT support tools or automated scripts may change administrator passwords during maintenance. Verify changes against authorized administrative activities to reduce false alerts.
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Some IT support tools or automated scripts may change administrator passwords during maintenance. Verify changes against authorized administrative activities to reduce false alerts.
 references:
     - https://github.com/Nightmare-Eclipse/BlueHammer
 drilldown_searches:
diff --git a/detections/endpoint/windows_admin_permission_discovery.yml b/detections/endpoint/windows_admin_permission_discovery.yml
index 3aafcc5db33..fe3d0a0e3ea 100644
--- a/detections/endpoint/windows_admin_permission_discovery.yml
+++ b/detections/endpoint/windows_admin_permission_discovery.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic identifies the creation of a suspicious file named 'win.dat' in the root directory (C:\). It leverages data from the Endpoint.Filesystem datamodel to detect this activity. This behavior is significant as it is commonly used by malware like NjRAT to check for administrative privileges on a compromised host. If confirmed malicious, this activity could indicate that the malware has administrative access, allowing it to perform high-privilege actions, potentially leading to further system compromise and persistence.
 data_source:
     - Sysmon EventID 11
-search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk", "*.dat") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | eval dropped_file_path = split(file_path, "\\") | eval dropped_file_path_split_count = mvcount(dropped_file_path) | eval root_drive = mvindex(dropped_file_path,0) | where LIKE(root_drive, "C:") AND dropped_file_path_split_count = 2 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_admin_permission_discovery_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk", "*.dat") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_admin_permission_discovery_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 known_false_positives: False positives may occur if there are legitimate accounts with the privilege to drop files in the root of the C drive. It's recommended to verify the legitimacy of such actions and the accounts involved.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml
index 2272e80472e..3f2fbb06cdf 100644
--- a/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml
+++ b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml
@@ -10,7 +10,8 @@ description: The following analytic detects a source computer accessing Windows
 data_source:
     - Windows Event Log Security 5140
     - Windows Event Log Security 5145
-search: '`wineventlog_security` EventCode=5140 OR EventCode=5145 (ShareName="\\\\*\\ADMIN$" OR ShareName="\\\\*\\IPC$" OR ShareName="\\\\*\\C$") | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets values(ShareName) as shares values(dest) as dest by _time, IpAddress, SubjectUserName, EventCode | where unique_targets > 30 | `windows_administrative_shares_accessed_on_multiple_hosts_filter`'
+search: |
+    `wineventlog_security` EventCode=5140 OR EventCode=5145 (ShareName="\\\\*\\ADMIN$" OR ShareName="\\\\*\\IPC$" OR ShareName="\\\\*\\C$") | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets values(ShareName) as shares values(dest) as dest by _time, IpAddress, SubjectUserName, EventCode | where unique_targets > 30 | `windows_administrative_shares_accessed_on_multiple_hosts_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting file share events. The Advanced Security Audit policy setting `Audit Detailed File Share` or `Audit File Share` within `Object Access` need to be enabled.
 known_false_positives: An single endpoint accessing windows administrative shares across a large number of endpoints is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems.
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$host_targets$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host_targets$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $IpAddress$ accessed the IPC share on more than 30 endpoints in a timespan of 5 minutes.
     entity:
diff --git a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml
index 4ca99604925..078afaf3f0a 100644
--- a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml
+++ b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml
@@ -9,13 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the default Group Policy Objects (GPOs) in an Active Directory environment. It leverages Splunk's Admon to monitor updates to the "Default Domain Policy" and "Default Domain Controllers Policy." This activity is significant because changes to these default GPOs can indicate an adversary with privileged access attempting to gain further control, establish persistence, or deploy malware across multiple hosts. If confirmed malicious, such modifications could lead to widespread policy enforcement changes, unauthorized access, and potential compromise of the entire domain environment.
 data_source:
     - Windows Active Directory Admon
-search: |-
-    `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" (displayName="Default Domain Policy" OR displayName="Default Domain Controllers Policy")
-      | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath)
-        BY dcName, displayName
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_admon_default_group_policy_object_modified_filter`
+search: |
+    `admon` admonEventType="Update" objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" displayName IN ("Default Domain Policy", "Default Domain Controllers Policy") | stats count min(_time) as firstTime max(_time) as lastTime by admonEventType objectCategory displayName dcName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_admon_default_group_policy_object_modified_filter`
 how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here https://help.splunk.com/en/splunk-cloud-platform/get-started/get-data-in/9.3.2411/get-windows-data/monitor-active-directory
 known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
 references:
@@ -32,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dcName$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dcName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A default domain group policy was updated on $dcName$
     entity:
diff --git a/detections/endpoint/windows_admon_group_policy_object_created.yml b/detections/endpoint/windows_admon_group_policy_object_created.yml
index c99fb26297f..14f04a73d9a 100644
--- a/detections/endpoint/windows_admon_group_policy_object_created.yml
+++ b/detections/endpoint/windows_admon_group_policy_object_created.yml
@@ -9,13 +9,8 @@ type: TTP
 description: The following analytic detects the creation of a new Group Policy Object (GPO) using Splunk's Admon data. It identifies events where a new GPO is created, excluding default "New Group Policy Object" entries. Monitoring GPO creation is crucial as adversaries can exploit GPOs to escalate privileges or deploy malware across an Active Directory network. If confirmed malicious, this activity could allow attackers to control system configurations, deploy ransomware, or propagate malware, significantly compromising the network's security.
 data_source:
     - Windows Active Directory Admon
-search: |-
-    `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" versionNumber=0 displayName!="New Group Policy Object"
-      | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath)
-        BY dcName, displayName
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_admon_group_policy_object_created_filter`
+search: |
+    `admon` admonEventType="Update" objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" versionNumber="0" NOT displayName="New Group Policy Object" | stats count min(_time) as firstTime max(_time) as lastTime by admonEventType objectCategory versionNumber displayName dcName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_admon_group_policy_object_created_filter`
 how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here https://help.splunk.com/en/splunk-cloud-platform/get-started/get-data-in/9.3.2411/get-windows-data/monitor-active-directory
 known_false_positives: Group Policy Objects are created as part of regular administrative operations, filter as needed.
 references:
@@ -32,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dcName$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dcName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new group policy objected was created on $dcName$
     entity:
diff --git a/detections/endpoint/windows_advanced_installer_msix_with_ai_stubs_execution.yml b/detections/endpoint/windows_advanced_installer_msix_with_ai_stubs_execution.yml
index 01aba0e6859..d7df0637108 100644
--- a/detections/endpoint/windows_advanced_installer_msix_with_ai_stubs_execution.yml
+++ b/detections/endpoint/windows_advanced_installer_msix_with_ai_stubs_execution.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path IN ("*\\AI_STUBS\\AiStubX64Elevated.exe", "*\\AI_STUBS\\AiStubX86Elevated.exe", "*\\AI_STUBS\\AiStubX64.exe", "*\\AI_STUBS\\AiStubX86.exe") AND Processes.original_file_name="popupwrapper.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_advanced_installer_msix_with_ai_stubs_execution_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path IN ("*\\AI_STUBS\\AiStubX64Elevated.exe", "*\\AI_STUBS\\AiStubX86Elevated.exe", "*\\AI_STUBS\\AiStubX64.exe", "*\\AI_STUBS\\AiStubX86.exe") Processes.original_file_name="popupwrapper.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_advanced_installer_msix_with_ai_stubs_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain process execution information, including process paths. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate applications packaged with Advanced Installer using the Package Support Framework may trigger this detection. Verify if the MSIX package is from a trusted source and signed by a trusted publisher before taking action. Organizations that use Advanced Installer for legitimate software packaging may see false positives.
 references:
@@ -28,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Advanced Installer MSIX package with AI_STUBS execution detected on $dest$ by user $user$
     entity:
@@ -55,6 +56,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/msix_ai_stubs/windows_sysmon.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_ai_platform_dns_query.yml b/detections/endpoint/windows_ai_platform_dns_query.yml
index 64febb1b456..34a6d5ae13a 100644
--- a/detections/endpoint/windows_ai_platform_dns_query.yml
+++ b/detections/endpoint/windows_ai_platform_dns_query.yml
@@ -6,8 +6,7 @@ modification_date: '2026-09-22'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects DNS queries initiated by the Windows AI Platform to domains associated with Hugging Face, OpenAI, and other popular providers of machine learning models and services. Monitoring these DNS requests is important because it can reveal when systems are accessing external AI platforms, which may indicate the use of third-party AI resources or the transfer of sensitive data outside the organization’s environment. Detecting such activity enables organizations to enforce data governance policies, prevent unapproved use of external AI services, and maintain visibility into potential data exfiltration risks. Proactive monitoring provides better control over AI model usage and helps safeguard organizational data flows.
+description: The following analytic detects DNS queries initiated by the Windows AI Platform to domains associated with Hugging Face, OpenAI, and other popular providers of machine learning models and services. Monitoring these DNS requests is important because it can reveal when systems are accessing external AI platforms, which may indicate the use of third-party AI resources or the transfer of sensitive data outside the organization’s environment. Detecting such activity enables organizations to enforce data governance policies, prevent unapproved use of external AI services, and maintain visibility into potential data exfiltration risks. Proactive monitoring provides better control over AI model usage and helps safeguard organizational data flows.
 data_source:
     - Sysmon EventID 22
 search: |
@@ -33,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml
index aea125442a2..bd490983c55 100644
--- a/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml
+++ b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml
@@ -6,15 +6,18 @@ modification_date: '2026-09-30'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the creation of an NTFS alternate data stream (ADS) accessed over a local administrative share targeting the loopback address (127.0.0.1).
+description: 'The following analytic detects the creation of an NTFS alternate data stream (ADS) accessed over a local administrative share targeting the loopback address (127.0.0.1).
+
     It leverages Windows Security Event Logs with EventCode 5145 to identify this activity.
+
     Legitimate local processes access files directly rather than through a local SMB share.
+
     This behavior is a hallmark of the ShieldBreak exploit, which abuses a symbolic link swap through a loopback share to redirect a privileged, Defender-driven write into an alternate data stream on a system-owned file, ultimately landing attacker content in C:\Windows\System32.
-    If confirmed malicious, this activity indicates an in-progress local privilege escalation attempt and should be investigated immediately.
+
+    If confirmed malicious, this activity indicates an in-progress local privilege escalation attempt and should be investigated immediately.'
 data_source:
     - Windows Event Log Security 5145
-search: |-
+search: |
     `wineventlog_security`
     EventCode=5145
     IpAddress IN ("127.0.0.1", "::1")
@@ -30,13 +33,14 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_alternate_data_stream_created_over_local_share_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting Windows Security Event Logs with EventCode 5145 enabled.
+how_to_implement: 'To successfully implement this search, you need to be ingesting Windows Security Event Logs with EventCode 5145 enabled.
+
     The Windows TA is also required.
-    Enable Object Access auditing (success/failure) for File Share in group policy so that RelativeTargetName and IpAddress are populated.
-known_false_positives: |-
-    Backup, replication, or file-sync software may occasionally write alternate data streams over administrative shares.
-    Loopback (127.0.0.1) access to a local share is rare for legitimate software, tune by ShareName or src_user as needed for your environment.
+
+    Enable Object Access auditing (success/failure) for File Share in group policy so that RelativeTargetName and IpAddress are populated.'
+known_false_positives: 'Backup, replication, or file-sync software may occasionally write alternate data streams over administrative shares.
+
+    Loopback (127.0.0.1) access to a local share is rare for legitimate software, tune by ShareName or src_user as needed for your environment.'
 references:
     - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day
     - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet
@@ -48,7 +52,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_alternate_datastream___base64_content.yml b/detections/endpoint/windows_alternate_datastream___base64_content.yml
index 4c5e8894db4..9c6941de067 100644
--- a/detections/endpoint/windows_alternate_datastream___base64_content.yml
+++ b/detections/endpoint/windows_alternate_datastream___base64_content.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation of Alternate Data Streams (ADS) with Base64 content on Windows systems. It leverages Sysmon EventID 15, which captures file creation events, including the content of named streams. ADS can conceal malicious payloads, making them significant for SOC monitoring. This detection identifies hidden streams that may contain executables, scripts, or configuration data, often used by malware to evade detection. If confirmed malicious, this activity could allow attackers to hide and execute payloads, persist in the environment, or access sensitive information without being easily detected.
 data_source:
     - Sysmon EventID 15
-search: '`sysmon` EventCode=15 NOT Contents IN ("-","[ZoneTransfer]*") | regex TargetFilename="(?<!\/)\b\w+(\.\w+)?:\w+(\.\w+)?$" | regex Contents="(?:[A-Za-z0-9+/]{128,})(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" | eval file_name = replace(TargetFilename,"(.*\\\)",""), process = Image , file_path = TargetFilename , base64 = Contents, file_hash = coalesce(SHA256,SHA1,MD5,Hash) | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc file_hash file_name file_path process process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product Contents Image base64 | `base64decode(base64)` | fields - base64 | rename base64_decode as command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_alternate_datastream___base64_content_filter`'
+search: |
+    `sysmon` EventCode=15 NOT Contents IN ("-","[ZoneTransfer]*") | regex TargetFilename="(?<!\/)\b\w+(\.\w+)?:\w+(\.\w+)?$" | regex Contents="(?:[A-Za-z0-9+/]{128,})(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" | eval file_name = replace(TargetFilename,"(.*\\\)",""), process = Image , file_path = TargetFilename , base64 = Contents, file_hash = coalesce(SHA256,SHA1,MD5,Hash) | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc file_hash file_name file_path process process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product Contents Image base64 | `base64decode(base64)` | fields - base64 | rename base64_decode as command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_alternate_datastream___base64_content_filter`
 how_to_implement: Target environment must ingest sysmon data, specifically Event ID 15.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Base64 content written to an NTFS alternate data stream in $dest$, see command field for details.
     entity:
diff --git a/detections/endpoint/windows_alternate_datastream___executable_content.yml b/detections/endpoint/windows_alternate_datastream___executable_content.yml
index a40cb1db7fa..47c9cdbe200 100644
--- a/detections/endpoint/windows_alternate_datastream___executable_content.yml
+++ b/detections/endpoint/windows_alternate_datastream___executable_content.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the writing of data with an IMPHASH value to an Alternate Data Stream (ADS) in the NTFS file system. It leverages Sysmon Event ID 15 and regex to identify files with a Portable Executable (PE) structure. This activity is significant as it may indicate a threat actor staging malicious code in hidden areas for persistence or future execution. If confirmed malicious, this could allow attackers to execute hidden code, maintain persistence, or escalate privileges within the environment.
 data_source:
     - Sysmon EventID 15
-search: '`sysmon` EventCode=15 IMPHASH!=00000000000000000000000000000000 | regex TargetFilename="(?<!\/)\b\w+(\.\w+)?:\w+(\.\w+)?$" | eval file_name = replace(TargetFilename,"(.*\\\)",""), process = Image , file_path = TargetFilename, file_hash = coalesce(SHA256,SHA1,MD5,Hash) | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc file_hash file_name file_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product Contents Image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_alternate_datastream___executable_content_filter`'
+search: |
+    `sysmon` EventCode=15 IMPHASH!=00000000000000000000000000000000 | regex TargetFilename="(?<!\/)\b\w+(\.\w+)?:\w+(\.\w+)?$" | eval file_name = replace(TargetFilename,"(.*\\\)",""), process = Image , file_path = TargetFilename, file_hash = coalesce(SHA256,SHA1,MD5,Hash) | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc file_hash file_name file_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product Contents Image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_alternate_datastream___executable_content_filter`
 how_to_implement: Target environment must ingest Sysmon data, specifically Event ID 15, and import hashing/imphash must be enabled within Sysmon.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Base64 content written to an NTFS alternate data stream in $dest$, see command field for details.
     entity:
diff --git a/detections/endpoint/windows_alternate_datastream___process_execution.yml b/detections/endpoint/windows_alternate_datastream___process_execution.yml
index 6616c0ce08e..26a3d9ccbcf 100644
--- a/detections/endpoint/windows_alternate_datastream___process_execution.yml
+++ b/detections/endpoint/windows_alternate_datastream___process_execution.yml
@@ -10,7 +10,7 @@ description: The following analytic detects when a process attempts to execute a
 data_source:
     - Windows Event Log Security 4688
     - Sysmon EventID 1
-search: |-
+search: |
     | tstats count min(_time) as firstTime max(_time) as lastTime values(Processes.process_current_directory) as directory
     from datamodel=Endpoint.Processes where
     Processes.parent_process_name != "unknown"
@@ -61,7 +61,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The $process_name$ process was executed by $user$ using data from an NTFS alternate data stream.
     entity:
diff --git a/detections/endpoint/windows_anomalous_registry_value_length_in_environment_key.yml b/detections/endpoint/windows_anomalous_registry_value_length_in_environment_key.yml
index c6539b10002..a5910f4e0eb 100644
--- a/detections/endpoint/windows_anomalous_registry_value_length_in_environment_key.yml
+++ b/detections/endpoint/windows_anomalous_registry_value_length_in_environment_key.yml
@@ -6,30 +6,15 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects creation or modification of registry values under a user or system Environment key (paths matching *\Environment\*) where the stored value exceeds 2,000 characters.
+description: 'The following analytic detects creation or modification of registry values under a user or system Environment key (paths matching *\Environment\*) where the stored value exceeds 2,000 characters.
+
     Legitimate environment variables are typically short strings (paths, tokens, or flags); unusually long values can indicate adversaries or malware staging encoded payloads, bloated malicious PATH entries, or other data in a location that is loaded for every interactive session.
-    This behavior has been observed in contexts such as .NET infostealer activity. Analysts should validate the writing process, value content, and whether the change aligns with trusted software deployment or administrative tasks.
+
+    This behavior has been observed in contexts such as .NET infostealer activity. Analysts should validate the writing process, value content, and whether the change aligns with trusted software deployment or administrative tasks.'
 data_source:
     - Sysmon EventID 13
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Registry WHERE
-
-    Registry.action IN ("created", "modified")
-    Registry.registry_path= "*\\Environment\\*"
-    Registry.registry_value_name != "Path"
-
-    by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive  Registry.registry_key_name  Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product Registry.registry_value_data Registry.registry_path
-    | `drop_dm_object_name(Registry)`
-    | eval registry_value_data_len = len(registry_value_data)
-    | where registry_value_data_len > 2000
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_anomalous_registry_value_length_in_environment_key_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action IN ("created", "modified") Registry.registry_path="*\\Environment\\*" NOT Registry.registry_value_name="*Path" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product Registry.registry_value_data_len | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_anomalous_registry_value_length_in_environment_key_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml
index bc15eed8b73..4770c8cea06 100644
--- a/detections/endpoint/windows_anonymous_pipe_activity.yml
+++ b/detections/endpoint/windows_anonymous_pipe_activity.yml
@@ -6,11 +6,12 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
-description: "The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques."
+description: The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques.
 data_source:
     - Sysmon EventID 17
     - Sysmon EventID 18
-search: '`sysmon` EventCode IN (17,18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName="*Anonymous Pipe*" NOT( Image IN ("C:\\Program Files*", "C:\\Windows\\system32\\*","C:\\Windows\\syswow64\\*")) | stats  min(_time) as firstTime max(_time) as lastTime count by dest EventCode PipeName ProcessGuid ProcessId Image EventType | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_anonymous_pipe_activity_filter`'
+search: |
+    `sysmon` EventCode=17 EventCode="18" PipeName="*Anonymous Pipe*" NOT (Image IN ("C:\\Program Files*", "C:\\Windows\\system32\\*", "C:\\Windows\\syswow64\\*")) | eval PipeName=PipeName | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc pipe_name process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_anonymous_pipe_activity_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. .
 known_false_positives: Automation tool might use anonymous pipe for task orchestration or process communication.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 analytic_story:
     - Salt Typhoon
     - China-Nexus Threat Activity
diff --git a/detections/endpoint/windows_apache_benchmark_binary.yml b/detections/endpoint/windows_apache_benchmark_binary.yml
index 0632fa74a11..fb5edee13cd 100644
--- a/detections/endpoint/windows_apache_benchmark_binary.yml
+++ b/detections/endpoint/windows_apache_benchmark_binary.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.original_file_name=ab.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_apache_benchmark_binary_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.original_file_name="ab.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_apache_benchmark_binary_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited as there is a small subset of binaries that contain the original file name of ab.exe. Filter as needed.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml b/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml
index 248eaa37aff..05f757cd44d 100644
--- a/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml
+++ b/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml
@@ -10,7 +10,8 @@ description: The following analytic detects a suspicious process creating or con
 data_source:
     - Sysmon EventID 17
     - Sysmon EventID 18
-search: '`sysmon` EventCode IN (17, 18) EventType IN ( "CreatePipe", "ConnectPipe") Image IN ("*\\calc.exe", "*\\notepad.exe", "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe", "*\\OneDriveSetup.exe", "*\\dxdiag.exe", "*\\mobsync.exe", "*\\msra.exe", "*\\xwizard.exe") | regex PipeName="^\\\{[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{8}" | stats  min(_time) as firstTime max(_time) as lastTime count by dest dvc pipe_name process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product Image PipeName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_app_layer_protocol_qakbot_namedpipe_filter`'
+search: |
+    `sysmon` EventCode IN (17, 18) EventType IN ( "CreatePipe", "ConnectPipe") Image IN ("*\\calc.exe", "*\\notepad.exe", "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe", "*\\OneDriveSetup.exe", "*\\dxdiag.exe", "*\\mobsync.exe", "*\\msra.exe", "*\\xwizard.exe") | regex PipeName="^\\\{[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{8}" | stats  min(_time) as firstTime max(_time) as lastTime count by dest dvc pipe_name process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product Image PipeName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_app_layer_protocol_qakbot_namedpipe_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, pipename, processguid and named pipe event type from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml b/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml
index 59e7b20e376..a752ab24dac 100644
--- a/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml
+++ b/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml
@@ -10,7 +10,8 @@ description: The following analytic detects the wermgr.exe process creating or c
 data_source:
     - Sysmon EventID 17
     - Sysmon EventID 18
-search: '`sysmon` EventCode IN (17, 18) Image= "*\\wermgr.exe" EventType IN ( "CreatePipe", "ConnectPipe") | stats  min(_time) as firstTime max(_time) as lastTime count by dest dvc pipe_name process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product Image PipeName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_app_layer_protocol_wermgr_connect_to_namedpipe_filter`'
+search: |
+    `sysmon` EventCode=17 EventCode="18" Image="*\\wermgr.exe" | eval PipeName=PipeName | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc pipe_name process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_app_layer_protocol_wermgr_connect_to_namedpipe_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, pipename, processguid and named pipe event type from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_appcertdll_modification_via_command_line.yml b/detections/endpoint/windows_appcertdll_modification_via_command_line.yml
index 7a31021714d..dc3a848ca66 100644
--- a/detections/endpoint/windows_appcertdll_modification_via_command_line.yml
+++ b/detections/endpoint/windows_appcertdll_modification_via_command_line.yml
@@ -6,40 +6,19 @@ modification_date: '2026-07-27'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic detects attempts to modify AppCertDLL registry keys via some command line utility. Values under this key are used to specify DLLs loaded by the Windows Session Manager.
+description: 'This analytic detects attempts to modify AppCertDLL registry keys via some command line utility. Values under this key are used to specify DLLs loaded by the Windows Session Manager.
+
     Such modifications can be abused by attackers to load malicious code early in the system startup process, enabling persistent malware execution with high privileges.
-    If confirmed malicious, this behavior may lead to system compromise, persistence, and the evasion of security controls.
+
+    If confirmed malicious, this behavior may lead to system compromise, persistence, and the evasion of security controls.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process="*\\Control\\Session Manager\\AppCertDLLs*"
-
-    by Processes.process Processes.vendor_product Processes.user_id
-       Processes.process_hash Processes.parent_process_name
-       Processes.parent_process_exec Processes.action Processes.dest
-       Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name
-       Processes.parent_process Processes.parent_process_path
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id
-       Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_appcertdll_modification_via_command_line_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\\Control\\Session Manager\\AppCertDLLs*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_appcertdll_modification_via_command_line_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Modifications to AppCertDLL keys may be made by legitimate software updates or trusted system management tools. Review changes to ensure they are from approved sources.
+known_false_positives: Modifications to AppCertDLL keys may be made by legitimate software updates or trusted system management tools. Review changes to ensure they are from approved sources.
 references:
     - https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
 drilldown_searches:
@@ -50,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_appcertdll_modification_via_registry.yml b/detections/endpoint/windows_appcertdll_modification_via_registry.yml
index 28aeaf306af..83602880fd6 100644
--- a/detections/endpoint/windows_appcertdll_modification_via_registry.yml
+++ b/detections/endpoint/windows_appcertdll_modification_via_registry.yml
@@ -6,39 +6,19 @@ modification_date: '2026-07-27'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic detects attempts to modify AppCertDLL registry entries.
+description: 'This analytic detects attempts to modify AppCertDLL registry entries.
+
     Values under this registry entry are used to specify DLLs loaded by the Windows Session Manager.
+
     Such modifications can be abused by attackers to load malicious code early in the system startup process, enabling persistent malware execution with high privileges.
-    If confirmed malicious, this behavior may lead to system compromise, persistence, and the evasion of security controls.
+
+    If confirmed malicious, this behavior may lead to system compromise, persistence, and the evasion of security controls.'
 data_source:
     - Sysmon EventID 13
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Registry WHERE
-
-    Registry.action = "modified"
-    Registry.registry_path= "*\\Control\\Session Manager\\AppCertDLLs\\*"
-    Registry.registry_value_data = "*"
-
-    by Registry.action Registry.dest Registry.process_guid Registry.process_id
-       Registry.registry_hive Registry.registry_path Registry.registry_key_name
-       Registry.registry_value_data Registry.registry_value_name
-       Registry.registry_value_type Registry.status
-       Registry.user Registry.vendor_product
-
-    | `drop_dm_object_name(Registry)`
-    | where isnotnull(registry_value_data)
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_appcertdll_modification_via_registry_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
-known_false_positives: |-
-    Modifications to AppCertDLL entries may be made by legitimate software updates or trusted system management tools. Review changes to ensure they are from approved sources.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action="modified" Registry.registry_path="*\\Control\\Session Manager\\AppCertDLLs\\*" Registry.registry_value_data="*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_appcertdll_modification_via_registry_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
+known_false_positives: Modifications to AppCertDLL entries may be made by legitimate software updates or trusted system management tools. Review changes to ensure they are from approved sources.
 references:
     - https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
 drilldown_searches:
@@ -49,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml
index 7807a8b1d2c..88ea37686a5 100644
--- a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml
+++ b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml
@@ -10,7 +10,8 @@ description: The following analytic detects the use of default or publicly known
 data_source:
     - Sysmon EventID 17
     - Sysmon EventID 18
-search: '`sysmon` EventCode IN (17, 18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName IN ("\\RManFUSServerNotify32", "\\RManFUSCallbackNotify32", "\\RMSPrint*") | stats  min(_time) as firstTime max(_time) as lastTime count by dest dvc pipe_name process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product Image PipeName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter`'
+search: |
+    `sysmon` EventCode=17 EventCode="18" PipeName IN ("\\RManFUSServerNotify32", "\\RManFUSCallbackNotify32", "\\RMSPrint") | eval PipeName=PipeName | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc pipe_name process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: False positives may be present. Filter based on pipe name or process.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: possible RMS admin tool named pipe was created in endpoint $dest$
     entity:
diff --git a/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml b/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml
index f5925935625..efb408e9600 100644
--- a/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml
+++ b/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml
@@ -6,56 +6,57 @@ modification_date: '2026-10-02'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects the execution of rundll32.exe calling one of the following DLLs:
+description: 'The following analytic detects the execution of rundll32.exe calling one of the following DLLs:
+
 
     - Advpack.dll
+
     - Ieadvpack.dll
+
     - Syssetup.dll
+
     - Setupapi.dll
 
+
     with one of the following functions: "LaunchINFSection", "InstallHinfSection", "SetupInfObjectInstallAction".
+
     This method is identified through Endpoint Detection and Response (EDR) telemetry,
+
     focusing on command-line executions and process details.
+
     This activity is significant as it indicates a potential application
+
     control or whitelisting bypass, allowing script code execution from a file.
+
     If confirmed malicious, an attacker could execute arbitrary code, potentially leading to privilege escalation,
+
     persistence, or further network compromise.
-    Investigate the script content, network connections, and any spawned child processes for further context.
+
+    Investigate the script content, network connections, and any spawned child processes for further context.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-      max(_time) as lastTime
-    from datamodel=Endpoint.Processes where
-    `process_rundll32`
-    Processes.process IN ("*syssetup*", "*advpack*", "*setupapi*")
-    Processes.process IN ("*LaunchINFSection*", "*InstallHinfSection*", "*SetupInfObjectInstallAction*")
-    NOT (Processes.parent_process_name="msiexec.exe" Processes.process="* C:\\Program Files (x86)\\Netskope\\EPDLP Deployment\\*")
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_application_whitelisting_bypass_attempt_via_rundll32_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" Processes.process IN ("*syssetup*", "*advpack*", "*setupapi*") Processes.process IN ("*LaunchINFSection*", "*InstallHinfSection*", "*SetupInfObjectInstallAction*") NOT Processes.parent_process_name="*msiexec.exe" Processes.process="* C:\\Program Files (x86)\\Netskope\\EPDLP Deployment\\*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_application_whitelisting_bypass_attempt_via_rundll32_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions.
+
     These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product.
+
     The logs must also be mapped to the `Processes` node of the `Endpoint` data model.
-    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    Although unlikely, some legitimate applications may leverage one of the following DLLs syssetup.dll, dvpack.dll, ieadvpack.dll and can trigger a false positive. Apply additional filters as needed.
+
+    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.'
+known_false_positives: Although unlikely, some legitimate applications may leverage one of the following DLLs syssetup.dll, dvpack.dll, ieadvpack.dll and can trigger a false positive. Apply additional filters as needed.
 references:
     - https://attack.mitre.org/techniques/T1218/011/
     - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
@@ -77,7 +78,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/windows_applocker_block_events.yml b/detections/endpoint/windows_applocker_block_events.yml
index e6acb3d585c..aa8efa755ae 100644
--- a/detections/endpoint/windows_applocker_block_events.yml
+++ b/detections/endpoint/windows_applocker_block_events.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic detects attempts to bypass application restrictions by identifying Windows AppLocker policy violations. It leverages Windows AppLocker event logs, specifically EventCodes 8007, 8004, 8022, 8025, 8029, and 8040, to pinpoint blocked actions. This activity is significant for a SOC as it highlights potential unauthorized application executions, which could indicate malicious intent or policy circumvention. If confirmed malicious, this activity could allow an attacker to execute unauthorized applications, potentially leading to further system compromise or data exfiltration.
 data_source: []
-search: |-
+search: |
     `applocker`  EventCode IN (8007, 8004, 8022, 8025, 8029, 8040)
       | spath input=UserData_Xml
       | rename RuleAndFileData.* as *, TargetUser as user, Computer as dest
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -56,6 +56,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562/applocker/applocker.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-AppLocker/MSI and Script
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_applocker_execution_from_uncommon_locations.yml b/detections/endpoint/windows_applocker_execution_from_uncommon_locations.yml
index 2c13bebceba..1079d2df0d6 100644
--- a/detections/endpoint/windows_applocker_execution_from_uncommon_locations.yml
+++ b/detections/endpoint/windows_applocker_execution_from_uncommon_locations.yml
@@ -8,7 +8,7 @@ status: production
 type: Hunting
 description: The following analytic identifies the execution of applications or scripts from uncommon or suspicious file paths, potentially indicating malware or unauthorized activity. It leverages Windows AppLocker event logs and uses statistical analysis to detect anomalies. By calculating the average and standard deviation of execution counts per file path, it flags paths with execution counts significantly higher than expected. This behavior is significant as it can uncover malicious activities or policy violations. If confirmed malicious, this activity could allow attackers to execute unauthorized code, leading to potential system compromise or data breaches.
 data_source: []
-search: |-
+search: |
     `applocker`
       | spath input=UserData_Xml
       | rename RuleAndFileData.* as *, Computer as dest, TargetUser AS user
@@ -42,6 +42,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562/applocker/applocker.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-AppLocker/MSI and Script
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml b/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml
index 15e389f0588..c5c2ff8d7a5 100644
--- a/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml
+++ b/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml
@@ -8,7 +8,7 @@ status: production
 type: TTP
 description: The following analytic utilizes Windows AppLocker event logs to identify attempts to bypass application restrictions. AppLocker is a feature that allows administrators to specify which applications are permitted to run on a system. This analytic is designed to identify attempts to bypass these restrictions, which could be indicative of an attacker attempting to escalate privileges. The analytic uses EventCodes 8007, 8004, 8022, 8025, 8029, and 8040 to identify these attempts. The analytic will identify the host, full file path, and target user associated with the bypass attempt. These EventCodes are related to block events and focus on 5 attempts or more.
 data_source: []
-search: |-
+search: |
     `applocker` EventCode IN (8007, 8004, 8022, 8025, 8029, 8040)
       | spath input=UserData_Xml
       | rename RuleAndFileData.* as *, Computer as dest, TargetUser AS user
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An attempt to bypass application restrictions was detected on a host $dest$.
     entity:
@@ -55,6 +55,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562/applocker/applocker.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-AppLocker/MSI and Script
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_applocker_rare_application_launch_detection.yml b/detections/endpoint/windows_applocker_rare_application_launch_detection.yml
index 70090e11c07..d6ca0bd88d1 100644
--- a/detections/endpoint/windows_applocker_rare_application_launch_detection.yml
+++ b/detections/endpoint/windows_applocker_rare_application_launch_detection.yml
@@ -8,7 +8,7 @@ status: production
 type: Hunting
 description: The following analytic detects the launch of rarely used applications within the environment, which may indicate the use of potentially malicious software or tools by attackers. It leverages Windows AppLocker event logs, aggregating application launch counts over time and flagging those that significantly deviate from the norm. This behavior is significant as it helps identify unusual application activity that could signal a security threat. If confirmed malicious, this activity could allow attackers to execute unauthorized code, potentially leading to further compromise of the system.
 data_source: []
-search: |-
+search: |
     `applocker`
       | spath input=UserData_Xml
       | rename RuleAndFileData.* as *, Computer as dest, TargetUser AS user
@@ -38,6 +38,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562/applocker/applocker.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-AppLocker/MSI and Script
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_appx_deployment_full_trust_package_installation.yml b/detections/endpoint/windows_appx_deployment_full_trust_package_installation.yml
index ea242b8c747..22089f2db62 100644
--- a/detections/endpoint/windows_appx_deployment_full_trust_package_installation.yml
+++ b/detections/endpoint/windows_appx_deployment_full_trust_package_installation.yml
@@ -9,15 +9,8 @@ type: Hunting
 description: The following analytic detects the installation of MSIX/AppX packages with full trust privileges. This detection leverages Windows event logs from the AppXDeployment-Server, specifically focusing on EventCode 400 which indicates a package deployment operation. Full trust packages are significant as they run with elevated privileges outside the normal AppX container restrictions, allowing them to access system resources that regular AppX packages cannot. Adversaries have been observed leveraging full trust MSIX packages to deliver malware, as documented in recent threat intelligence reports. If confirmed malicious, these packages could allow attackers to execute arbitrary code with elevated privileges, establish persistence, or deliver malware while evading traditional detection mechanisms.
 data_source:
     - Windows Event Log AppXDeployment-Server 400
-search: |-
-    `wineventlog_appxdeploymentserver` EventCode=400 HasFullTrust="true"
-      | stats count min(_time) as firstTime max(_time) as lastTime values(PackageFullName) as PackageFullName values(Path) as PackagePath values(PackageSourceUri) as PackageSourceUri values(PackageDisplayName) as PackageDisplayName values(CallingProcess) as CallingProcess values(IsCentennial) as IsCentennial
-        BY dvc EventCode HasFullTrust
-           user_id
-      | rename dvc as dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_appx_deployment_full_trust_package_installation_filter`
+search: |
+    `wineventlog_appxdeploymentserver` EventCode="400" HasFullTrust="true" | stats count min(_time) as firstTime max(_time) as lastTime by _time dest dvc EventCode Path ProcessID user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_appx_deployment_full_trust_package_installation_filter`
 how_to_implement: To implement this search, you need to configure Windows event log collection for the Microsoft-Windows-AppXDeploymentServer/Operational channel. This can be done through Windows Event Forwarding, Splunk Universal Forwarders, or other log collection methods. Ensure that the log collection method preserves the full XML structure of the events. The sourcetype should be set to XmlWinEventLog or WinEventLog depending on your environment configuration. This detection specifically looks for EventCode 400, which indicates package deployment operations, and filters for packages with full trust privileges.
 known_false_positives: Legitimate applications may be deployed as full trust MSIX packages, especially line-of-business applications that require access to system resources. Microsoft Store applications, development tools, and enterprise applications may legitimately use full trust packages. Verify if the package is from a trusted source and signed by a trusted publisher before taking action. Review the package source URI and calling process to determine if the installation is expected in your environment.
 references:
@@ -34,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Look for related PowerShell activity from the same dest
       search: '`powershell` EventCode=4104 dest="$dest$" | stats count by ScriptBlockText'
       earliest_offset: $info_min_time$
@@ -55,6 +48,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/appx/windows_appxdeploymentserver.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_appx_deployment_package_installation_success.yml b/detections/endpoint/windows_appx_deployment_package_installation_success.yml
index 9a72f3d71ee..4141cffcc42 100644
--- a/detections/endpoint/windows_appx_deployment_package_installation_success.yml
+++ b/detections/endpoint/windows_appx_deployment_package_installation_success.yml
@@ -9,14 +9,8 @@ type: Anomaly
 description: This analytic detects successful MSIX/AppX package installations on Windows systems by monitoring EventID 854 in the Microsoft-Windows-AppXDeployment-Server/Operational log. This event is generated when an MSIX/AppX package has been successfully installed on a system. While most package installations are legitimate, monitoring these events can help identify unauthorized or suspicious package installations, especially when correlated with other events such as unsigned package installations (EventID 603 with Flags=8388608) or full trust package installations (EventID 400 with HasFullTrust=true).
 data_source:
     - Windows Event Log AppXDeployment-Server 854
-search: |-
-    `wineventlog_appxdeploymentserver` EventCode=854
-      | stats count min(_time) as firstTime max(_time) as lastTime values(Path) as PackagePath
-        BY dvc EventCode user_id
-      | rename dvc as dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_appx_deployment_package_installation_success_filter`
+search: |
+    `wineventlog_appxdeploymentserver` EventCode="854" | eval PackagePath=Path | stats count min(_time) as firstTime max(_time) as lastTime by _time dest dvc EventCode Path user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_appx_deployment_package_installation_success_filter`
 how_to_implement: To implement this detection, you need to be collecting Windows Event Logs from your endpoints, specifically the Microsoft-Windows-AppXDeploymentServer/Operational log. Ensure that your Splunk deployment is ingesting these logs with the source type "XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational". This detection works best when used in conjunction with other MSIX package abuse detections such as unsigned package installations (EventID 603) and full trust package installations (EventID 400).
 known_false_positives: Legitimate MSIX/AppX package installations will trigger this detection. This is expected behavior and not necessarily indicative of malicious activity. This analytic is designed to provide visibility into package installations and should be used as part of a broader detection strategy. Consider correlating these events with other suspicious indicators such as unsigned packages or packages from unusual sources.
 references:
@@ -29,11 +23,11 @@ drilldown_searches:
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
     - name: View related unsigned package installations for - "$dest$"
-      search: 'source="XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational" EventCode=603 Flags="8388608" host="$dest$"'
+      search: source="XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational" EventCode=603 Flags="8388608" host="$dest$"
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
     - name: View related full trust package installations for - "$dest$"
-      search: 'source="XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational" EventCode=400 HasFullTrust="true" host="$dest$"'
+      search: source="XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational" EventCode=400 HasFullTrust="true" host="$dest$"
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
 intermediate_findings:
@@ -60,6 +54,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/appx/windows_appxdeploymentserver.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_appx_deployment_unsigned_package_installation.yml b/detections/endpoint/windows_appx_deployment_unsigned_package_installation.yml
index 49b3c7843e5..832e30d5711 100644
--- a/detections/endpoint/windows_appx_deployment_unsigned_package_installation.yml
+++ b/detections/endpoint/windows_appx_deployment_unsigned_package_installation.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter. This detection leverages Windows event logs from the AppXDeployment-Server, specifically focusing on EventID 603 which indicates the start of a deployment operation with specific deployment flags. The flag value 8388608 corresponds to the -AllowUnsigned option in PowerShell's Add-AppxPackage cmdlet. This activity is significant as adversaries have been observed leveraging unsigned MSIX packages to deliver malware, bypassing signature verification that would normally protect users from malicious packages. If confirmed malicious, this could allow attackers to execute arbitrary code, establish persistence, or deliver malware while evading traditional detection mechanisms.
 data_source:
     - Windows Event Log AppXDeployment-Server 855
-search: |-
-    `wineventlog_appxdeploymentserver` EventCode=603 Flags="8388608"
-      | stats count min(_time) as firstTime max(_time) as lastTime values(Path) as file_name values(CallingProcess) as CallingProcess
-        BY dvc EventCode Flags
-           user_id
-      | rename dvc as dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_appx_deployment_unsigned_package_installation_filter`
+search: |
+    `wineventlog_appxdeploymentserver` EventCode="603" Flags="8388608" | eval file_name=Path, CallingProcess=CallingProcess | stats count min(_time) as firstTime max(_time) as lastTime by _time dest dvc EventCode user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_appx_deployment_unsigned_package_installation_filter`
 how_to_implement: To implement this search, you need to configure Windows event log collection for the Microsoft-Windows-AppXDeploymentServer/Operational channel. This can be done through Windows Event Forwarding, Splunk Universal Forwarders, or other log collection methods. Ensure that the log collection method preserves the full XML structure of the events. The sourcetype should be set to XmlWinEventLog or WinEventLog depending on your environment configuration. This detection specifically looks for EventID 603 with a Flags value of 8388608, which indicates the use of the -AllowUnsigned parameter when installing MSIX packages.
 known_false_positives: Legitimate software development and testing activities may trigger this detection. Internal application development teams testing MSIX packages before signing or system administrators installing custom unsigned applications for business purposes may use the -AllowUnsigned parameter. Note that the -AllowUnsigned flag is only available on Windows 11 and later versions. Verify if the package installation is expected in your environment and if the calling process and user are authorized to install unsigned packages.
 references:
@@ -33,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Look for related PowerShell activity from the same dest
       search: '`powershell` EventCode=4104 dest="$dest$" ScriptBlockText="*Add-AppxPackage*" OR ScriptBlockText="*Add-AppPackage*" | stats count by ScriptBlockText'
       earliest_offset: $info_min_time$
@@ -63,6 +56,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/appx/windows_appxdeploymentserver.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_archive_collected_data_via_powershell.yml b/detections/endpoint/windows_archive_collected_data_via_powershell.yml
index fd4a9c6df97..d90a7f3bc8f 100644
--- a/detections/endpoint/windows_archive_collected_data_via_powershell.yml
+++ b/detections/endpoint/windows_archive_collected_data_via_powershell.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of PowerShell scripts to archive files into a temporary folder. It leverages PowerShell Script Block Logging, specifically monitoring for the `Compress-Archive` command targeting the `Temp` directory. This activity is significant as it may indicate an adversary's attempt to collect and compress data for exfiltration. If confirmed malicious, this behavior could lead to unauthorized data access and exfiltration, posing a severe risk to sensitive information and overall network security.
 data_source:
     - Powershell Script Block Logging 4104
-search: '`powershell` EventCode=4104 ScriptBlockText = "*Compress-Archive*"  ScriptBlockText = "*\\Temp\\*" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_archive_collected_data_via_powershell_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Compress-Archive*" Processes.process="*\\Temp\\*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_archive_collected_data_via_powershell_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: powershell may used this function to archive data.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_archive_collected_data_via_rar.yml b/detections/endpoint/windows_archive_collected_data_via_rar.yml
index 2f0166454d6..0254900f6b4 100644
--- a/detections/endpoint/windows_archive_collected_data_via_rar.yml
+++ b/detections/endpoint/windows_archive_collected_data_via_rar.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name="Rar.exe"
-        OR
-        Processes.original_file_name = "Rar.exe"
-        AND
-        Processes.process = "*a*" Processes.process = "* -ep1*" Processes.process = "* -r*" Processes.process = "* -y*" Processes.process = "* -v5m*" Processes.process = "* -m1*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_archive_collected_data_via_rar_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.original_file_name="Rar.exe" Processes.process="*a*" Processes.process="* -ep1*" Processes.process="* -r*" Processes.process="* -y*" Processes.process="* -v5m*" Processes.process="* -m1*") OR Processes.process_name="*Rar.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_archive_collected_data_via_rar_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: user and network administrator can execute this command.
 references:
@@ -41,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_archived_collected_data_in_temp_folder.yml b/detections/endpoint/windows_archived_collected_data_in_temp_folder.yml
index c5d2c1f0913..7eb7e1cf993 100644
--- a/detections/endpoint/windows_archived_collected_data_in_temp_folder.yml
+++ b/detections/endpoint/windows_archived_collected_data_in_temp_folder.yml
@@ -10,25 +10,13 @@ description: The following analytic detects the creation of archived files in a
 data_source:
     - Sysmon EventID 11
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-      max(_time) as lastTime
-    FROM datamodel=Endpoint.Filesystem where
-      Filesystem.file_name IN ("*.zip", "*.rar", "*.tar", "*.7z")
-      Filesystem.file_path IN ("*\\AppData\\Local\\Temp\\*", "*\\Windows\\Temp\\*")
-    by Filesystem.action Filesystem.dest Filesystem.file_access_time
-       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-       Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size
-       Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_archived_collected_data_in_temp_folder_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.zip", "*.rar", "*.tar", "*.7z") Filesystem.file_path IN ("*\\AppData\\Local\\Temp\\*", "*\\Windows\\Temp\\*") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_archived_collected_data_in_temp_folder_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: |
-    Some installers, debugging or support tools may create archive files in the temp folder.
+known_false_positives: 'Some installers, debugging or support tools may create archive files in the temp folder.
+
     Legitimate software may also use temporary folders for archiving purposes.
-    Review and apply filters as needed.
+
+    Review and apply filters as needed.'
 references:
     - https://x.com/suyog41/status/1825869470323056748
     - https://g0njxa.medium.com/from-vietnam-to-united-states-malware-fraud-and-dropshipping-98b7a7b2c36d
@@ -40,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_attempt_to_stop_security_service.yml b/detections/endpoint/windows_attempt_to_stop_security_service.yml
index bb970385674..cd5b17ee59c 100644
--- a/detections/endpoint/windows_attempt_to_stop_security_service.yml
+++ b/detections/endpoint/windows_attempt_to_stop_security_service.yml
@@ -11,7 +11,7 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
       WHERE (
             (`process_net`
@@ -46,7 +46,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/windows_audit_policy_auditing_option_disabled_via_auditpol.yml b/detections/endpoint/windows_audit_policy_auditing_option_disabled_via_auditpol.yml
index 18315e0fbf7..0d9a0229d66 100644
--- a/detections/endpoint/windows_audit_policy_auditing_option_disabled_via_auditpol.yml
+++ b/detections/endpoint/windows_audit_policy_auditing_option_disabled_via_auditpol.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_auditpol` Processes.process="*/set*" Processes.process="*/option:*" Processes.process="*/value:disable*" Processes.process IN ("*FullPrivilegeAuditing*", "*AuditBaseObjects*", "*AuditBaseDirectories*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_audit_policy_auditing_option_disabled_via_auditpol_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*auditpol.exe" OR Processes.original_file_name="AUDITPOL.EXE" Processes.process="*/set*" Processes.process="*/option:*" Processes.process="*/value:disable*" Processes.process IN ("*FullPrivilegeAuditing*", "*AuditBaseObjects*", "*AuditBaseDirectories*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_auditing_option_disabled_via_auditpol_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time. and understood.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable an audit policy auditing option on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/windows_audit_policy_auditing_option_modified___registry.yml b/detections/endpoint/windows_audit_policy_auditing_option_modified___registry.yml
index 5b270028a92..d9133692ad7 100644
--- a/detections/endpoint/windows_audit_policy_auditing_option_modified___registry.yml
+++ b/detections/endpoint/windows_audit_policy_auditing_option_modified___registry.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects potentially suspicious modifications to the Audit Policy auditing options registry values. It leverages data from the Endpoint.Registry data model, focusing on changes to one of the following auditing option values "CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects" and "AuditBaseDirectories" within the "HKLM\\System\\CurrentControlSet\\Control\\Lsa\\" registry key. This activity is significant as it could be a sign of a threat actor trying to tamper with the audit policy configuration, and disabling SACLs configuration. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path="*\\Control\\Lsa*" Registry.registry_value_name IN ("CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects", "AuditBaseDirectories") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_auditing_option_modified___registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\Lsa*" Registry.registry_value_name IN ("*CrashOnAuditFail", "*FullPrivilegeAuditing", "*AuditBaseObjects", "*AuditBaseDirectories") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_auditing_option_modified___registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: Active setup installer may add or modify this registry.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_audit_policy_cleared_via_auditpol.yml b/detections/endpoint/windows_audit_policy_cleared_via_auditpol.yml
index 77ea5088123..eecbf25a8db 100644
--- a/detections/endpoint/windows_audit_policy_cleared_via_auditpol.yml
+++ b/detections/endpoint/windows_audit_policy_cleared_via_auditpol.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_auditpol` Processes.process IN ("*/clear*", "*/remove*")
-        AND
-        NOT Processes.process IN ("*/resourceSACL*", "*/?*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_audit_policy_cleared_via_auditpol_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*auditpol.exe" OR Processes.original_file_name="AUDITPOL.EXE" Processes.process IN ("*/clear*", "*/remove*") NOT (Processes.process IN ("*/resourceSACL*", "*/**")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_cleared_via_auditpol_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time. and understood.
 references:
@@ -43,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to clear logging on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/windows_audit_policy_disabled_via_auditpol.yml b/detections/endpoint/windows_audit_policy_disabled_via_auditpol.yml
index 884bca3b8b4..e79dbd685ba 100644
--- a/detections/endpoint/windows_audit_policy_disabled_via_auditpol.yml
+++ b/detections/endpoint/windows_audit_policy_disabled_via_auditpol.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_auditpol` Processes.process="*/set*" Processes.process IN ("*/success:*", "*/failure:*") Processes.process="*disable*"
-        AND
-        NOT Processes.process IN ("*/?*", "*/exclude*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_audit_policy_disabled_via_auditpol_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*auditpol.exe" OR Processes.original_file_name="AUDITPOL.EXE" Processes.process="*/set*" Processes.process IN ("*/success:*", "*/failure:*") Processes.process="*disable*" NOT (Processes.process IN ("*/**", "*/exclude*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_disabled_via_auditpol_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be rare, investigate the activity, and apply additional filters when necessary.
 references:
@@ -42,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_audit_policy_disabled_via_legacy_auditpol.yml b/detections/endpoint/windows_audit_policy_disabled_via_legacy_auditpol.yml
index 0c4a989f937..c6cf939fce9 100644
--- a/detections/endpoint/windows_audit_policy_disabled_via_legacy_auditpol.yml
+++ b/detections/endpoint/windows_audit_policy_disabled_via_legacy_auditpol.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            `process_auditpol` Processes.process="*/disable"
-        )
-        OR Processes.process IN ("*/system:none*", "*/logon:none*", "*/object:none*", "*/privilege:none*", "*/process:none*", "*/policy:none*", "*/sam:none*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_audit_policy_disabled_via_legacy_auditpol_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*auditpol.exe" OR Processes.original_file_name="AUDITPOL.EXE" Processes.process="*/disable" OR Processes.process IN ("*/system:none*", "*/logon:none*", "*/object:none*", "*/privilege:none*", "*/process:none*", "*/policy:none*", "*/sam:none*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_disabled_via_legacy_auditpol_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be rare, investigate the activity, and apply additional filters when necessary.
 references:
@@ -43,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_audit_policy_excluded_category_via_auditpol.yml b/detections/endpoint/windows_audit_policy_excluded_category_via_auditpol.yml
index fc7763f3412..dd822f3f486 100644
--- a/detections/endpoint/windows_audit_policy_excluded_category_via_auditpol.yml
+++ b/detections/endpoint/windows_audit_policy_excluded_category_via_auditpol.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_auditpol` Processes.process="*/set*" Processes.process="*/exclude*"
-        AND
-        NOT Processes.process="*/?*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_audit_policy_excluded_category_via_auditpol_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*auditpol.exe" OR Processes.original_file_name="AUDITPOL.EXE" Processes.process="*/set*" Processes.process="*/exclude*" NOT Processes.process="*/**" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_excluded_category_via_auditpol_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be rare, investigate the activity, and apply additional filters when necessary.
 references:
@@ -42,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_audit_policy_restored_via_auditpol.yml b/detections/endpoint/windows_audit_policy_restored_via_auditpol.yml
index 000fad0d064..beb983dcb1a 100644
--- a/detections/endpoint/windows_audit_policy_restored_via_auditpol.yml
+++ b/detections/endpoint/windows_audit_policy_restored_via_auditpol.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_auditpol` Processes.process="*/restore*" Processes.process="*/file*"
-        AND
-        NOT Processes.process="*/?*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_audit_policy_restored_via_auditpol_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*auditpol.exe" OR Processes.original_file_name="AUDITPOL.EXE" Processes.process="*/restore*" Processes.process="*/file*" NOT Processes.process="*/**" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_restored_via_auditpol_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives could arise from administrative activity such as audit policy setup. Apply additional filters to known scripts and parent processes performing this action where necessary.
 references:
@@ -42,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_audit_policy_security_descriptor_tampering_via_auditpol.yml b/detections/endpoint/windows_audit_policy_security_descriptor_tampering_via_auditpol.yml
index f86abe2a516..f79cdb64907 100644
--- a/detections/endpoint/windows_audit_policy_security_descriptor_tampering_via_auditpol.yml
+++ b/detections/endpoint/windows_audit_policy_security_descriptor_tampering_via_auditpol.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_auditpol` Processes.process="*/set*" Processes.process="*/sd:*"
-        AND
-        NOT Processes.process="*/?*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_audit_policy_security_descriptor_tampering_via_auditpol_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*auditpol.exe" OR Processes.original_file_name="AUDITPOL.EXE" Processes.process="*/set*" Processes.process="*/sd:*" NOT Processes.process="*/**" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_audit_policy_security_descriptor_tampering_via_auditpol_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be rare to non existent. Any activity detected by this analytic should be investigated and approved or denied.
 references:
@@ -39,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_autoit3_execution.yml b/detections/endpoint/windows_autoit3_execution.yml
index 6438be1cb1c..5017165ec58 100644
--- a/detections/endpoint/windows_autoit3_execution.yml
+++ b/detections/endpoint/windows_autoit3_execution.yml
@@ -6,40 +6,25 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects the execution of AutoIt3, a scripting
+description: 'The following analytic detects the execution of AutoIt3, a scripting
+
     language often used for automating Windows GUI tasks and general scripting.
+
     It identifies instances where AutoIt3 or its variants are executed by searching for process names
-    or original file names matching 'autoit3.exe'.
+
+    or original file names matching ''autoit3.exe''.
+
     This activity is significant because attackers frequently use AutoIt3 to automate malicious actions, such as executing malware.
+
     If confirmed malicious, this activity could lead to unauthorized code execution,
-    system compromise, or further propagation of malware within the environment.
+
+    system compromise, or further propagation of malware within the environment.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-      max(_time) as lastTime
-    from datamodel=Endpoint.Processes where
-    (
-      Processes.process_name = "autoit*.exe"
-      OR
-      Processes.original_file_name = "autoit*.exe"
-    )
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_autoit3_execution_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="autoit*.exe" OR Processes.original_file_name="autoit*.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_autoit3_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present if the application is legitimately used, filter by user or endpoint as needed.
 references:
@@ -52,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Execution of AutoIt3 detected. The source process is $parent_process_name$ and the destination process is $process_name$ on $dest$ by
     entity:
diff --git a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml
index 8e479ce37e2..54cb0bd2cb1 100644
--- a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml
+++ b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to undocumented registry keys that allow a DLL to load into lsass.exe, potentially capturing credentials. It leverages the Endpoint.Registry data model to identify changes to \CurrentControlSet\Services\NTDS\DirectoryServiceExtPt or \CurrentControlSet\Services\NTDS\LsaDbExtPt. This activity is significant as it indicates a possible attempt to inject malicious code into the Local Security Authority Subsystem Service (LSASS), which can lead to credential theft. If confirmed malicious, this could allow attackers to gain unauthorized access to sensitive information and escalate privileges within the environment.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt","*\\CurrentControlSet\\Services\\NTDS\\LsaDbExtPt") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_autostart_execution_lsass_driver_registry_modification_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt", "*\\CurrentControlSet\\Services\\NTDS\\LsaDbExtPt") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_autostart_execution_lsass_driver_registry_modification_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives may be present on recent Windows Operating Systems. Filtering may be required based on process_name. In addition, look for non-standard, unsigned, module loads into LSASS. If query is too noisy, modify by adding Endpoint.processes process_name to query to identify the process making the modification.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The registry values for DirectoryServiceExtPt or LsaDbExtPt were modified on $dest$.
     entity:
diff --git a/detections/endpoint/windows_azure_powershell_module_installation_via_powershell_script.yml b/detections/endpoint/windows_azure_powershell_module_installation_via_powershell_script.yml
index 2ea7ec94e9c..44fe4157535 100644
--- a/detections/endpoint/windows_azure_powershell_module_installation_via_powershell_script.yml
+++ b/detections/endpoint/windows_azure_powershell_module_installation_via_powershell_script.yml
@@ -6,37 +6,16 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic detects the installation of Azure AD and cloud management modules via PowerShell Script Block Logging.
-    Tools such as AADInternals, AzureAD, MSOnline, and Az.Resources provide deep access to Azure Active Directory objects, user accounts, service principals, and tenant configurations making them high-value targets for adversaries conducting reconnaissance, privilege escalation, or persistence operations post-compromise.
+description: 'This analytic detects the installation of Azure AD and cloud management modules via PowerShell Script Block Logging.
+
+    Tools such as AADInternals, AzureAD, MSOnline, and Az.Resources provide deep access to Azure Active Directory objects, user accounts, service principals, and tenant configurations making them high-value targets for adversaries conducting reconnaissance, privilege escalation, or persistence operations post-compromise.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventID="4104"
-    ScriptBlockText IN (
-        "*Install-Module -Name AADInternals*",
-        "*Install-Module -Name Az.Resources*",
-        "*Install-Module -Name AzureAd*",
-        "*Install-Module -Name MSOnline*",
-        "*Install-Module AADInternals*",
-        "*Install-Module Az.Resources*",
-        "*Install-Module AzureAd*",
-        "*Install-Module MSOnline*"
-    )
-    | fillnull
-    | stats count min(_time) as firstTime
-            max(_time) as lastTime
-      by Computer EventID ScriptBlockText signature signature_id
-         user_id vendor_product Guid Opcode
-         Name Path ProcessID ScriptBlockId
-
-    | rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_azure_powershell_module_installation_via_powershell_script_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*Install-Module -Name AADInternals*", "*Install-Module -Name Az.Resources*", "*Install-Module -Name AzureAd*", "*Install-Module -Name MSOnline*", "*Install-Module AADInternals*", "*Install-Module Az.Resources*", "*Install-Module AzureAd*", "*Install-Module MSOnline*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_azure_powershell_module_installation_via_powershell_script_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate administrators often install these modules for managing Azure environments. Filter alerts for authorized personnel and approved administrative activities.
+references: []
 drilldown_searches:
     - earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
@@ -45,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_azure_storage_utility_execution_via_cli.yml b/detections/endpoint/windows_azure_storage_utility_execution_via_cli.yml
index ca21af86777..5e09d5cfbb6 100644
--- a/detections/endpoint/windows_azure_storage_utility_execution_via_cli.yml
+++ b/detections/endpoint/windows_azure_storage_utility_execution_via_cli.yml
@@ -6,41 +6,19 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic detects the execution of Azure Storage utilities such as AzCopy and Storage Explorer via the CLI.
+description: 'This analytic detects the execution of Azure Storage utilities such as AzCopy and Storage Explorer via the CLI.
+
     These tools enable large-scale data transfers over trusted cloud channels, allowing malicious activity to blend with legitimate traffic and evade traditional network defenses.
+
     Adversaries may leverage them post-compromise to stage or extract sensitive data from endpoints.
-    While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.
+
+    While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_name IN (
-        "AzCopy.exe",
-        "StorageExplorer.exe"
-    )
-
-    by Processes.process Processes.vendor_product Processes.user_id
-       Processes.process_hash Processes.parent_process_name
-       Processes.parent_process_exec Processes.action Processes.dest
-       Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name
-       Processes.parent_process Processes.parent_process_path
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id
-       Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_azure_storage_utility_execution_via_cli_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*AzCopy.exe", "*StorageExplorer.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_azure_storage_utility_execution_via_cli_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate IT operations and cloud administrators frequently use Windows Azure Storage Tools for data management and backups. Investigate unexpected usage to rule out unauthorized access or exfiltration.
 references:
@@ -53,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_binary_execution_from_an_archive.yml b/detections/endpoint/windows_binary_execution_from_an_archive.yml
index c404af75953..8cd6292a55b 100644
--- a/detections/endpoint/windows_binary_execution_from_an_archive.yml
+++ b/detections/endpoint/windows_binary_execution_from_an_archive.yml
@@ -6,45 +6,16 @@ modification_date: '2026-05-13'
 author: Raven Tait, Nasreddine Bencherchali, Splunk
 status: experimental
 type: Anomaly
-description: |-
-    Detects the execution of a binary from archive-related paths in the user's Temp directory.
+description: 'Detects the execution of a binary from archive-related paths in the user''s Temp directory.
+
     It looks for binaries launched by `explorer.exe`, `winrar.exe`, or `7zFM.exe`, where the executed process path includes Temp and archive markers such as RAR, 7z, or ZIP.
-    This was abused by attackers to bypass Mark-of-the-Web (MOTW) such as CVE-2025-0411 or exploit certain vulnerabilities.
+
+    This was abused by attackers to bypass Mark-of-the-Web (MOTW) such as CVE-2025-0411 or exploit certain vulnerabilities.'
 data_source:
     - Sysmon EventID 1
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.parent_process_name IN (
-        "explorer.exe",
-        "winrar.exe",
-        "7zFM.exe"
-    )
-    Processes.process_path="*\\AppData\\Local\\Temp\\*"
-    Processes.process_path IN (
-        "*\\rar*",
-        "*\\7z*",
-        "*.zip*"
-    )
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name
-       Processes.parent_process Processes.parent_process_path
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id
-       Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_binary_execution_from_an_archive_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*explorer.exe", "*winrar.exe", "*7zFM.exe") Processes.process_path="*\\AppData\\Local\\Temp\\*" Processes.process_path IN ("*\\rar*", "*\\7z*", "*.zip*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_binary_execution_from_an_archive_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some installers, administrative packages, or automation workflows may extract and run binaries from archive files in temporary directories. Review the parent process, executed path, and user context before tuning approved activity.
 references:
@@ -57,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml
index 53232bd57ed..fe531b67ff9 100644
--- a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml
+++ b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=mavinject.exe Processes.process IN ("*injectrunning*", "*hmodule=0x*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_binary_proxy_execution_mavinject_dll_injection_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*mavinject.exe" Processes.process IN ("*injectrunning*", "*hmodule=0x*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_binary_proxy_execution_mavinject_dll_injection_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter on DLL name or parent process.
 references:
@@ -40,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting load a DLL.
     entity:
diff --git a/detections/endpoint/windows_bitdefender_submission_wizard_dll_sideloading.yml b/detections/endpoint/windows_bitdefender_submission_wizard_dll_sideloading.yml
index d995f03f842..0196a382d04 100644
--- a/detections/endpoint/windows_bitdefender_submission_wizard_dll_sideloading.yml
+++ b/detections/endpoint/windows_bitdefender_submission_wizard_dll_sideloading.yml
@@ -6,45 +6,13 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: experimental
 type: TTP
-description: |
-    Detects DLL side-loading of Bitdefender Submission Wizard (BDSubmit.exe, bdsw.exe, or renamed BluetoothService.exe) when a malicious log.dll is loaded from a non-standard path via Sysmon ImageLoad events.
+description: Detects DLL side-loading of Bitdefender Submission Wizard (BDSubmit.exe, bdsw.exe, or renamed BluetoothService.exe) when a malicious log.dll is loaded from a non-standard path via Sysmon ImageLoad events.
 data_source:
     - Sysmon EventID 7
-search: |-
-    `sysmon`
-    EventCode=7
-    (
-        Image IN (
-            "*\\BDSubmit.exe",
-            "*\\bdsw.exe",
-            "*\\BluetoothService.exe"
-        )
-        OR
-        OriginalFileName IN (
-            "BDSubmit.exe",
-            "bdsw.exe"
-        )
-    )
-    ImageLoaded="*\\log.dll"
-    NOT ImageLoaded IN (
-        "*:\\Program Files (x86)\\*",
-        "*:\\Program Files\\*",
-        "*:\\Windows\\System32\\*",
-        "*:\\Windows\\SysWOW64\\*"
-    )
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by dest Image ImageLoaded Signed SignatureStatus User OriginalFileName loaded_file
-         loaded_file_path process_exec process_guid process_hash process_id process_name
-         process_path service_dll_signature_exists service_dll_signature_verified signature
-         signature_id user_id vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_bitdefender_submission_wizard_dll_sideloading_filter`
-how_to_implement: |
-    Ingest Sysmon ImageLoad events and ensure the Splunk Add-on for Sysmon is configured to parse them. Enable ImageLoad in Sysmon config for DLLs. Map logs to Endpoint data model where applicable.
-known_false_positives: |
-    Legitimate Bitdefender installations loading log.dll from Program Files are excluded. Allowlist known paths as needed.
+search: |
+    `sysmon` EventCode=7 Image IN ("*\\BDSubmit.exe", "*\\bdsw.exe", "*\\BluetoothService.exe") OR OriginalFileName IN ("BDSubmit.exe", "bdsw.exe") ImageLoaded="*\\log.dll" NOT (ImageLoaded IN ("*:\\Program Files (x86)\\*", "*:\\Program Files\\*", "*\\system32\\*", "*\\syswow64\\*")) | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_bitdefender_submission_wizard_dll_sideloading_filter`
+how_to_implement: Ingest Sysmon ImageLoad events and ensure the Splunk Add-on for Sysmon is configured to parse them. Enable ImageLoad in Sysmon config for DLLs. Map logs to Endpoint data model where applicable.
+known_false_positives: Legitimate Bitdefender installations loading log.dll from Program Files are excluded. Allowlist known paths as needed.
 references:
     - https://attack.mitre.org/techniques/T1574/002/
     - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
@@ -57,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$User$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$User$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Bitdefender Submission Wizard loaded $ImageLoaded$ from a non-standard path on $dest$ by user $User$, indicating potential DLL side-loading activity.
     entity:
diff --git a/detections/endpoint/windows_bitlocker_suspicious_command_usage.yml b/detections/endpoint/windows_bitlocker_suspicious_command_usage.yml
index af129503c16..78a3ee1e935 100644
--- a/detections/endpoint/windows_bitlocker_suspicious_command_usage.yml
+++ b/detections/endpoint/windows_bitlocker_suspicious_command_usage.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = manage-bde.exe
-        AND
-        Processes.process IN ("* -protectors -disable *","* -protectors -delete *","* -forcerecovery *","* -lock *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_bitlocker_suspicious_command_usage_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*manage-bde.exe" Processes.process IN ("* -protectors -disable *", "* -protectors -delete *", "* -forcerecovery *", "* -lock *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_bitlocker_suspicious_command_usage_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -42,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate processes on $dest$
       search: '| from datamodel Endpoint.Processes | search process_name = $process_name$ AND dest = "$dest$"'
       earliest_offset: $info_min_time$
diff --git a/detections/endpoint/windows_bitlockertogo_process_execution.yml b/detections/endpoint/windows_bitlockertogo_process_execution.yml
index 604d5c3b349..e1b4fcce1a2 100644
--- a/detections/endpoint/windows_bitlockertogo_process_execution.yml
+++ b/detections/endpoint/windows_bitlockertogo_process_execution.yml
@@ -10,20 +10,8 @@ description: The following analytic detects BitLockerToGo.exe execution, which h
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=bitlockertogo.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_bitlockertogo_process_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*bitlockertogo.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_bitlockertogo_process_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives are likely, as BitLockerToGo.exe is a legitimate Windows utility used for managing BitLocker encryption. However, monitor for usage of BitLockerToGo.exe in your environment, tune as needed. If BitLockerToGo.exe is not used in your environment, move to TTP.
 references:
diff --git a/detections/endpoint/windows_bitlockertogo_with_network_activity.yml b/detections/endpoint/windows_bitlockertogo_with_network_activity.yml
index e615fdcb19e..04396abb9bb 100644
--- a/detections/endpoint/windows_bitlockertogo_with_network_activity.yml
+++ b/detections/endpoint/windows_bitlockertogo_with_network_activity.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects suspicious usage of BitLockerToGo.exe, which has been observed being abused by Lumma stealer malware. The malware leverages this legitimate Windows utility to manipulate registry keys, search for cryptocurrency wallets and credentials, and exfiltrate sensitive data. This activity is significant because BitLockerToGo.exe provides functionality for viewing, copying, and writing files as well as modifying registry branches - capabilities that the Lumma stealer exploits for malicious purposes. If confirmed malicious, this could indicate an active data theft campaign targeting cryptocurrency wallets, browser credentials, and password manager archives. The detection focuses on identifying BitLockerToGo.exe execution patterns that deviate from normal system behavior.
 data_source:
     - Sysmon EventID 22
-search: |-
-    `sysmon` EventCode=22 process_name="bitlockertogo.exe"
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY answer answer_count dvc
-           process_exec process_guid process_name
-           query query_count reply_code_id
-           signature signature_id src
-           user_id vendor_product QueryName
-           QueryResults QueryStatus
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_bitlockertogo_with_network_activity_filter`
+search: |
+    `sysmon` EventCode=22 process_name="bitlockertogo.exe" | eval process_name=process_name, dvc=dvc, dest=Computer, QueryName=QueryName | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count query query_count reply_code_id src vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_bitlockertogo_with_network_activity_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: False positives are likely, as BitLockerToGo.exe is a legitimate Windows utility used for managing BitLocker encryption. However, the detection is designed to flag unusual execution patterns that deviate from standard usage. Filtering may be required to reduce false positives, once confirmed - move to TTP.
 references:
diff --git a/detections/endpoint/windows_bluetooth_service_installed_from_uncommon_location.yml b/detections/endpoint/windows_bluetooth_service_installed_from_uncommon_location.yml
index 031901e6a7b..24dacd662ab 100644
--- a/detections/endpoint/windows_bluetooth_service_installed_from_uncommon_location.yml
+++ b/detections/endpoint/windows_bluetooth_service_installed_from_uncommon_location.yml
@@ -6,44 +6,30 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |
-    Identifies the creation of a Windows service named "BluetoothService" with a binary path in user-writable directories, particularly %AppData%\Bluetooth.
+description: 'Identifies the creation of a Windows service named "BluetoothService" with a binary path in user-writable directories, particularly %AppData%\Bluetooth.
+
     This technique was observed in the Lotus Blossom Chrysalis backdoor campaign, where attackers created a service named "BluetoothService" pointing to a malicious binary (renamed Bitdefender Submission Wizard) in a hidden AppData directory.
+
     While legitimate Bluetooth services exist in Windows, they are system services with binaries in System32.
-    Any BluetoothService created with a binary path in user directories (AppData, Temp, Downloads) is highly suspicious and indicates potential malware persistence.
+
+    Any BluetoothService created with a binary path in user directories (AppData, Temp, Downloads) is highly suspicious and indicates potential malware persistence.'
 data_source:
     - Windows Event Log System 7045
 search: |
-    `wineventlog_system`
-    EventCode=7045
-    ServiceName IN (
-        "BluetoothService",
-        "Bluetooth Service"
-    )
-    ImagePath IN (
-        "*\\AppData\\*",
-        "*\\ProgramData\\*",
-        "*\\Temp\\*",
-        "*\\Users\\*\\Bluetooth\\*"
-    )
-    | stats count min(_time) as firstTime max(_time) as lastTime
-      by Computer ServiceName ImagePath ServiceType StartType UserID
-    | rename Computer as dest
-             UserID as user_id
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_bluetooth_service_installed_from_uncommon_location_filter`
-how_to_implement: |
-    To successfully implement this search, you need to be ingesting Windows System Event Logs (Event ID 7045) from your Windows endpoints. Event ID 7045 logs service installation events and includes the service name, binary path, service type, and start type.
+    `wineventlog_system` EventCode=7045 ServiceName IN ("BluetoothService", "Bluetooth Service") ImagePath IN ("*\\AppData\\*", "*\\ProgramData\\*", "*\\Temp\\*", "*\\Users\*\\Bluetooth\\*") | eval ServiceName=ServiceName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_bluetooth_service_installed_from_uncommon_location_filter`
+how_to_implement: 'To successfully implement this search, you need to be ingesting Windows System Event Logs (Event ID 7045) from your Windows endpoints. Event ID 7045 logs service installation events and includes the service name, binary path, service type, and start type.
+
+
+    Ensure Windows Event Log forwarding is configured to send System logs to Splunk, or use a Windows Event Log collection agent. The Splunk Add-on for Microsoft Windows is required to properly parse these events.'
+known_false_positives: 'Legitimate Bluetooth services in Windows are system services located in System32. Any BluetoothService created outside of system directories is highly suspicious. However, false positives may occur if:
 
-    Ensure Windows Event Log forwarding is configured to send System logs to Splunk, or use a Windows Event Log collection agent. The Splunk Add-on for Microsoft Windows is required to properly parse these events.
-known_false_positives: |
-    Legitimate Bluetooth services in Windows are system services located in System32. Any BluetoothService created outside of system directories is highly suspicious. However, false positives may occur if:
 
     1. Third-party Bluetooth software installs services in Program Files (excluded by this detection)
+
     2. Development or testing environments create test services
 
-    The detection specifically targets user-writable directories (AppData, Temp) which are strong indicators of malicious activity. Allowlist known-good third-party Bluetooth software installation paths if needed.
+
+    The detection specifically targets user-writable directories (AppData, Temp) which are strong indicators of malicious activity. Allowlist known-good third-party Bluetooth software installation paths if needed.'
 references:
     - https://attack.mitre.org/techniques/T1543/003/
     - https://attack.mitre.org/techniques/T1036/
@@ -56,7 +42,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -84,6 +70,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lotus_blossom_chrysalis/windows-system.log
-          sourcetype: XmlWinEventLog:System
           source: XmlWinEventLog:System
+          sourcetype: XmlWinEventLog:System
       test_type: unit
diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml
index 48b60501976..c5b3fd0fd9f 100644
--- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml
+++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of files in the Windows %startup% folder, a common persistence technique. It leverages the Endpoint.Filesystem data model to identify file creation events in this specific directory. This activity is significant because adversaries often use the startup folder to ensure their malicious code executes automatically upon system boot or user logon. If confirmed malicious, this could allow attackers to maintain persistence on the host, potentially leading to further system compromise and unauthorized access to sensitive information.
 data_source:
     - Sysmon EventID 11
-search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path = "*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_boot_or_logon_autostart_execution_in_startup_folder_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_boot_or_logon_autostart_execution_in_startup_folder_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 known_false_positives: Administrators may allow creation of script or exe in this path.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_bootloader_inventory.yml b/detections/endpoint/windows_bootloader_inventory.yml
index d355207497e..9cd364af32b 100644
--- a/detections/endpoint/windows_bootloader_inventory.yml
+++ b/detections/endpoint/windows_bootloader_inventory.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Hunting
 description: The following analytic identifies the bootloader paths on Windows endpoints. It leverages a PowerShell Scripted input to capture this data, which is then processed and aggregated using Splunk. Monitoring bootloader paths is significant for a SOC as it helps detect unauthorized modifications that could indicate bootkits or other persistent threats. If confirmed malicious, such activity could allow attackers to maintain persistence, bypass security controls, and potentially control the boot process, leading to full system compromise.
 data_source: []
-search: |-
+search: |
     `bootloader_inventory`
       | stats count min(_time) as firstTime max(_time) as lastTime values(_raw)
         BY host
diff --git a/detections/endpoint/windows_browser_process_launched_with_unusual_flags.yml b/detections/endpoint/windows_browser_process_launched_with_unusual_flags.yml
index d57c7b27116..7a1086842a8 100644
--- a/detections/endpoint/windows_browser_process_launched_with_unusual_flags.yml
+++ b/detections/endpoint/windows_browser_process_launched_with_unusual_flags.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of unusual browser flags, specifically --mute-audio and --do-not-elevate, which deviate from standard browser launch behavior. These flags may indicate automated scripts, testing environments, or attempts to modify browser functionality for silent operation or restricted privilege execution. Detection focuses on non-standard launch parameters, unexpected process behavior, or deviations from baseline configurations. Monitoring such flag usage helps identify potentially suspicious activity, misconfigurations, or policy violations, enabling security teams to investigate anomalies, ensure system compliance, and differentiate legitimate administrative or testing uses from unusual or unauthorized operations.
 data_source:
     - Sysmon EventID 1
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT (Processes.parent_process_name IN ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe", "explorer.exe")) AND NOT (Processes.parent_process_path IN("C:\\Program Files*", "C:\\Windows\\System32\\*", "C:\\Windows\\SysWow64\\*",)) AND Processes.process_name IN ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe") AND Processes.process IN ("*--mute-audio*","*--no-de-elevate*", "*--do-not-de-elevate*", "*--disable-audio*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_browser_process_launched_with_unusual_flags_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT (Processes.parent_process_name IN ("*chrome.exe", "*msedge.exe", "*brave.exe", "*firefox.exe", "*explorer.exe")) Processes.process_name IN ("*chrome.exe", "*msedge.exe", "*brave.exe", "*firefox.exe") Processes.process IN ("*--mute-audio*", "*--no-de-elevate*", "*--do-not-de-elevate*", "*--disable-audio*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_browser_process_launched_with_unusual_flags_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: It is possible false positives will be present based on third party applications. Filtering may be needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_builtin_account_name_was_changed.yml b/detections/endpoint/windows_builtin_account_name_was_changed.yml
index 5981a964fbc..273df68dc1e 100644
--- a/detections/endpoint/windows_builtin_account_name_was_changed.yml
+++ b/detections/endpoint/windows_builtin_account_name_was_changed.yml
@@ -6,33 +6,21 @@ modification_date: '2026-08-24'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects renaming of Windows built-in accounts via Event ID 4781.
+description: 'The following analytic detects renaming of Windows built-in accounts via Event ID 4781.
+
     It identifies renames targeting accounts with well-known reserved RIDs (500-504): Administrator, Guest, krbtgt, DefaultAccount, and WDAGUtilityAccount, by matching the TargetSid field against the S-1-5-21-*-50[0-4] pattern.
+
     Attackers commonly rename the built-in Administrator account to evade detections that alert on the literal account name, while retaining the full privileges of the RID-500 account.
-    Renaming Guest, krbtgt, or other reserved accounts is highly unusual in any legitimate environment.
+
+    Renaming Guest, krbtgt, or other reserved accounts is highly unusual in any legitimate environment.'
 data_source:
     - Windows Event Log Security 4781
-search: |-
-    `wineventlog_security`
-    EventCode=4781
-    TargetSid="S-1-5-21-*"
-
-    | where match(TargetSid, "S-1-5-21-.*-50[0-4]$")
-
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by dest OldTargetUserName NewTargetUserName
-         TargetSid SubjectLogonId
+search: |
+    `wineventlog_security` EventCode=4781 TargetSid="S-1-5-21-*" | eval OldTargetUserName=OldTargetUserName, NewTargetUserName=NewTargetUserName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_builtin_account_name_was_changed_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
+known_false_positives: 'Renaming built-in accounts is uncommon in most environments but may occur during initial system hardening or CIS benchmark compliance efforts.
 
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_builtin_account_name_was_changed_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
-known_false_positives: |-
-    Renaming built-in accounts is uncommon in most environments but may occur during initial system hardening or CIS benchmark compliance efforts.
-    Validate the source user, logon ID, and timing against expected change control windows before tuning.
+    Validate the source user, logon ID, and timing against expected change control windows before tuning.'
 references:
     - https://attack.mitre.org/techniques/T1078/003/
     - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4781
@@ -47,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Built-in account [$OldTargetUserName$] (SID [$TargetSid$]) was renamed to [$NewTargetUserName$] on [$dest$]
     entity:
diff --git a/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml b/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml
index 1b94a10a7c8..cb555410e65 100644
--- a/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml
+++ b/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where  Processes.process_name = pkgmgr.exe Processes.process = "*.xml*" NOT(Processes.parent_process_path IN("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "*:\\Program Files*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_bypass_uac_via_pkgmgr_tool_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*pkgmgr.exe" Processes.process="*.xml*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_bypass_uac_via_pkgmgr_tool_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present on recent Windows Operating Systems. Filtering may be required based on process_name. In addition, look for non-standard, unsigned, module loads into LSASS. If query is too noisy, modify by adding Endpoint.processes process_name to query to identify the process making the modification.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_cab_file_on_disk.yml b/detections/endpoint/windows_cab_file_on_disk.yml
index 878f72ce355..e25949d6615 100644
--- a/detections/endpoint/windows_cab_file_on_disk.yml
+++ b/detections/endpoint/windows_cab_file_on_disk.yml
@@ -6,61 +6,33 @@ modification_date: '2026-08-24'
 author: Michael Haag, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects .cab files being written to disk.
-    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on events where the file name is '*.cab' and the action is 'write'.
+description: 'The following analytic detects .cab files being written to disk.
+
+    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on events where the file name is ''*.cab'' and the action is ''write''.
+
     This activity can be significant as .cab files can be used to deliver malicious payloads, including embedded .url files that execute harmful code.
+
     If confirmed malicious, this behavior could lead to unauthorized code execution and potential system compromise.
-    Analysts should review the file path and associated artifacts for further investigation.
+
+    Analysts should review the file path and associated artifacts for further investigation.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count values(Filesystem.file_path) as file_path
-            min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Filesystem WHERE
-
-    Filesystem.action IN ("created", "modified")
-    Filesystem.file_name="*.cab"
-    NOT Filesystem.file_path IN (
-        "*\\AppData\\Local\\Microsoft\\*",
-        "*\\Windows Kits\\10\\ADK\\Installers\\*",
-        "C:\\Program Files (x86)\\*",
-        "C:\\Program Files\\*",
-        "C:\\ProgramData\\Microsoft\\*",
-        "C:\\ProgramData\\Package Cache\\*",
-        "C:\\Windows\\appcompat\\*",
-        "C:\\Windows\\Logs\\CBS\\*",
-        "C:\\Windows\\servicing\\*",
-        "C:\\Windows\\SoftwareDistribution\\*",
-        "C:\\Windows\\System32\\*",
-        "C:\\Windows\\SystemApps\\*",
-        "C:\\Windows\\SysWOW64\\*",
-        "C:\\Windows\\WinSxS\\*",
-    )
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.cab" NOT (Filesystem.file_path IN ("*\\AppData\\Local\\Microsoft\\*", "*\\Windows Kits\\10\\ADK\\Installers\\*", "*C:\\Program Files (x86)\\*", "*C:\\Program Files\\*", "*C:\\ProgramData\\Microsoft\\*", "*C:\\ProgramData\\Package Cache\\*", "*C:\\Windows\\appcompat\\*", "*C:\\Windows\\Logs\\CBS\\*", "*C:\\Windows\\servicing\\*", "*C:\\Windows\\SoftwareDistribution\\*", "*C:\\Windows\\System32\\*", "*C:\\Windows\\SystemApps\\*", "*C:\\Windows\\SysWOW64\\*", "*C:\\Windows\\WinSxS\\*")) by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cab_file_on_disk_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
 
-    BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-       Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-       Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-       Filesystem.user Filesystem.vendor_product
-
-    | `drop_dm_object_name("Filesystem")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_cab_file_on_disk_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
     These agents are designed to provide security-related telemetry from the endpoints where the agent is installed.
+
     To implement this search, you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions.
+
     These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product.
+
     The logs must also be mapped to the `Processes` node of the `Endpoint` data model.
-    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Some false positives are expected from user controlled folders.
+
+    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.'
+known_false_positives: Some false positives are expected from user controlled folders.
 references:
     - https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-25-IOCs-from-DarkGate-activity.txt
 drilldown_searches:
@@ -71,7 +43,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml b/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml
index d732490e0a7..8607e3fc354 100644
--- a/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml
+++ b/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml
@@ -6,35 +6,31 @@ modification_date: '2026-10-09'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    Detects usage of expand.exe to extract Microsoft Cabinet (CAB) archives, with
+description: 'Detects usage of expand.exe to extract Microsoft Cabinet (CAB) archives, with
+
     emphasis on extractions into `C:\\ProgramData` or similar staging locations. In
+
     recent APT37 activity, a CAB payload (e.g., wonder.cab) was expanded into
+
     ProgramData prior to persistence and execution. This behavior is a strong signal
-    for ingress tool transfer and staging of payloads.
+
+    for ingress tool transfer and staging of payloads.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
-    from datamodel=Endpoint.Processes
-    where Processes.process_name="expand.exe"
-      (Processes.process="*-F:*" OR Processes.process="*/F:*")
-      Processes.process="*\\ProgramData\\*"
-    by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_path Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_path Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_cabinet_file_extraction_via_expand_filter`
-how_to_implement: |
-    This analytic relies on process creation telemetry mapped to the Endpoint.Processes
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*expand.exe" Processes.process IN ("*-F:*", "*/F:*") Processes.process="*\\ProgramData\\*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cabinet_file_extraction_via_expand_filter`
+how_to_implement: 'This analytic relies on process creation telemetry mapped to the Endpoint.Processes
+
     datamodel (e.g., Sysmon EID 1 or EDR). Ensure full command-line logging is enabled
-    to capture expand.exe arguments, including `/F:*` or `-F:*` and destination paths.
-known_false_positives: |
-    Legitimate software deployment or administrators may use expand.exe for local
+
+    to capture expand.exe arguments, including `/F:*` or `-F:*` and destination paths.'
+known_false_positives: 'Legitimate software deployment or administrators may use expand.exe for local
+
     file extraction. Filter by approved deployment tools, signed parent processes,
-    and sanctioned paths.
+
+    and sanctioned paths.'
 references:
     - https://www.zscaler.com/blogs/security-research/apt37-targets-windows-rust-backdoor-and-python-loader
     - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml#L304
@@ -44,15 +40,9 @@ drilldown_searches:
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
-      search: |
-        | from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$","$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name"
-          values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories"
-          values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
-          by normalized_risk_object
-        | `security_content_ctime(firstTime)`
-        | `security_content_ctime(lastTime)`
+      search: "| from datamodel Risk.All_Risk | search normalized_risk_object IN (\"$user$\",\"$dest$\") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as \"Search Name\"\n  values(risk_message) as \"Risk Message\" values(analyticstories) as \"Analytic Stories\"\n  values(annotations._all) as \"Annotations\" values(annotations.mitre_attack.mitre_tactic) as \"ATT&CK Tactics\"\n  by normalized_risk_object\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n"
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: expand.exe extracted cabinet contents on $dest$ executed by $user$.
     entity:
diff --git a/detections/endpoint/windows_cached_domain_credentials_reg_query.yml b/detections/endpoint/windows_cached_domain_credentials_reg_query.yml
index 1169905e72e..51a3e32cd6a 100644
--- a/detections/endpoint/windows_cached_domain_credentials_reg_query.yml
+++ b/detections/endpoint/windows_cached_domain_credentials_reg_query.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where  `process_reg` AND Processes.process = "* query *" AND Processes.process = "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Processes.process = "*CACHEDLOGONSCOUNT*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cached_domain_credentials_reg_query_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*reg.exe" OR Processes.original_file_name="reg.exe" Processes.process="* query *" Processes.process="*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" Processes.process="*CACHEDLOGONSCOUNT*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cached_domain_credentials_reg_query_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_certutil_root_certificate_addition.yml b/detections/endpoint/windows_certutil_root_certificate_addition.yml
index 171ff53782f..3e645257fef 100644
--- a/detections/endpoint/windows_certutil_root_certificate_addition.yml
+++ b/detections/endpoint/windows_certutil_root_certificate_addition.yml
@@ -6,63 +6,45 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects the use of certutil.exe to add a certificate to the Root certificate store using the "-addstore" flag.
+description: 'The following analytic detects the use of certutil.exe to add a certificate to the Root certificate store using the "-addstore" flag.
+
     In this case, the certificate is loaded from a temporary file path (e.g., %TEMP%) or other uncommon locations (e.g. C:\\Users\\Public\\), which is highly suspicious and uncommon in legitimate administrative activity.
+
     This behavior may indicate an adversary is installing a malicious root certificate to intercept HTTPS traffic, impersonate trusted entities, or bypass security controls.
+
     The use of flags such as -f (force) and -Enterprise, combined with loading .tmp files from user-writable locations, is consistent with post-exploitation activity seen in credential theft and adversary-in-the-middle (AiTM) attacks.
+
     This should be investigated immediately, especially if correlated with unauthorized privilege use or prior certificate modifications.
+
     You should monitor when new certificates are added to the root store because this store is what your system uses to decide which websites, apps, and software can be trusted.
+
     If an attacker manages to add their own certificate there, they can silently intercept encrypted traffic, impersonate trusted websites, or make malicious programs look safe.
-    This means they could steal sensitive data, bypass security tools, and keep access to your system even after other malware is removed.
+
+    This means they could steal sensitive data, bypass security tools, and keep access to your system even after other malware is removed.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-      max(_time) as lastTime
-      values(Processes.process) as process
-    from datamodel=Endpoint.Processes where
-    `process_certutil`
-    Processes.process=*-addstore*
-    Processes.process=*root*
-    Processes.process IN (
-          "*:\\PerfLogs\\*",
-          "*:\\Windows\\Temp\\*",
-          "*\\AppData\\Local\\Temp\\*",
-          "*\\ProgramData\\*",
-          "*\\Users\\Public\\*",
-          "*%AppData%*",
-          "*%Public%*",
-          "*%Temp%*",
-          "*%tmp%*"
-          )
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    |`security_content_ctime(lastTime)`
-    | `windows_certutil_root_certificate_addition_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*certutil.exe" OR Processes.original_file_name="CertUtil.exe" Processes.process="*-addstore*" Processes.process="*root*" Processes.process IN ("*:\\PerfLogs\\*", "*:\\Windows\\Temp\\*", "*\\AppData\\Local\\Temp\\*", "*\\ProgramData\\*", "*\\Users\\Public\\*", "*%AppData%*", "*%Public%*", "*%Temp%*", "*%tmp%*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_certutil_root_certificate_addition_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed.
+
     To implement this search, you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions.
+
     These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product.
+
     The logs must also be mapped to the `Processes` node of the `Endpoint` data model.
-    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    Administrators or third party utilities may use leverage certutil in order to add a root certificate to the store. Filter as needed or restrict to critical assets on the perimeter.
+
+    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.'
+known_false_positives: Administrators or third party utilities may use leverage certutil in order to add a root certificate to the store. Filter as needed or restrict to critical assets on the perimeter.
 references:
     - https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/
     - https://www.deepinstinct.com/blog/iranian-threat-actor-continues-to-develop-mass-exploitation-tools
@@ -75,7 +57,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A potentially suspicious certificate was added to the Root certificate store via Certutil on $dest$.
     entity:
diff --git a/detections/endpoint/windows_change_file_association_command_to_notepad.yml b/detections/endpoint/windows_change_file_association_command_to_notepad.yml
index 4aba6dbb57f..a0ded93d58c 100644
--- a/detections/endpoint/windows_change_file_association_command_to_notepad.yml
+++ b/detections/endpoint/windows_change_file_association_command_to_notepad.yml
@@ -6,11 +6,13 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects attempts to change the command value of a file association of an extension to open with Notepad.exe.
+description: 'The following analytic detects attempts to change the command value of a file association of an extension to open with Notepad.exe.
+
     It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns and registry modifications.
+
     This activity is significant as it can indicate an attempt to manipulate file handling behavior, a technique observed in APT and ransomware attacks like Prestige.
-    After changing the extension of all encrypted files to a new one, Prestige ransomware modifies the file association for that extension to open with Notepad.exe in order to display a ransom note.
+
+    After changing the extension of all encrypted files to a new one, Prestige ransomware modifies the file association for that extension to open with Notepad.exe in order to display a ransom note.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
@@ -49,16 +51,23 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_change_file_association_command_to_notepad_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
+
+    names and speed up the data modeling process.'
 known_false_positives: No false positives have been identified at this time.
 references:
     - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
@@ -70,7 +79,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Process with commandline $process$ set the execution command of a file association to notepad.exe on $dest$
     entity:
diff --git a/detections/endpoint/windows_chrome_auto_update_disabled_via_registry.yml b/detections/endpoint/windows_chrome_auto_update_disabled_via_registry.yml
index 5ed7764e615..8186e638513 100644
--- a/detections/endpoint/windows_chrome_auto_update_disabled_via_registry.yml
+++ b/detections/endpoint/windows_chrome_auto_update_disabled_via_registry.yml
@@ -6,48 +6,25 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects modifications to Windows registry values that disable Google Chrome auto-updates.
+description: 'The following analytic detects modifications to Windows registry values that disable Google Chrome auto-updates.
+
     Changes to values such as DisableAutoUpdateChecksCheckboxValue = 1, Update{8A69D345-D564-463C-AFF1-A69D9E530F96} = 0, UpdateDefault = 0, and AutoUpdateCheckPeriodMinutes = 0 can prevent Chrome from receiving security updates.
+
     This behavior may indicate attempts to bypass update policies, maintain unauthorized extensions, or facilitate malware persistence.
-    Monitoring these registry changes helps identify potential policy violations or malicious activity targeting browser security.
+
+    Monitoring these registry changes helps identify potential policy violations or malicious activity targeting browser security.'
 data_source:
     - Sysmon EventID 13
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
-
-    where Registry.registry_path = "*\\Google\\Update*"
-          AND
-          (
-            Registry.registry_value_name = "DisableAutoUpdateChecksCheckboxValue"
-            Registry.registry_value_data = 0x00000001
-          )
-          OR
-          (
-            Registry.registry_value_name  IN (
-              "AutoUpdateCheckPeriodMinutes",
-              "Update{8A69D345-D564-463C-AFF1-A69D9E530F96}",
-              "UpdateDefault"
-            )
-            Registry.registry_value_data = 0x00000000
-          )
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Google\\Update*" Registry.registry_value_name="*DisableAutoUpdateChecksCheckboxValue" Registry.registry_value_data="0x00000001") OR (Registry.registry_value_name IN ("*AutoUpdateCheckPeriodMinutes", "*Update{8A69D345-D564-463C-AFF1-A69D9E530F96}", "*UpdateDefault") Registry.registry_value_data="0x00000000") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_chrome_auto_update_disabled_via_registry_filter`
+how_to_implement: 'To successfully implement this search, you need to be ingesting
 
-    by Registry.action Registry.dest Registry.process_guid Registry.process_id
-       Registry.registry_hive Registry.registry_path Registry.registry_key_name
-       Registry.registry_value_data Registry.registry_value_name
-       Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
-
-    | `drop_dm_object_name(Registry)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_chrome_auto_update_disabled_via_registry_filter`
-how_to_implement: |
-    To successfully implement this search, you need to be ingesting
     logs with the registry value name, registry path, and registry value data from your
+
     endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
-    Sysmon TA. https://splunkbase.splunk.com/app/5709
-known_false_positives: |
-    IT administrators intentionally disabling auto-updates in managed environments for testing, compatibility, or deployment purposes.
+
+    Sysmon TA. https://splunkbase.splunk.com/app/5709'
+known_false_positives: IT administrators intentionally disabling auto-updates in managed environments for testing, compatibility, or deployment purposes.
 references:
     - https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking
 drilldown_searches:
@@ -58,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_chrome_enable_extension_loading_via_command_line.yml b/detections/endpoint/windows_chrome_enable_extension_loading_via_command_line.yml
index 6dc8adf4b93..7a8d443da32 100644
--- a/detections/endpoint/windows_chrome_enable_extension_loading_via_command_line.yml
+++ b/detections/endpoint/windows_chrome_enable_extension_loading_via_command_line.yml
@@ -6,29 +6,17 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects instances where Google Chrome is started with the --disable-features=DisableLoadExtensionCommandLineSwitch flag, effectively enabling the loading of extensions via the command line.
+description: 'The following analytic detects instances where Google Chrome is started with the --disable-features=DisableLoadExtensionCommandLineSwitch flag, effectively enabling the loading of extensions via the command line.
+
     This may indicate attempts to bypass enterprise extension policies, load unauthorized or malicious extensions, or manipulate browser behavior.
-    Monitoring this activity helps identify potential security policy violations, malware persistence techniques, or other suspicious Chrome modifications.
+
+    Monitoring this activity helps identify potential security policy violations, malware persistence techniques, or other suspicious Chrome modifications.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime
-    from datamodel=Endpoint.Processes where
-      Processes.process_name = "Chrome.exe"
-      Processes.process= "*--disable-features*"
-      Processes.process= "*DisableLoadExtensionCommandLineSwitch*"
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_chrome_enable_extension_loading_via_command_line_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*Chrome.exe" Processes.process="*--disable-features*" Processes.process="*DisableLoadExtensionCommandLineSwitch*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_chrome_enable_extension_loading_via_command_line_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Developers or IT admins loading unpacked extensions for testing or deployment purposes.
 references:
@@ -41,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml b/detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml
index 46f22b200c6..310fc9e51ff 100644
--- a/detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml
+++ b/detections/endpoint/windows_chrome_extension_allowed_registry_modification.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects modifications to the Windows registry keys that control the Chrome Extension Install Allowlist. Unauthorized changes to these keys may indicate attempts to bypass Chrome extension restrictions or install unapproved extensions. This detection helps identify potential security policy violations or malicious activity targeting Chrome extension settings.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path = "*\\Google\\Chrome\\ExtensionInstallAllowlist*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_chrome_extension_allowed_registry_modification_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Google\\Chrome\\ExtensionInstallAllowlist*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_chrome_extension_allowed_registry_modification_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: Legitimate IT admin updates to Chrome extension allowlist via Group Policy or enterprise management tools. Filtering is needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_chromium_browser_launched_with_small_window_size.yml b/detections/endpoint/windows_chromium_browser_launched_with_small_window_size.yml
index 6a1cc0d27c1..2ea0600c294 100644
--- a/detections/endpoint/windows_chromium_browser_launched_with_small_window_size.yml
+++ b/detections/endpoint/windows_chromium_browser_launched_with_small_window_size.yml
@@ -41,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Chromium-based browser process was launched on $dest$ by user $user$ with an unusually small window size ($window_width$ x $window_height$ pixels). The process was spawned by $parent_process_name$ and included the following command-line parameters $process$.
     entity:
diff --git a/detections/endpoint/windows_chromium_browser_no_security_sandbox_process.yml b/detections/endpoint/windows_chromium_browser_no_security_sandbox_process.yml
index b7bb1200ce3..e0ec040981a 100644
--- a/detections/endpoint/windows_chromium_browser_no_security_sandbox_process.yml
+++ b/detections/endpoint/windows_chromium_browser_no_security_sandbox_process.yml
@@ -6,32 +6,22 @@ modification_date: '2026-06-25'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects instances where a Chrome or Chromium-based browser is launched with the --no-sandbox flag, a known indicator of potentially malicious or suspicious behavior. While this flag is occasionally used during software development or testing, it is rarely seen in normal user activity. Threat actors often abuse this setting to disable Chrome's built-in security sandbox, making it easier to execute malicious code or escape browser isolation. This behavior is commonly observed in malware droppers or loaders that embed Chromium components for command and control, credential theft, or UI spoofing. Analysts should investigate such events, especially if they originate from unusual parent processes (e.g., powershell.exe, cmd.exe, or unknown binaries), or if accompanied by other indicators such as file drops, process injection, or outbound network activity. Filtering by command-line arguments and process ancestry can help reduce false positives and surface high-fidelity detections.
+description: The following analytic detects instances where a Chrome or Chromium-based browser is launched with the --no-sandbox flag, a known indicator of potentially malicious or suspicious behavior. While this flag is occasionally used during software development or testing, it is rarely seen in normal user activity. Threat actors often abuse this setting to disable Chrome's built-in security sandbox, making it easier to execute malicious code or escape browser isolation. This behavior is commonly observed in malware droppers or loaders that embed Chromium components for command and control, credential theft, or UI spoofing. Analysts should investigate such events, especially if they originate from unusual parent processes (e.g., powershell.exe, cmd.exe, or unknown binaries), or if accompanied by other indicators such as file drops, process injection, or outbound network activity. Filtering by command-line arguments and process ancestry can help reduce false positives and surface high-fidelity detections.
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe")
-    Processes.process IN ("*--no-sandbox*", "*--allow-no-sandbox-job*")
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_chromium_browser_no_security_sandbox_process_filter`
-how_to_implement: |
-    To successfully implement this search you need to be ingesting information
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*Chrome.exe", "*Brave.exe", "*Opera.exe", "*Vivaldi.exe", "*msedge.exe") Processes.process IN ("*--no-sandbox*", "*--allow-no-sandbox-job*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_chromium_browser_no_security_sandbox_process_filter`
+how_to_implement: 'To successfully implement this search you need to be ingesting information
+
     on process that include the name of the process responsible for the changes from
+
     your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+
     confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-    endpoint product.
+
+    endpoint product.'
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
 references:
     - https://unix.stackexchange.com/questions/68832/what-does-the-chromium-option-no-sandbox-mean
@@ -43,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A chromium process with the --no-sandbox flag was launched on $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/windows_chromium_browser_with_custom_user_data_directory.yml b/detections/endpoint/windows_chromium_browser_with_custom_user_data_directory.yml
index 6438deca8fe..f1ba8c10512 100644
--- a/detections/endpoint/windows_chromium_browser_with_custom_user_data_directory.yml
+++ b/detections/endpoint/windows_chromium_browser_with_custom_user_data_directory.yml
@@ -6,33 +6,22 @@ modification_date: '2026-06-25'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects instances where the Chromium-based browser (e.g., Google Chrome, Microsoft Edge) is launched with the --user-data-dir command-line argument. While this flag is legitimate and used for multi-profile support or automation, it is frequently leveraged by malware and adversaries to run Chrome in an isolated environment for stealth operations, credential harvesting, phishing delivery, or evasion of user session artifacts.
+description: The following analytic detects instances where the Chromium-based browser (e.g., Google Chrome, Microsoft Edge) is launched with the --user-data-dir command-line argument. While this flag is legitimate and used for multi-profile support or automation, it is frequently leveraged by malware and adversaries to run Chrome in an isolated environment for stealth operations, credential harvesting, phishing delivery, or evasion of user session artifacts.
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe")
-    Processes.process = "*--user-data-dir*"
-    Processes.process IN ("*--disable-gpu*", "*--disable-3d-apis*")
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_chromium_browser_with_custom_user_data_directory_filter`
-how_to_implement: |
-    To successfully implement this search you need to be ingesting information
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*Chrome.exe", "*Brave.exe", "*Opera.exe", "*Vivaldi.exe", "*msedge.exe") Processes.process="*--user-data-dir*" Processes.process IN ("*--disable-gpu*", "*--disable-3d-apis*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_chromium_browser_with_custom_user_data_directory_filter`
+how_to_implement: 'To successfully implement this search you need to be ingesting information
+
     on process that include the name of the process responsible for the changes from
+
     your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+
     confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-    endpoint product.
+
+    endpoint product.'
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
 references:
     - https://chromium.googlesource.com/chromium/src/+/main/docs/user_data_dir.md
@@ -44,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_chromium_process_launched_with_disable_popup_blocking.yml b/detections/endpoint/windows_chromium_process_launched_with_disable_popup_blocking.yml
index a8399815241..ed885300d73 100644
--- a/detections/endpoint/windows_chromium_process_launched_with_disable_popup_blocking.yml
+++ b/detections/endpoint/windows_chromium_process_launched_with_disable_popup_blocking.yml
@@ -12,18 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes
-    where Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe")
-    Processes.process = "*--disable-popup-blocking*"
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`| `windows_chromium_process_launched_with_disable_popup_blocking_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*Chrome.exe", "*Brave.exe", "*Opera.exe", "*Vivaldi.exe", "*msedge.exe") Processes.process="*--disable-popup-blocking*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_chromium_process_launched_with_disable_popup_blocking_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Administrators may enable or disable this feature for framework testing that may cause some false positive.
 references:
@@ -37,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_chromium_process_launched_with_logging_disabled.yml b/detections/endpoint/windows_chromium_process_launched_with_logging_disabled.yml
index e21dc05defa..181df154181 100644
--- a/detections/endpoint/windows_chromium_process_launched_with_logging_disabled.yml
+++ b/detections/endpoint/windows_chromium_process_launched_with_logging_disabled.yml
@@ -6,30 +6,21 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects instances of Chromium-based browser processes on Windows launched with logging disabled via command-line arguments such as --disable-logging and --disable-logging-redirect.
+description: 'The following analytic detects instances of Chromium-based browser processes on Windows launched with logging disabled via command-line arguments such as --disable-logging and --disable-logging-redirect.
+
     The --disable-logging flag forces browser logging to be disabled, while --disable-logging-redirect disables log redirection and is commonly used for testing or debugging scenarios.
+
     Logging is enabled by default in Chromium debug builds, making these flags more likely to appear in debug or development environments.
+
     While these options may be legitimately used by automation frameworks, debugging workflows, or isolated testing environments, they are also leveraged by malware and malicious scripts to evade security monitoring.
-    Analysts should review the parent process, full command-line parameters, and execution context to determine whether the behavior is expected or potentially suspicious.
+
+    Analysts should review the parent process, full command-line parameters, and execution context to determine whether the behavior is expected or potentially suspicious.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes
-    where Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe")
-    Processes.process = "*--disable-logging*"
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_chromium_process_launched_with_logging_disabled_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*Chrome.exe", "*Brave.exe", "*Opera.exe", "*Vivaldi.exe", "*msedge.exe") Processes.process="*--disable-logging*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_chromium_process_launched_with_logging_disabled_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -43,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_chromium_process_loaded_extension_via_command_line.yml b/detections/endpoint/windows_chromium_process_loaded_extension_via_command_line.yml
index 3c095e061ef..fcfaf592109 100644
--- a/detections/endpoint/windows_chromium_process_loaded_extension_via_command_line.yml
+++ b/detections/endpoint/windows_chromium_process_loaded_extension_via_command_line.yml
@@ -6,32 +6,22 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects instances where Google Chrome is started with the --load-extension command-line flag, which allows loading unpacked or non-standard extensions. This behavior can indicate attempts to bypass enterprise extension policies, install malicious extensions, or load potentially harmful browser components. Monitoring such activity helps identify unauthorized extension usage, potential malware persistence mechanisms, or policy violations that could compromise browser security.
+description: The following analytic detects instances where Google Chrome is started with the --load-extension command-line flag, which allows loading unpacked or non-standard extensions. This behavior can indicate attempts to bypass enterprise extension policies, install malicious extensions, or load potentially harmful browser components. Monitoring such activity helps identify unauthorized extension usage, potential malware persistence mechanisms, or policy violations that could compromise browser security.
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where
-    Processes.process_name = "Chrome.exe"
-    Processes.process= "*--load-extension*"
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*Chrome.exe" Processes.process="*--load-extension*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_chromium_process_loaded_extension_via_command_line_filter`
+how_to_implement: 'To successfully implement this search you need to be ingesting information
 
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_chromium_process_loaded_extension_via_command_line_filter`
-how_to_implement: |
-    To successfully implement this search you need to be ingesting information
     on process that include the name of the process responsible for the changes from
+
     your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+
     confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-    endpoint product.
+
+    endpoint product.'
 known_false_positives: Developers or IT admins loading unpacked extensions for testing or deployment purposes.
 references:
     - https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking
@@ -44,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_chromium_process_with_disabled_extensions.yml b/detections/endpoint/windows_chromium_process_with_disabled_extensions.yml
index 02e22cb6600..c917e7bd9cc 100644
--- a/detections/endpoint/windows_chromium_process_with_disabled_extensions.yml
+++ b/detections/endpoint/windows_chromium_process_with_disabled_extensions.yml
@@ -12,19 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes
-    where Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe")
-    Processes.process = "*--disable-extensions*"
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_chromium_process_with_disabled_extensions_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*Chrome.exe", "*Brave.exe", "*Opera.exe", "*Vivaldi.exe", "*msedge.exe") Processes.process="*--disable-extensions*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_chromium_process_with_disabled_extensions_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Administrators may enable or disable this feature for framework testing that may cause some false positive.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_cisco_secure_endpoint_related_service_stopped.yml b/detections/endpoint/windows_cisco_secure_endpoint_related_service_stopped.yml
index c479018019e..0714c5a4d5c 100644
--- a/detections/endpoint/windows_cisco_secure_endpoint_related_service_stopped.yml
+++ b/detections/endpoint/windows_cisco_secure_endpoint_related_service_stopped.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the suspicious termination of known services commonly targeted by ransomware before file encryption. It leverages Windows System Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow Copy, backup, and antivirus services are stopped. This activity is significant because ransomware often disables these services to avoid errors and ensure successful file encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering files inaccessible and potentially causing significant operational disruption and data loss.
 data_source:
     - Windows Event Log System 7036
-search: |-
+search: |
     `wineventlog_system` `normalized_service_binary_field`
       | rename param1 as display_name
       | rename param2 as status
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_cisco_secure_endpoint_stop_immunet_service_via_sfc.yml b/detections/endpoint/windows_cisco_secure_endpoint_stop_immunet_service_via_sfc.yml
index af899db29fd..82a632bc43e 100644
--- a/detections/endpoint/windows_cisco_secure_endpoint_stop_immunet_service_via_sfc.yml
+++ b/detections/endpoint/windows_cisco_secure_endpoint_stop_immunet_service_via_sfc.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" Processes.process="* -k*" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cisco_secure_endpoint_stop_immunet_service_via_sfc_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sfc.exe" Processes.process="* -k*" NOT (Processes.process_path IN ("*\\system32\\*", "*\\syswow64\\*", "*:\\Windows\\WinSxS\\*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cisco_secure_endpoint_stop_immunet_service_via_sfc_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: It is possible that this action is executed during troubleshooting activity. Activity needs to be confirmed on a case by case basis.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_cisco_secure_endpoint_unblock_file_via_sfc.yml b/detections/endpoint/windows_cisco_secure_endpoint_unblock_file_via_sfc.yml
index 042aecf84db..4f67c307756 100644
--- a/detections/endpoint/windows_cisco_secure_endpoint_unblock_file_via_sfc.yml
+++ b/detections/endpoint/windows_cisco_secure_endpoint_unblock_file_via_sfc.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" Processes.process="* -unblock *" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cisco_secure_endpoint_unblock_file_via_sfc_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sfc.exe" Processes.process="* -unblock *" NOT (Processes.process_path IN ("*\\system32\\*", "*\\syswow64\\*", "*:\\Windows\\WinSxS\\*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cisco_secure_endpoint_unblock_file_via_sfc_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: It is possible that this action is executed during troubleshooting activity. Activity needs to be confirmed on a case by case basis.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc.yml b/detections/endpoint/windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc.yml
index 295027d6225..00dc83ade7b 100644
--- a/detections/endpoint/windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc.yml
+++ b/detections/endpoint/windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" Processes.process="* -u*" NOT Processes.process="* -unblock *" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sfc.exe" Processes.process="* -u*" NOT Processes.process="* -unblock *" NOT (Processes.process_path IN ("*\\system32\\*", "*\\syswow64\\*", "*:\\Windows\\WinSxS\\*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: It is possible that this action is executed during troubleshooting activity. Activity needs to be confirmed on a case by case basis.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml
index 46cd6303183..bae0e6a1a4a 100644
--- a/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml
+++ b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml
@@ -6,28 +6,17 @@ modification_date: '2026-06-29'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the execution of the PowerShell command 'Get-Clipboard' to retrieve clipboard data.
+description: 'The following analytic detects the execution of the PowerShell command ''Get-Clipboard'' to retrieve clipboard data.
+
     It leverages PowerShell Script Block Logging (EventCode 4104) to identify instances where this command is used.
+
     This activity is significant because it can indicate an attempt to steal sensitive information such as usernames, passwords, or other confidential data copied to the clipboard.
-    If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, potentially compromising user accounts and other critical assets.
+
+    If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, potentially compromising user accounts and other critical assets.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventCode=4104
-    ScriptBlockText = "*Get-Clipboard*"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by dest signature signature_id
-         user_id vendor_product EventID
-         Guid Opcode Name
-         Path ProcessID ScriptBlockId
-         ScriptBlockText
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_clipboard_data_via_get_clipboard_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-Clipboard*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_clipboard_data_via_get_clipboard_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: It is possible there will be false positives, filter as needed.
 references:
@@ -42,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml
index 8e6bd9a38d5..86f9ba98af0 100644
--- a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml
+++ b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml
@@ -6,43 +6,17 @@ modification_date: '2026-10-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects "cldapi.dll" being loaded by a process not associated with legitimate cloud sync activity.
-    The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits.
+description: 'The following analytic detects "cldapi.dll" being loaded by a process not associated with legitimate cloud sync activity.
+
+    The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits.'
 data_source:
     - Sysmon EventID 7
-search: |-
-    `sysmon`
-    EventID=7
-    ImageLoaded="*\\cldapi.dll"
-    NOT Image IN (
-        "*\\box.exe",
-        "*\\dropbox.exe",
-        "*\\googledrivefs.exe",
-        "*\\icloud.exe",
-        "*\\onedrive*.exe",
-        "C:\\Windows\\explorer.exe",
-        "C:\\Windows\\System32\\*",
-        "C:\\Windows\\Syswow64\\*",
-        "C:\\Windows\\WinSxS\\*"
-    )
-
-    | stats count min(_time) as firstTime
-                    max(_time) as lastTime
-
-      by dest loaded_file_path loaded_file
-         process_path process_name process_exec process_guid process_hash process_id
-         service_dll_signature_exists service_dll_signature_verified
-         signature signature_id user_id vendor_product
+search: |
+    `sysmon` EventCode=7 ImageLoaded="*\\cldapi.dll" NOT (Image IN ("\\box.exe", "\\dropbox.exe", "\\googledrivefs.exe", "\\icloud.exe", "\\onedrive*.exe", "C:\\Windows\\explorer.exe", "C:\\Windows\\System32\\", "C:\\Windows\\Syswow64\\", "C:\\Windows\\WinSxS\\")) | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cloud_files_filter_loaded_by_uncommon_process_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: 'False positives may include other third-party cloud-based file storage software.
 
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_cloud_files_filter_loaded_by_uncommon_process_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: |-
-    False positives may include other third-party cloud-based file storage software.
-    Filter as necessary for your environment.
+    Filter as necessary for your environment.'
 references:
     - https://www.huntress.com/blog/nightmare-eclipse-intrusion
     - https://www.threatlocker.com/blog/miniplasma-windows-privilege-escalation-zero-day-affects-fully-patched-systems
@@ -54,16 +28,14 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
           type: system
           score: 20
           message: Cloud Files Filter [$loaded_file_path$] loaded by suspicious process [$process_path$] on [$dest$]
-threat_objects:
-    - field: loaded_file_path
-      type: loaded_file
+threat_objects: []
 analytic_story:
     - RedSun
     - BlueHammer
diff --git a/detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml b/detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml
index fef62dc23f3..0f83738dabe 100644
--- a/detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml
+++ b/detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml
@@ -6,29 +6,17 @@ modification_date: '2026-05-01'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects a non-system process causing creation of CldFlt0.etl under C:\Windows\System32\LogFiles\CloudFiles\.
+description: 'Detects a non-system process causing creation of CldFlt0.etl under C:\Windows\System32\LogFiles\CloudFiles\.
+
     This path is initialised by the CldFlt driver when a process calls CfRegisterSyncRoot() or CfConnectSyncRoot().
+
     In the RedSun exploit this is a side-effect of the DoCloudStuff() function that registers a fake sync provider to create the cloud-tagged bait file.
-    Legitimate cloud providers (OneDrive etc.) register sync roots from SYSTEM-level service processes, not from user-context executables.
+
+    Legitimate cloud providers (OneDrive etc.) register sync roots from SYSTEM-level service processes, not from user-context executables.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    `sysmon`
-    EventCode=11
-    TargetFilename = "*\\Windows\\System32\\LogFiles\\CloudFiles\\*"
-    NOT Image IN (
-        "*:\\Windows\\System32*",
-        "*:\\Windows\\SysWOW64*",
-        "*:\\Program Files\\WindowsApps\\*"
-    )
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by action dest file_name file_path Image process_guid
-         process_id user_id vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_cloud_files_filter_log_created_by_non_system_process_filter`
+search: |
+    `sysmon` EventCode=11 TargetFilename="*\\system32\\*" NOT (Image IN ("*\\system32\\*", "*\\syswow64\\*", "*:\\Program Files\\WindowsApps\\*")) | eval process_name=process_name, root_drive=root_drive | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name file_path process_guid process_id user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cloud_files_filter_log_created_by_non_system_process_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -42,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Non-System process $Image$ created a cloud files filter $file_name$ on host $dest$
     entity:
diff --git a/detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml b/detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml
index bf909972d7a..3152fc4b306 100644
--- a/detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml
+++ b/detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml
@@ -6,14 +6,16 @@ modification_date: '2026-08-19'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic detects uncommon processes reading or requesting read access to sensitive files from cloud providers on Windows endpoints.
+description: 'This analytic detects uncommon processes reading or requesting read access to sensitive files from cloud providers on Windows endpoints.
+
     It monitors Windows Security Event 4663 for ReadData (AccessMask 0x1) operations against sensitive files from cloud providers such as Azure.
+
     Access by any process outside the known toolchain may indicate credential theft or cloud identity reconnaissance activity, including infostealer behavior such as one observed in Vidar Stealer variants.
-    This detection currently only supports Azure sensitive files, but will be extended to support other cloud providers in the future.
+
+    This detection currently only supports Azure sensitive files, but will be extended to support other cloud providers in the future.'
 data_source:
     - Windows Event Log Security 4663
-search: |-
+search: |
     `wineventlog_security`
     EventCode=4663
     ObjectType="File"
@@ -60,15 +62,18 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_cloud_sensitive_file_read_access_by_uncommon_process_filter`
-how_to_implement: |-
-    To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663.
+how_to_implement: 'To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663.
+
     To enable Event ID 4663, enable object access auditing through Group Policy: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access > Audit File System, then enable Success auditing. Enable Failure auditing if your environment also requires denied access attempts.
-    Event ID 4663 is only generated for files with a matching System Access Control List (SACL), so configure auditing on the relevant sensitive files from cloud providers.
-known_false_positives: |-
-    False positives are expected from legitimate tooling.
+
+    Event ID 4663 is only generated for files with a matching System Access Control List (SACL), so configure auditing on the relevant sensitive files from cloud providers.'
+known_false_positives: 'False positives are expected from legitimate tooling.
+
     The detection excludes the Azure CLI bundled Python interpreter, Windows PowerShell, PowerShell 7+, VS Code, and the Azure Developer CLI by process path.
+
     Residual false positives may arise from CI/CD agents (e.g., Azure DevOps self-hosted runners, GitHub Actions runners) that invoke az or Azure PowerShell from non-standard install paths not covered by the exclusion list, backup or DLP agents that scan user profile directories, and custom automation scripts that shell out to Azure CLI from an unexpected working directory.
-    Tune by adding confirmed-legitimate process paths and file paths to the companion filter macro windows_cloud_sensitive_file_read_access_by_uncommon_process_filter.
+
+    Tune by adding confirmed-legitimate process paths and file paths to the companion filter macro windows_cloud_sensitive_file_read_access_by_uncommon_process_filter.'
 references:
     - https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html
 drilldown_searches:
@@ -79,7 +84,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml
index 41dcceffd3e..aaf5053b494 100644
--- a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml
+++ b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("ipconfig.exe", "systeminfo.exe", "net1.exe", "arp.exe", "nslookup.exe", "route.exe", "netstat.exe", "hostname.exe", "whoami.exe") AND NOT Processes.parent_process_name IN ("cmd.exe", "powershell.exe", "powershell_ise.exe", "pwsh.exe", "explorer.exe", "-", "unknown") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cmdline_tool_execution_from_non_shell_process_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*ipconfig.exe", "*systeminfo.exe", "*net1.exe", "*arp.exe", "*nslookup.exe", "*route.exe", "*netstat.exe", "*hostname.exe", "*whoami.exe") NOT (Processes.parent_process_name IN ("*cmd.exe", "*powershell.exe", "*powershell_ise.exe", "*pwsh.exe", "*explorer.exe", "*-", "*unknown")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cmdline_tool_execution_from_non_shell_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: A network operator or systems administrator may utilize an automated host discovery application that may generate false positives. Filter as needed.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_cobalt_strike_powershell_loader.yml b/detections/endpoint/windows_cobalt_strike_powershell_loader.yml
index e9efd3504ad..bdc4993b666 100644
--- a/detections/endpoint/windows_cobalt_strike_powershell_loader.yml
+++ b/detections/endpoint/windows_cobalt_strike_powershell_loader.yml
@@ -6,29 +6,22 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects the PowerShell pattern used at the end of a Cobalt Strike PowerShell loader to perform the decompression of the executable.
+description: 'Detects the PowerShell pattern used at the end of a Cobalt Strike PowerShell loader to perform the decompression of the executable.
+
     This loader is used in attacks such as scripted web delivery.
+
     Cobalt Strike is a legitimate, commercial penetration testing tool that has been largely co-opted by ransomware gangs to launch attacks.
-    Cobalt Strike's popularity is mainly due to its beacons or payload being stealthy, and easily customizable.
-    Cobalt Strike Beacon provides encrypted communication with the C&C server to send information and receive commands.
+
+    Cobalt Strike''s popularity is mainly due to its beacons or payload being stealthy, and easily customizable.
+
+    Cobalt Strike Beacon provides encrypted communication with the C&C server to send information and receive commands.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventID="4104"
-    ScriptBlockText="*));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer EventID ScriptBlockText dest signature signature_id user_id vendor_product
-         Guid Opcode Name Path ProcessID ScriptBlockId
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_cobalt_strike_powershell_loader_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cobalt_strike_powershell_loader_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate penetration testing activities and authorized red team exercises may use this PowerShell loader pattern. Verify and whitelist approved security testing tools to reduce false alerts.
+references: []
 drilldown_searches:
     - earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
@@ -37,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Cobalt Strike PowerShell loader pattern observed on $dest$ via script block $ScriptBlockId$.
     entity:
diff --git a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml
index 740895047d4..11d6c456b67 100644
--- a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml
+++ b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_reg` Processes.process=*inprocserver32*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_com_hijacking_inprocserver32_modification_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*reg.exe" OR Processes.original_file_name="reg.exe" Processes.process="*inprocserver32*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_com_hijacking_inprocserver32_modification_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present and some filtering may be required.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to modify InProcServer32 within the registry.
     entity:
diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml
index a1605e8d2e6..2cbbfe4418b 100644
--- a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml
+++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml
@@ -6,58 +6,45 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Michael Haag, Splunk
 status: production
 type: Hunting
-description: |
-    The following analytic identifies path traversal command-line executions,
+description: 'The following analytic identifies path traversal command-line executions,
+
     leveraging data from Endpoint Detection and Response (EDR) agents. It detects patterns
+
     in command-line arguments indicative of path traversal techniques, such as multiple
+
     instances of "/..", "\..", or "\\..". This activity is significant as it often indicates
+
     attempts to evade defenses by executing malicious code, such as through msdt.exe.
+
     If confirmed malicious, this behavior could allow attackers to execute arbitrary
+
     code, potentially leading to system compromise, data exfiltration, or further lateral
-    movement within the network.
+
+    movement within the network.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime FROM datamodel=Endpoint.Processes where
-    Processes.process IN ("*\\..*", "*//..*", "*\..*", "*/..*")
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process
-       Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name Processes.process_path
-       Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | eval count_of_pattern1 = (mvcount(split(process,"/.."))-1)
-    | eval count_of_pattern2 = (mvcount(split(process,"\.."))-1)
-    | eval count_of_pattern3 = (mvcount(split(process,"\\.."))-1)
-    | eval count_of_pattern4 = (mvcount(split(process,"//.."))-1)
+    `sysmon` EventCode=1 CommandLine IN ("*\\..*", "*//..*", "*..*", "*/..*") count_of_pattern1>1 OR count_of_pattern2>1 OR count_of_pattern3>1 OR count_of_pattern4>1 | eval src_user=src_user | stats count min(_time) as firstTime max(_time) as lastTime by action dest original_file_name parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process process_exec process_guid process_hash process_id process_integrity_level process_name process_path user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_hunting_path_traversal_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-    | search count_of_pattern1 > 1
-             OR
-             count_of_pattern2 > 1
-             OR
-             count_of_pattern3 > 1
-             OR
-             count_of_pattern4 > 1
-    | `windows_command_and_scripting_interpreter_hunting_path_traversal_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    False positives may vary depending on the score you want to check.
+
+    names and speed up the data modeling process.'
+known_false_positives: False positives may vary depending on the score you want to check.
 references:
     - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
 analytic_story:
diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml
index ad45edc8d7d..ed003375ed0 100644
--- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml
+++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.os="Linux" Processes.process="*\/..\/..\/..\/*" OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*/../../../*", "*\\..\\..\\..\\*", "*//..//..//..//*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Not known at this moment.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_command_obfuscation_with_environment_variable_substrings.yml b/detections/endpoint/windows_command_obfuscation_with_environment_variable_substrings.yml
index 4c3ed9345d3..f6d9bfe89d4 100644
--- a/detections/endpoint/windows_command_obfuscation_with_environment_variable_substrings.yml
+++ b/detections/endpoint/windows_command_obfuscation_with_environment_variable_substrings.yml
@@ -6,39 +6,22 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects command obfuscation by using a technique to build a target command using character indexes from environment variables.
+description: 'Detects command obfuscation by using a technique to build a target command using character indexes from environment variables.
+
     This hides the true intent of the command by building it on the fly.
+
     In Windows command prompt, you can use the :~ format to extract substrings from environment variable values.
-    This behavior has been observed in various malware families, including Cobalt Strike and Meterpreter.
+
+    This behavior has been observed in various malware families, including Cobalt Strike and Meterpreter.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process="*%%*:~*,*"
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name
-       Processes.parent_process Processes.parent_process_path
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id
-       Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_command_obfuscation_with_environment_variable_substrings_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*%%*:~*,*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_obfuscation_with_environment_variable_substrings_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate scripts and system maintenance tools may use substring extraction from environment variables for dynamic command construction. Review and whitelist authorized scripts to reduce false positives.
+references: []
 drilldown_searches:
     - earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
@@ -47,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml
index f9e7d6f0afa..1b2a823ffff 100644
--- a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml
+++ b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml
@@ -9,19 +9,8 @@ type: TTP
 description: The following analytic detects the execution of a DCRat "forkbomb" payload, which spawns multiple cmd.exe processes that launch notepad.exe instances in quick succession. This detection leverages Endpoint Detection and Response (EDR) data, focusing on the rapid creation of cmd.exe and notepad.exe processes within a 30-second window. This activity is significant as it indicates a potential DCRat infection, a known Remote Access Trojan (RAT) with destructive capabilities. If confirmed malicious, this behavior could lead to system instability, resource exhaustion, and potential disruption of services.
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.user) as user values(Processes.action) as action values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product dc(Processes.parent_process_id) as parent_process_id_count dc(Processes.process_id) as process_id_count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name= "cmd.exe" (Processes.process_name = "notepad.exe"
-        OR
-        Processes.original_file_name= "notepad.exe") Processes.parent_process = "*.bat*"
-      BY Processes.parent_process_name Processes.process_name Processes.original_file_name
-         Processes.parent_process Processes.dest Processes.user
-         _time span=30s
-    | where parent_process_id_count>= 10 AND process_id_count >=10
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_command_shell_dcrat_forkbomb_payload_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*cmd.exe" Processes.process_name="*notepad.exe" OR Processes.original_file_name="notepad.exe" Processes.parent_process="*.bat*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_shell_dcrat_forkbomb_payload_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -36,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Multiple cmd.exe processes with child process of notepad.exe executed on $dest$
     entity:
diff --git a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml
index 0e413b27477..bdd69f63fc3 100644
--- a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml
+++ b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml
@@ -8,7 +8,7 @@ status: production
 type: Correlation
 description: The following analytic identifies instances where four or more distinct detection analytics are associated with malicious command line behavior on a specific host. This detection leverages the Command Line Interface (CLI) data from various sources to identify suspicious activities. This behavior is significant as it often indicates attempts to execute malicious commands, access sensitive data, install backdoors, or perform other nefarious actions. If confirmed malicious, attackers could gain unauthorized control, exfiltrate information, escalate privileges, or launch further attacks within the network, leading to severe compromise.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
       WHERE source IN ("*Windows Cmdline Tool Execution From Non-Shell Process*", "*Windows System Network Config Discovery Display DNS*", "*Local Account Discovery With Wmic*", "*Windows Group Discovery Via Net*", "*Windows Create Local Administrator Account Via Net*", "*Windows User Discovery Via Net*", "*Icacls Deny Command*", "*ICACLS Grant Command*", "*Windows Proxy Via Netsh*", "*Processes launching netsh*", "*Disabling Firewall with Netsh*", "*Windows System Network Connections Discovery Netsh*", "*Network Connection Discovery With Arp*", "*Windows System Discovery Using ldap Nslookup*", "*Windows System Shutdown CommandLine*")
       BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$risk_object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Common Abused Cmd Shell Risk Behavior - $risk_object$
     entity:
diff --git a/detections/endpoint/windows_compatibility_telemetry_suspicious_child_process.yml b/detections/endpoint/windows_compatibility_telemetry_suspicious_child_process.yml
index 429601e139d..98a8f22586a 100644
--- a/detections/endpoint/windows_compatibility_telemetry_suspicious_child_process.yml
+++ b/detections/endpoint/windows_compatibility_telemetry_suspicious_child_process.yml
@@ -11,22 +11,8 @@ data_source:
     - Windows Event Log Security 4688
     - Sysmon EventID 1
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name = "CompatTelRunner.exe"
-        AND
-        Processes.process="* -cv:*" NOT Processes.process IN ("* -m:*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_compatibility_telemetry_suspicious_child_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*CompatTelRunner.exe" Processes.process="* -cv:*" NOT Processes.process="* -m:*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_compatibility_telemetry_suspicious_child_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -41,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate processes on $dest$
       search: '| from datamodel Endpoint.Processes | search dest = "$dest$" AND process_name = "$process_name$"'
       earliest_offset: $info_min_time$
diff --git a/detections/endpoint/windows_compatibility_telemetry_tampering_through_registry.yml b/detections/endpoint/windows_compatibility_telemetry_tampering_through_registry.yml
index cad6ffc1c09..1c811dd5a0b 100644
--- a/detections/endpoint/windows_compatibility_telemetry_tampering_through_registry.yml
+++ b/detections/endpoint/windows_compatibility_telemetry_tampering_through_registry.yml
@@ -9,23 +9,8 @@ type: TTP
 description: This detection identifies suspicious modifications to the Windows Compatibility Telemetry registry settings, specifically within the "TelemetryController" registry key and "Command" registry value. It leverages data from the Endpoint.Registry data model, focusing on registry paths and values indicative of such changes. This activity is significant because CompatTelRunner.exe and the "Microsoft Compatibility Appraiser" task always run as System and can be used to elevate privileges or establish a highly privileged persistence mechanism. If confirmed malicious, this could enable unauthorized code execution, privilege escalation, or persistent access to the compromised system.
 data_source:
     - Sysmon EventID 13
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as firstTime, max(_time) as lastTime, count FROM datamodel=Endpoint.Registry
-      WHERE (
-            Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController*"
-            AND
-            Registry.registry_value_name="Command" NOT Registry.registry_value_data IN ("(empty)")
-        )
-      BY Registry.action Registry.dest Registry.process_guid
-         Registry.process_id Registry.registry_hive Registry.registry_path
-         Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
-         Registry.registry_value_type Registry.status Registry.user
-         Registry.vendor_product
-    | `drop_dm_object_name(Registry)`
-    | eval process = registry_value_data
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_compatibility_telemetry_tampering_through_registry_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController*" Registry.registry_value_name="*Command" NOT Registry.registry_value_data="(empty)" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_compatibility_telemetry_tampering_through_registry_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -40,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$","$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate registry changes on $dest$
       search: '| from datamodel Endpoint.Registry | search registry_path = "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController*" AND dest = "$dest$"'
       earliest_offset: $info_min_time$
diff --git a/detections/endpoint/windows_computer_account_changed_to_domain_controller.yml b/detections/endpoint/windows_computer_account_changed_to_domain_controller.yml
index 6a9633f10d6..d196f7d7786 100644
--- a/detections/endpoint/windows_computer_account_changed_to_domain_controller.yml
+++ b/detections/endpoint/windows_computer_account_changed_to_domain_controller.yml
@@ -6,25 +6,15 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects a modification to the User Account Control flags for a computer account where the `SERVER_TRUST_ACCOUNT` flag is set.
+description: 'Detects a modification to the User Account Control flags for a computer account where the `SERVER_TRUST_ACCOUNT` flag is set.
+
     This flag is normally associated with domain controller computer accounts.
-    This activity may indicate a legitimate domain controller promotion or, if unexpected, an attempt to grant a computer account domain controller-like trust within Active Directory.
+
+    This activity may indicate a legitimate domain controller promotion or, if unexpected, an attempt to grant a computer account domain controller-like trust within Active Directory.'
 data_source:
     - Windows Event Log Security 4742
-search: |-
-    `wineventlog_security`
-    EventID=4742
-    UserAccountControl="*%%2088*"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer TargetUserName UserAccountControl EventID
-
-    | rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_computer_account_changed_to_domain_controller_filter`
+search: |
+    `wineventlog_security` EventID="4742" UserAccountControl="*%%2088*" | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_computer_account_changed_to_domain_controller_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate administrative activities during domain controller promotions or system updates may trigger this rule. Filter alerts originating from authorized IT personnel or approved change management processes.
 references:
@@ -38,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Computer account User Account Control flags changed to domain controller $UserAccountControl$ on $dest$.
     entity:
diff --git a/detections/endpoint/windows_computer_account_created_by_computer_account.yml b/detections/endpoint/windows_computer_account_created_by_computer_account.yml
index 8cded259deb..b1219ffddb1 100644
--- a/detections/endpoint/windows_computer_account_created_by_computer_account.yml
+++ b/detections/endpoint/windows_computer_account_created_by_computer_account.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic identifies a computer account creating a new computer account with a specific Service Principal Name (SPN) "RestrictedKrbHost". This detection leverages Windows Security Event Logs, specifically EventCode 4741, to identify such activities. This behavior is significant as it may indicate an attempt to establish unauthorized Kerberos authentication channels, potentially leading to lateral movement or privilege escalation. If confirmed malicious, this activity could allow an attacker to impersonate services, access sensitive information, or maintain persistence within the network.
 data_source:
     - Windows Event Log Security 4741
-search: |-
-    `wineventlog_security` EventCode=4741 user_type=computer SubjectDomainName!="NT AUTHORITY" ServicePrincipalNames=*RestrictedKrbHost*
-      | stats  count min(_time) as firstTime max(_time) as lastTime
-        BY dest, subject, action
-           ,src_user, user, user_type,
-           SubjectUserName,SubjectDomainName
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_computer_account_created_by_computer_account_filter`
+search: |
+    `wineventlog_security` EventCode=4741 user_type="computer" NOT SubjectDomainName="NT AUTHORITY" ServicePrincipalNames="*RestrictedKrbHost*" | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_computer_account_created_by_computer_account_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4741 EventCode enabled. The Windows TA is also required.
 known_false_positives: It is possible third party applications may have a computer account that adds computer accounts, filtering may be required.
 references:
@@ -31,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Computer Account on $dest$ created by a computer account (possibly indicative of Kerberos relay attack).
     entity:
diff --git a/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml b/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml
index ad73e21f276..d9e116f9e3b 100644
--- a/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml
+++ b/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml
@@ -9,14 +9,8 @@ type: TTP
 description: The following analytic detects a computer account requesting a Kerberos ticket, which is unusual as typically user accounts request these tickets. This detection leverages Windows Security Event Logs, specifically EventCode 4768, to identify instances where the TargetUserName ends with a dollar sign ($), indicating a computer account. This activity is significant because it may indicate the use of tools like KrbUpRelay or other Kerberos-based attacks. If confirmed malicious, this could allow attackers to impersonate computer accounts, potentially leading to unauthorized access and lateral movement within the network.
 data_source:
     - Windows Event Log Security 4768
-search: |-
-    `wineventlog_security`  EventCode=4768 TargetUserName="*$"  src_ip!="::1"
-      | stats  count min(_time) as firstTime max(_time) as lastTime
-        BY dest, subject, action,
-           user, TargetUserName, src_ip
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_computer_account_requesting_kerberos_ticket_filter`
+search: |
+    `wineventlog_security` EventCode=4768 TargetUserName="*$" NOT src_ip="::1" | eval src_ip=src_ip | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_computer_account_requesting_kerberos_ticket_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4768 EventCode enabled. The Windows TA is also required.
 known_false_positives: It is possible false positives will be present based on third party applications. Filtering may be needed.
 references:
@@ -29,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Computer Account requested a Kerberos ticket on $dest$, possibly indicative of Kerberos relay attack.
     entity:
diff --git a/detections/endpoint/windows_computer_account_with_spn.yml b/detections/endpoint/windows_computer_account_with_spn.yml
index b1a587d9720..66c72f5c56c 100644
--- a/detections/endpoint/windows_computer_account_with_spn.yml
+++ b/detections/endpoint/windows_computer_account_with_spn.yml
@@ -9,13 +9,8 @@ type: TTP
 description: The following analytic detects the addition of Service Principal Names (SPNs) HOST and RestrictedKrbHost to a computer account, indicative of KrbRelayUp behavior. This detection leverages Windows Security Event Logs, specifically EventCode 4741, to identify changes in SPNs. This activity is significant as it is commonly associated with Kerberos-based attacks, which can be used to escalate privileges or perform lateral movement within a network. If confirmed malicious, this behavior could allow an attacker to impersonate services, potentially leading to unauthorized access to sensitive resources.
 data_source:
     - Windows Event Log Security 4741
-search: |-
-    `wineventlog_security` EventCode=4741 NewUacValue="0x80" ServicePrincipalNames IN ("*HOST/*","*RestrictedKrbHost/*")
-      | stats count min(_time) as firstTime max(_time) as lastTime values(EventCode),values(TargetDomainName),values(PrimaryGroupId), values(OldUacValue), values(NewUacValue),values(SamAccountName),values(DnsHostName),values(ServicePrincipalNames)
-        BY dest Logon_ID subject
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_computer_account_with_spn_filter`
+search: |
+    `wineventlog_security` EventCode=4741 NewUacValue="0x80" ServicePrincipalNames IN ("*HOST/*", "*RestrictedKrbHost/*") | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_computer_account_with_spn_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4741 EventCode enabled. The Windows TA is also required.
 known_false_positives: It is possible third party applications may add these SPNs to Computer Accounts, filtering may be needed.
 references:
@@ -29,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Computer Account was created with SPNs related to Kerberos on $dest$, possibly indicative of Kerberos relay attack.
     entity:
diff --git a/detections/endpoint/windows_computerdefaults_spawning_a_process.yml b/detections/endpoint/windows_computerdefaults_spawning_a_process.yml
index e6472e0276b..e263933a951 100644
--- a/detections/endpoint/windows_computerdefaults_spawning_a_process.yml
+++ b/detections/endpoint/windows_computerdefaults_spawning_a_process.yml
@@ -9,20 +9,8 @@ type: TTP
 description: The following analytic detects the spawning of ComputerDefaults.exe, a Windows system process used to manage default application associations. While normally legitimate, this process can be exploited by attackers to bypass User Account Control (UAC) and execute unauthorized code with elevated privileges. Detection focuses on abnormal execution patterns, unusual parent-child process relationships, or deviations from standard paths. Such behavior may indicate attempts to modify system defaults or run malicious scripts undetected. Monitoring ComputerDefaults.exe is critical to identify potential security threats, prevent privilege escalation, and maintain system integrity by distinguishing normal operations from suspicious activity.
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=ComputerDefaults.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_computerdefaults_spawning_a_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*ComputerDefaults.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_computerdefaults_spawning_a_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -35,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A ComputerDefaults.exe process $parent_process_name$ spawning child process $process_name$ on host $dest$
     entity:
diff --git a/detections/endpoint/windows_conhost_with_headless_argument.yml b/detections/endpoint/windows_conhost_with_headless_argument.yml
index d5cabd065eb..2fc6f338ed2 100644
--- a/detections/endpoint/windows_conhost_with_headless_argument.yml
+++ b/detections/endpoint/windows_conhost_with_headless_argument.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=conhost.exe Processes.process="*--headless *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_conhost_with_headless_argument_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*conhost.exe" Processes.process="*--headless *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_conhost_with_headless_argument_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present if the application is legitimately used, filter by user or endpoint as needed.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows ConHost with Headless Argument detected on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/windows_consolehost_history_file_deletion.yml b/detections/endpoint/windows_consolehost_history_file_deletion.yml
index da1cc7f31a2..463b0c1439b 100644
--- a/detections/endpoint/windows_consolehost_history_file_deletion.yml
+++ b/detections/endpoint/windows_consolehost_history_file_deletion.yml
@@ -10,7 +10,8 @@ description: The following analytic detects the deletion of the ConsoleHost_hist
 data_source:
     - Sysmon EventID 23
     - Sysmon EventID 26
-search: '`sysmon` EventCode IN ("23","26") TargetFilename = "*\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt" | stats count min(_time) as firstTime, max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_name process_exec process_id process_path user_id vendor_product process_guid signature signature_id user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_consolehost_history_file_deletion_filter`'
+search: |
+    `sysmon` EventCode=23 EventCode="26" TargetFilename="*\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt" | stats count min(_time) as firstTime max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_consolehost_history_file_deletion_filter`
 how_to_implement: To successfully implement this search, you need to ingest logs that include the deleted target file name, process name, and process ID from your endpoints. If you are using Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed.
 known_false_positives: An administrator may delete the ConsoleHost history file on a specific machine, potentially triggering this detection. However, this action is uncommon for regular users who are not accustomed to using the PowerShell command line
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_id$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_content_copied_from_browser_was_executed.yml b/detections/endpoint/windows_content_copied_from_browser_was_executed.yml
index ad9d1785906..fd241e66ea0 100644
--- a/detections/endpoint/windows_content_copied_from_browser_was_executed.yml
+++ b/detections/endpoint/windows_content_copied_from_browser_was_executed.yml
@@ -6,13 +6,14 @@ modification_date: '2026-09-07'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic correlates modifications to the Windows RunMRU registry key with clipboard content
+description: 'The following analytic correlates modifications to the Windows RunMRU registry key with clipboard content
+
     changes initiated by browsers. It aims to detect ClickFix scenarios in which commands copied
-    from a browser are subsequently executed on the Windows system through the Run dialog box.
+
+    from a browser are subsequently executed on the Windows system through the Run dialog box.'
 data_source:
     - Sysmon EventID 13 AND Sysmon EventID 24
-search: |-
+search: |
     `sysmon`
     EventID IN (13, 24)
     (
@@ -46,11 +47,13 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_content_copied_from_browser_was_executed_filter`
-how_to_implement: |-
-    This detection requires Sysmon event logs. Configure your environment to ingest Sysmon registry modification (Event ID 13)
+how_to_implement: 'This detection requires Sysmon event logs. Configure your environment to ingest Sysmon registry modification (Event ID 13)
+
     and clipboard change (Event ID 24) events. Ensure that registry modification events are collected for the RunMRU registry key
+
     and clipboard change events are collected from common browser processes. Ingest the data through the appropriate Splunk technology
-    add-on and normalize field names using the Splunk Common Information Model (CIM).
+
+    add-on and normalize field names using the Splunk Common Information Model (CIM).'
 known_false_positives: No false positives have been identified at this time.
 references:
     - https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/
@@ -63,7 +66,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The content [$process$] was copied from [$process_name$] to the clipboard and was executed through the Run dialog box on [$dest$]
     entity:
diff --git a/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml b/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml
index 8eb5a955e07..c4e288e625a 100644
--- a/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml
+++ b/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml
@@ -6,29 +6,21 @@ modification_date: '2026-10-09'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    This analytic detects the execution of the ConvertTo-AADIntBackdoor command via PowerShell Script Block Logging.
+description: 'This analytic detects the execution of the ConvertTo-AADIntBackdoor command via PowerShell Script Block Logging.
+
     The ConvertTo-AADIntBackdoor command is part of the AADInternals toolkit, which is used primarily for security testing and administrative tasks in Azure Active Directory (Azure AD) environments.
+
     This particular command is designed to create a "backdoor" in a federated Azure AD domain.
+
     When executed, ConvertTo-AADIntBackdoor modifies the federation settings of a domain by adding or changing the federation configuration to allow an attacker to control the authentication process.
+
     This manipulation enables the creation of security tokens that can impersonate any user within the Azure AD tenant.
-    Consequently, this allows an attacker to bypass Multi-Factor Authentication (MFA), escalate privileges, and maintain persistent access to the Azure AD environment.
+
+    Consequently, this allows an attacker to bypass Multi-Factor Authentication (MFA), escalate privileges, and maintain persistent access to the Azure AD environment.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventID="4104"
-    ScriptBlockText="*ConvertTo-AADIntBackdoor*"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer EventID ScriptBlockText signature signature_id user_id vendor_product Guid
-         Opcode Name Path ProcessID ScriptBlockId
-
-    | rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_convertto_aadintbackdoor_execution_via_powershell_script_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*ConvertTo-AADIntBackdoor*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_convertto_aadintbackdoor_execution_via_powershell_script_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Certain administrative or security testing activities in Azure AD environments may use ConvertTo-AADIntBackdoor for legitimate federation configuration changes. Review and allow such actions from trusted administrators and approved tools.
 references:
@@ -42,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: ConvertTo-AADIntBackdoor Cmdlet execution via PowerShell script observed on $dest$
     entity:
diff --git a/detections/endpoint/windows_create_local_account.yml b/detections/endpoint/windows_create_local_account.yml
index e19c0130d9c..75a772be8c7 100644
--- a/detections/endpoint/windows_create_local_account.yml
+++ b/detections/endpoint/windows_create_local_account.yml
@@ -10,23 +10,15 @@ description: The following analytic detects the creation of a new local user acc
 data_source:
     - Windows Event Log Security 4720
 search: |
-    | tstats `security_content_summariesonly`
-      values(All_Changes.result_id) as result_id
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    from datamodel=Change where
-    All_Changes.result_id=4720
-    by All_Changes.user All_Changes.dest All_Changes.result All_Changes.action
-    | `drop_dm_object_name("All_Changes")`
-    | `security_content_ctime(lastTime)`
-    | `security_content_ctime(firstTime)`
-    | `windows_create_local_account_filter`
+    `wineventlog_security` EventCode=4720 All_Changes.result_id="4720" | eval user=user | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_create_local_account_filter`
 how_to_implement: 'This search requires you to have enabled your Group Management Audit Logs in your Local Windows Security Policy and be ingesting those logs.  More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/'
-known_false_positives: |
-    It is possible that an administrator created the account. Verifying activity with an administrator is advised.
+known_false_positives: 'It is possible that an administrator created the account. Verifying activity with an administrator is advised.
+
     Accounts created on Domain Controllers will trigger this too. Exclude if it becomes too noisy.
+
     This analytic is set to anomaly to allow for risk to be added. Filter and tune as needed.
-    Restrict to critical infrastructure to reduce any volume.
+
+    Restrict to critical infrastructure to reduce any volume.'
 references:
     - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
     - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L68
@@ -39,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_create_local_administrator_account_via_net.yml b/detections/endpoint/windows_create_local_administrator_account_via_net.yml
index 65e79e9e660..bff25340daf 100644
--- a/detections/endpoint/windows_create_local_administrator_account_via_net.yml
+++ b/detections/endpoint/windows_create_local_administrator_account_via_net.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_net`
-        AND
-        Processes.process=*/add*
-        AND
-        Processes.process IN ("*administrators*", "*administratoren*", "*administrateurs*", "*administrador*", "*amministratori*", "*administratorer*", "*Rendszergazda*", "*Администратор*", "*Administratör*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_create_local_administrator_account_via_net_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*net1.exe" OR Processes.original_file_name="net1.exe" Processes.process="*/add*" Processes.process IN ("*administrators*", "*administratoren*", "*administrateurs*", "*administrador*", "*amministratori*", "*administratorer*", "*Rendszergazda*", "*Администратор*", "*Administratör*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_create_local_administrator_account_via_net_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators often leverage net.exe to create admin accounts.
 references:
@@ -41,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_credential_access_from_browser_password_store.yml b/detections/endpoint/windows_credential_access_from_browser_password_store.yml
index 694b94d3938..f54aec5437b 100644
--- a/detections/endpoint/windows_credential_access_from_browser_password_store.yml
+++ b/detections/endpoint/windows_credential_access_from_browser_password_store.yml
@@ -6,14 +6,16 @@ modification_date: '2026-09-22'
 author: Teoderick Contreras, Bhavin Patel Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies a possible non-common browser process accessing its browser user data profile.
+description: 'The following analytic identifies a possible non-common browser process accessing its browser user data profile.
+
     This tactic/technique has been observed in various Trojan Stealers, such as SnakeKeylogger, which attempt to gather sensitive browser information and credentials as part of their exfiltration strategy.
+
     Detecting this anomaly can serve as a valuable pivot for identifying processes that access lists of browser user data profiles unexpectedly.
-    This detection uses a lookup file `browser_app_list` that maintains a list of well known browser applications and the browser paths that are allowed to access the browser user data profiles.
+
+    This detection uses a lookup file `browser_app_list` that maintains a list of well known browser applications and the browser paths that are allowed to access the browser user data profiles.'
 data_source:
     - Windows Event Log Security 4663
-search: |-
+search: |
     `wineventlog_security`
     EventCode=4663
 
@@ -50,7 +52,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml
index 7003854e614..59e706800b6 100644
--- a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml
+++ b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=createdump.exe
-        OR
-        Processes.original_file_name="FX_VER_INTERNALNAME_STR" Processes.process="*-u *"
-        AND
-        Processes.process="*-f *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_credential_dumping_lsass_memory_createdump_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.original_file_name="FX_VER_INTERNALNAME_STR" Processes.process="*-u *" Processes.process="*-f *") OR Processes.process_name="*createdump.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credential_dumping_lsass_memory_createdump_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present if an application is dumping processes, filter as needed. Recommend reviewing createdump.exe usage across the fleet to better understand all usage and by what.
 references:
@@ -42,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to dump a process.
     entity:
diff --git a/detections/endpoint/windows_credential_target_information_structure_in_commandline.yml b/detections/endpoint/windows_credential_target_information_structure_in_commandline.yml
index 60f09c438d5..1d6c48e749a 100644
--- a/detections/endpoint/windows_credential_target_information_structure_in_commandline.yml
+++ b/detections/endpoint/windows_credential_target_information_structure_in_commandline.yml
@@ -9,20 +9,8 @@ type: TTP
 description: Detects DNS-based Kerberos coercion attacks where adversaries inject marshaled credential structures into DNS records to spoof SPNs and redirect authentication such as in CVE-2025-33073. This detection leverages process creation events looking for specific CREDENTIAL_TARGET_INFORMATION structures.
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*1UWhRCA*" Processes.process="*AAAAA*" Processes.process="*YBAAAA*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_credential_target_information_structure_in_commandline_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*1UWhRCA*" Processes.process="*AAAAA*" Processes.process="*YBAAAA*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credential_target_information_structure_in_commandline_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Commands with all of these base64 encoded values are unusual in production environments. Filter as needed.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of CREDENTIAL_TARGET_INFORMATION magic string was identified in a command on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/windows_credentials_access_via_vaultcli_module.yml b/detections/endpoint/windows_credentials_access_via_vaultcli_module.yml
index b01547eed38..8520a572a4c 100644
--- a/detections/endpoint/windows_credentials_access_via_vaultcli_module.yml
+++ b/detections/endpoint/windows_credentials_access_via_vaultcli_module.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects potentially abnormal interactions with VaultCLI.dll, particularly those initiated by processes located in publicly writable Windows folder paths. The VaultCLI.dll module allows processes to extract credentials from the Windows Credential Vault. It was seen being abused by information stealers such as Meduza. The analytic monitors suspicious API calls, unauthorized credential access patterns, and anomalous process behaviors indicative of malicious activity. By leveraging a combination of signature-based detection and behavioral analysis, it effectively flags attempts to misuse the vault for credential theft, enabling swift response to protect sensitive user data and ensure system security.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7  ImageLoaded ="*\\vaultcli.dll" process_path IN("*\\windows\\fonts\\*", "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", "*\\appdata\\local\\temp\\*", "*\\PerfLogs\\*", "*:\\temp\\*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_access_via_vaultcli_module_filter`'
+search: |
+    `sysmon` EventCode=7 ImageLoaded="*\\vaultcli.dll" process_path IN ("*\\windows\\fonts\\*", "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "*\\Windows\\repair\\*", "*\\appdata\\local\\temp\\*", "*\\PerfLogs\\*", "*:\\temp\\*") | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_access_via_vaultcli_module_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: Third party software might leverage this DLL in order to make use of the Credential Manager feature via the provided exports. Typically the vaultcli.dll module is loaded by the vaultcmd.exe Windows Utility to interact with the Windows Credential Manager for secure storage and retrieval of credentials.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml
index f6e37777948..cf47997a2e8 100644
--- a/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml
+++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the copying of Chrome's Local State and Login Data files into temporary folders, a tactic often used by the Braodo stealer malware. These files contain encrypted user credentials, including saved passwords and login session details. The detection monitors for suspicious copying activity involving these specific Chrome files, particularly in temp directories where malware typically processes the stolen data. Identifying this behavior enables security teams to act quickly, preventing attackers from decrypting and exfiltrating sensitive browser credentials and mitigating the risk of unauthorized access.
 data_source:
     - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("Local State", "Login Data") Filesystem.file_path = "*\\temp\\*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_chrome_copied_in_temp_dir_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*Local State", "*Login Data") Filesystem.file_path="*\\temp\\*" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_chrome_copied_in_temp_dir_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Chrome Password Store File [$file_name$] was copied in %temp% folder on [$dest$].
     entity:
diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml
index 231b1b6cbb3..8af81dbad33 100644
--- a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml
+++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml
@@ -6,40 +6,21 @@ modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects non-Chrome processes attempting to access the Chrome extensions file.
+description: 'The following analytic detects non-Chrome processes attempting to access the Chrome extensions file.
+
     It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior.
+
     This activity is significant because adversaries may exploit this file to extract sensitive information from the Chrome browser, posing a security risk.
-    If confirmed malicious, this could lead to unauthorized access to stored credentials and other sensitive data, potentially compromising the security of the affected system and broader network.
+
+    If confirmed malicious, this could lead to unauthorized access to stored credentials and other sensitive data, potentially compromising the security of the affected system and broader network.'
 data_source:
     - Windows Event Log Security 4663
 search: |
-    `wineventlog_security`
-    EventCode=4663
-    object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*"
-    NOT process_path IN (
-        "*:\\Windows\\explorer.exe",
-        "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\chrome.exe",
-        "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\chrome.exe",
-        "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\chrome.exe",
-        "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\chrome.exe",
-        "*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe"
-    )
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-
-      by object_file_name object_file_path
-         process_name process_path
-         process_id EventCode dest
+    `wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*" NOT (process_path IN ("*:\\Windows\\explorer.exe", "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\chrome.exe", "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\chrome.exe", "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\chrome.exe", "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\chrome.exe", "*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe")) | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_chrome_extension_access_filter`
+how_to_implement: 'To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663.
 
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_credentials_from_password_stores_chrome_extension_access_filter`
-how_to_implement: |-
-    To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663.
-    For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
-known_false_positives: |-
-    The chrome uninstaller will access these set of files and folders. Filter as needed.
+    For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."'
+known_false_positives: The chrome uninstaller will access these set of files and folders. Filter as needed.
 references:
     - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
 drilldown_searches:
@@ -50,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml
index 1d58baaa711..fc4284bcb6b 100644
--- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml
+++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml
@@ -6,42 +6,21 @@ modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects non-Chrome processes accessing the Chrome "Local State" file, which contains critical settings and information. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior.
+description: 'The following analytic detects non-Chrome processes accessing the Chrome "Local State" file, which contains critical settings and information. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior.
+
     This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome.
+
     If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk.
-    Monitoring this anomaly helps identify potential threats and safeguard browser-stored data.
+
+    Monitoring this anomaly helps identify potential threats and safeguard browser-stored data.'
 data_source:
     - Windows Event Log Security 4663
 search: |
-    `wineventlog_security`
-    EventCode=4663
-    object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State"
-    NOT process_path IN (
-        "*:\\Windows\\explorer.exe",
-        "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\chrome.exe",
-        "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\chrome.exe",
-        "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\chrome.exe",
-        "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\chrome.exe",
-        "*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
-        "*\\platform_experience_helper.exe*",
-        "*:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe*"
-    )
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-
-      by object_file_name object_file_path
-         process_name process_path
-         process_id EventCode dest
+    `wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" NOT (process_path IN ("*:\\Windows\\explorer.exe", "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\chrome.exe", "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\chrome.exe", "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\chrome.exe", "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\chrome.exe", "*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe", "*\\platform_experience_helper.exe", "*:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe")) | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_chrome_localstate_access_filter`
+how_to_implement: 'To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663.
 
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_credentials_from_password_stores_chrome_localstate_access_filter`
-how_to_implement: |-
-    To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663.
-    For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
-known_false_positives: |-
-    The chrome uninstaller will access these set of files and folders. Filter as needed.
+    For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."'
+known_false_positives: The chrome uninstaller will access these set of files and folders. Filter as needed.
 references:
     - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
 drilldown_searches:
@@ -52,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml
index 5656489fbe4..b0490b4daf6 100644
--- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml
+++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml
@@ -6,42 +6,23 @@ modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies non-Chrome processes accessing the Chrome user data file "login data."
+description: 'The following analytic identifies non-Chrome processes accessing the Chrome user data file "login data."
+
     This file is an SQLite database containing sensitive information, including saved passwords.
+
     The detection leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts.
+
     This activity is significant as it may indicate attempts by threat actors to extract and decrypt stored passwords, posing a risk to user credentials.
-    If confirmed malicious, attackers could gain unauthorized access to sensitive accounts and escalate their privileges within the environment.
+
+    If confirmed malicious, attackers could gain unauthorized access to sensitive accounts and escalate their privileges within the environment.'
 data_source:
     - Windows Event Log Security 4663
 search: |
-    `wineventlog_security`
-    EventCode=4663
-    object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
-    NOT process_path IN (
-        "*:\\Windows\\explorer.exe",
-        "*:\\Windows\\System32\\dllhost.exe",
-        "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\chrome.exe",
-        "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\chrome.exe",
-        "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\chrome.exe",
-        "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\chrome.exe",
-        "*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe"
-    )
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-
-      by object_file_name object_file_path
-         process_name process_path
-         process_id EventCode dest
+    `wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" NOT (process_path IN ("*:\\Windows\\explorer.exe", "*:\\Windows\\System32\\dllhost.exe", "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\chrome.exe", "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\chrome.exe", "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\chrome.exe", "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\chrome.exe", "*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe")) | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_chrome_login_data_access_filter`
+how_to_implement: 'To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663.
 
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_credentials_from_password_stores_chrome_login_data_access_filter`
-how_to_implement: |-
-    To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663.
-    For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
-known_false_positives: |-
-    The chrome uninstaller will access these set of files and folders. Filter as needed.
+    For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."'
+known_false_positives: The chrome uninstaller will access these set of files and folders. Filter as needed.
 references:
     - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
 drilldown_searches:
@@ -52,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_credentials_from_password_stores_creation.yml b/detections/endpoint/windows_credentials_from_password_stores_creation.yml
index c7d239c047a..c6d61eb36f3 100644
--- a/detections/endpoint/windows_credentials_from_password_stores_creation.yml
+++ b/detections/endpoint/windows_credentials_from_password_stores_creation.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name="cmdkey.exe"
-        OR
-        Processes.original_file_name = "cmdkey.exe"
-        AND
-        Processes.process = "*/generic*" Processes.process IN ("*/user*", "*/password*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_credentials_from_password_stores_creation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.original_file_name="cmdkey.exe" Processes.process="*/generic*" Processes.process IN ("*/user*", "*/password*")) OR Processes.process_name="*cmdkey.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_creation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network administrator can use this tool for auditing process.
 references:
@@ -41,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: a process $process_name$ was executed on $dest$ to create stored credentials
     entity:
diff --git a/detections/endpoint/windows_credentials_from_password_stores_deletion.yml b/detections/endpoint/windows_credentials_from_password_stores_deletion.yml
index 3e6b8890801..c8a82086db2 100644
--- a/detections/endpoint/windows_credentials_from_password_stores_deletion.yml
+++ b/detections/endpoint/windows_credentials_from_password_stores_deletion.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (Processes.process_name="cmdkey.exe"
-        OR
-        Processes.original_file_name = "cmdkey.exe")
-        AND
-        Processes.process = "*/delete*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_credentials_from_password_stores_deletion_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*cmdkey.exe" OR Processes.original_file_name="cmdkey.exe" Processes.process="*/delete*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_deletion_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network administrator can use this tool for auditing process.
 references:
@@ -41,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: a process $process_name$ was executed on $dest$ to delete stored credentials
     entity:
diff --git a/detections/endpoint/windows_credentials_from_password_stores_query.yml b/detections/endpoint/windows_credentials_from_password_stores_query.yml
index 34cf76c7815..b0f0524a79f 100644
--- a/detections/endpoint/windows_credentials_from_password_stores_query.yml
+++ b/detections/endpoint/windows_credentials_from_password_stores_query.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name="cmdkey.exe"
-        OR
-        Processes.original_file_name = "cmdkey.exe"
-        AND
-        Processes.process = "*/list*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_credentials_from_password_stores_query_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.original_file_name="cmdkey.exe" Processes.process="*/list*") OR Processes.process_name="*cmdkey.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_query_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network administrator can use this tool for auditing process.
 references:
@@ -43,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_credentials_from_web_browsers_saved_in_temp_folder.yml b/detections/endpoint/windows_credentials_from_web_browsers_saved_in_temp_folder.yml
index 338b8aae5e6..3d7637d344b 100644
--- a/detections/endpoint/windows_credentials_from_web_browsers_saved_in_temp_folder.yml
+++ b/detections/endpoint/windows_credentials_from_web_browsers_saved_in_temp_folder.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation of files containing passwords, cookies, and saved login account information by the Braodo stealer malware in temporary folders. Braodo often collects these credentials from browsers and applications, storing them in temp directories before exfiltration. This detection focuses on monitoring for the creation of files with patterns or formats commonly associated with stolen credentials. By identifying these activities, security teams can take needed action to prevent sensitive login data from being leaked, reducing the risk of unauthorized access to user accounts and systems.
 data_source:
     - Sysmon EventID 11
-search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("login*", "pass*","cookie*","master_key*") Filesystem.file_path = "*\\temp\\*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_web_browsers_saved_in_temp_folder_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("login*", "pass*", "cookie*", "master_key*") Filesystem.file_path="*\\temp\\*" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_web_browsers_saved_in_temp_folder_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A known credential file name - [$file_name$] was saved in %temp% folder of [$dest$].
     entity:
diff --git a/detections/endpoint/windows_credentials_in_registry_reg_query.yml b/detections/endpoint/windows_credentials_in_registry_reg_query.yml
index c84daad7d7c..8dbda2b004a 100644
--- a/detections/endpoint/windows_credentials_in_registry_reg_query.yml
+++ b/detections/endpoint/windows_credentials_in_registry_reg_query.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process = "* query *" AND Processes.process IN ("*\\Software\\ORL\\WinVNC3\\Password*", "*\\SOFTWARE\\RealVNC\\WinVNC4 /v password*", "*\\CurrentControlSet\\Services\\SNMP*", "*\\Software\\TightVNC\\Server*", "*\\Software\\SimonTatham\\PuTTY\\Sessions*", "*\\Software\\OpenSSH\\Agent\\Keys*", "*password*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_in_registry_reg_query_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*reg.exe" OR Processes.original_file_name="reg.exe" Processes.process="* query *" Processes.process IN ("*\\Software\\ORL\\WinVNC3\\Password*", "*\\SOFTWARE\\RealVNC\\WinVNC4 /v password*", "*\\CurrentControlSet\\Services\\SNMP*", "*\\Software\\TightVNC\\Server*", "*\\Software\\SimonTatham\\PuTTY\\Sessions*", "*\\Software\\OpenSSH\\Agent\\Keys*", "*password*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_in_registry_reg_query_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_crowdstrike_agent_registry_key_removal.yml b/detections/endpoint/windows_crowdstrike_agent_registry_key_removal.yml
index 1da02596c5e..758387fb581 100644
--- a/detections/endpoint/windows_crowdstrike_agent_registry_key_removal.yml
+++ b/detections/endpoint/windows_crowdstrike_agent_registry_key_removal.yml
@@ -6,26 +6,15 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects delete events on the CrowdStrike registry keys.
+description: 'Detects delete events on the CrowdStrike registry keys.
+
     These keys are removed as part of the agent uninstallation process.
-    This activity should only occur during planned events and any instances outside that should be evaluated for malicious activity such as CVE-2022-44721.
+
+    This activity should only occur during planned events and any instances outside that should be evaluated for malicious activity such as CVE-2022-44721.'
 data_source:
     - Sysmon EventID 12
-search: |-
-    `sysmon`
-    EventID="12"
-    TargetObject="*\\SYSTEM\\CrowdStrike"
-    action="deleted"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer EventID TargetObject action dest process_guid process_id registry_hive
-         registry_path registry_key_name status user vendor_product
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_crowdstrike_agent_registry_key_removal_filter`
+search: |
+    `sysmon` EventCode=12 TargetObject="*\\SYSTEM\\CrowdStrike" action="deleted" | eval registry_value_name=registry_value_name, object_handle=registry_value_data | stats count min(_time) as firstTime max(_time) as lastTime by action dest process_guid process_id registry_hive registry_path registry_key_name status user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_crowdstrike_agent_registry_key_removal_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Agent uninstallations during planned maintenance or legitimate IT workflows may trigger these detections. Review such events to avoid false positive alerts.
 references:
@@ -38,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml b/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml
index eeaa18f1349..a8ddf997c19 100644
--- a/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml
+++ b/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml
@@ -6,35 +6,14 @@ modification_date: '2026-09-28'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects usage of Crowdstrike Real Time Response (RTR) to execute a "runscript" command.
-    This can be used by malicious actors with access to the Crowdstrike Dashboard to execute commands on remote managed hosts.
+description: 'Detects usage of Crowdstrike Real Time Response (RTR) to execute a "runscript" command.
+
+    This can be used by malicious actors with access to the Crowdstrike Dashboard to execute commands on remote managed hosts.'
 data_source:
     - Sysmon EventID 1
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.parent_process_name="dllhost.exe"
-    Processes.parent_process IN ("*/Processid:{BD07DDB9-1C61-4DCE-9202-A2BA1757CDB2}*", "unknown")
-    Processes.process_name="powershell.exe"
-    Processes.process="* -Version 5.1 -s -NoLogo -NoProfile -EncodedCommand*"
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_crowdstrike_rtr_script_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*dllhost.exe" Processes.parent_process IN ("*/Processid:{BD07DDB9-1C61-4DCE-9202-A2BA1757CDB2}*", "*unknown*") Processes.process_name="*powershell.exe" Processes.process="* -Version 5.1 -s -NoLogo -NoProfile -EncodedCommand*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_crowdstrike_rtr_script_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate Crowdstrike administrators may use RTR runscript commands for maintenance or troubleshooting. Filter alerts for trusted user activity and approved scripts.
 references:
@@ -47,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
index fab377f7cf4..9e8db6b624e 100644
--- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml
+++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
@@ -6,61 +6,46 @@ modification_date: '2026-10-02'
 author: Michael Haag, Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects the use of Windows Curl.exe to download
+description: 'The following analytic detects the use of Windows Curl.exe to download
+
     a file to a suspicious location, such as AppData, ProgramData, or Public directories.
+
     It leverages data from Endpoint Detection and Response (EDR) agents, focusing on
+
     command-line executions that include the -O or --output options. This activity is
+
     significant because downloading files to these locations can indicate an attempt
+
     to bypass security controls or establish persistence. If confirmed malicious, this
+
     behavior could lead to unauthorized code execution, data exfiltration, or further
-    compromise of the system.
+
+    compromise of the system.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
     - Cisco Network Visibility Module Flow Data
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    (
-      Processes.process_name=curl.exe
-      OR
-      Processes.original_file_name=Curl.exe
-    )
-    Processes.process IN ("*-O *","*--output*", "*--output-dir*")
-    Processes.process IN (
-          "*:\\PerfLogs\\*",
-          "*:\\Windows\\Temp\\*",
-          "*\\AppData\\*",
-          "*\\ProgramData\\*",
-          "*\\Users\\Public\\*",
-          "*%AppData%*",
-          "*%Public%*",
-          "*%Temp%*",
-          "*%tmp%*"
-          )
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_curl_download_to_suspicious_path_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*curl.exe" OR Processes.original_file_name="Curl.exe" Processes.process IN ("*-O *", "*--output*", "*--output-dir*") Processes.process IN ("*:\\PerfLogs\\*", "*:\\Windows\\Temp\\*", "*\\AppData\\*", "*\\ProgramData\\*", "*\\Users\\Public\\*", "*%AppData%*", "*%Public%*", "*%Temp%*", "*%tmp%*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_curl_download_to_suspicious_path_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    It is possible Administrators or super users will use Curl for legitimate purposes. Filter as needed.
+
+    names and speed up the data modeling process.'
+known_false_positives: It is possible Administrators or super users will use Curl for legitimate purposes. Filter as needed.
 references:
     - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
     - https://attack.mitre.org/techniques/T1105/
@@ -74,7 +59,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory.
     entity:
diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml
index 5c630ac4f37..fd4c067bb2a 100644
--- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml
+++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml
@@ -6,46 +6,20 @@ modification_date: '2026-10-09'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects the use of Windows Curl.exe to upload a file to a remote destination.
+description: 'The following analytic detects the use of Windows Curl.exe to upload a file to a remote destination.
+
     It identifies command-line arguments such as `-T`, `--upload-file`, `-d`, `--data`, and `-F` in process execution logs.
+
     This activity is significant because adversaries may use Curl to exfiltrate data or upload malicious payloads. If confirmed malicious, this could lead to data breaches or further compromise of the system.
-    Analysts should review parallel processes and network logs to determine if the upload was successful and isolate the endpoint if necessary.
+
+    Analysts should review parallel processes and network logs to determine if the upload was successful and isolate the endpoint if necessary.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
     - Cisco Network Visibility Module Flow Data
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    (
-        Processes.process_name=curl.exe
-        OR
-        Processes.original_file_name=Curl.exe
-    )
-    Processes.process IN (
-        "*-T *",
-        "*--upload-file *",
-        "*-d *",
-        "*--data *",
-        "*-F *"
-    )
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id
-       Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_curl_upload_to_remote_destination_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*curl.exe" OR Processes.original_file_name="Curl.exe" Processes.process IN ("*-T *", "*--upload-file *", "*-d *", "*--data *", "*-F *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_curl_upload_to_remote_destination_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be limited to source control applications and may be required to be filtered out.
 references:
diff --git a/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml b/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml
index 79720fd7a03..909f1bd0452 100644
--- a/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml
+++ b/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml
@@ -10,7 +10,7 @@ description: The following analytic identifies a suspicious process that is recu
 data_source:
     - Sysmon EventID 23
     - Sysmon EventID 26
-search: |-
+search: |
     `sysmon` EventCode IN ("23","26") TargetFilename IN ("*.exe", "*.sys", "*.dll")
       | bin _time span=2m
       | stats count min(_time) as firstTime, max(_time) as lastTime values(file_path) as file_path values(file_hash) as file_hash values(file_name) as file_name values(file_modify_time) as file_modify_time values(process_name) as process_name values(process_path) as process_path values(process_guid) as process_guid values(process_id) as process_id values(process_exec) as process_exec
@@ -33,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The process $process_name$ has removed a significant quantity of executable files, totaling [$count$], from the destination $dest$.
     entity:
diff --git a/detections/endpoint/windows_debugger_tool_execution.yml b/detections/endpoint/windows_debugger_tool_execution.yml
index eb5716893f1..6a4656a4077 100644
--- a/detections/endpoint/windows_debugger_tool_execution.yml
+++ b/detections/endpoint/windows_debugger_tool_execution.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "x32dbg.exe"
-        OR
-        Processes.process_name = "x64dbg.exe"
-        OR
-        Processes.process_name = "windbg.exe"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_debugger_tool_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*x32dbg.exe", "*x64dbg.exe", "*windbg.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_debugger_tool_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: administrator or IT professional may execute this application for verifying files or debugging application.
 references:
diff --git a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml
index c00602a48bd..7323b21b151 100644
--- a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml
+++ b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic identifies modifications to the TranscodedWallpaper file in the wallpaper theme directory, excluding changes made by explorer.exe. This detection leverages the Endpoint.Processes and Endpoint.Filesystem data models to correlate process activity with file modifications. This activity is significant as it may indicate an adversary attempting to deface or change the desktop wallpaper of a targeted host, a tactic often used to signal compromise or deliver a message. If confirmed malicious, this could be a sign of unauthorized access and tampering, potentially leading to further system compromise or data exfiltration.
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_path !="*\\Windows\\Explorer.EXE" by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields file_name file_path process_name process_path process dest file_create_time _time proc_guid] | `windows_defacement_modify_transcodedwallpaper_file_filter`'
+search: |
+    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_path !="*\\Windows\\Explorer.EXE" by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields file_name file_path process_name process_path process dest file_create_time _time proc_guid] | `windows_defacement_modify_transcodedwallpaper_file_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: 3rd part software application can change the wallpaper. Filter is needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_default_cobalt_strike_powershell_beacon.yml b/detections/endpoint/windows_default_cobalt_strike_powershell_beacon.yml
index 75b3815e969..df79fd89e35 100644
--- a/detections/endpoint/windows_default_cobalt_strike_powershell_beacon.yml
+++ b/detections/endpoint/windows_default_cobalt_strike_powershell_beacon.yml
@@ -6,35 +6,16 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects default function and variable names known to be used by the Cobalt Strike PowerShell beacon.
-    This beacon is used to gain command and control on a victim.
+description: 'Detects default function and variable names known to be used by the Cobalt Strike PowerShell beacon.
+
+    This beacon is used to gain command and control on a victim.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventID="4104"
-    ScriptBlockText IN (
-        "*func_get_proc_address*",
-        "*$var_unsafe_native_methods*",
-        "*$var_gpa.Invoke*",
-        "*func_get_delegate_type*",
-        "*$var_type_builder*"
-    )
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-
-    by Computer EventID ScriptBlockText dest signature signature_id
-       user_id vendor_product Guid Opcode Name
-       Path ProcessID ScriptBlockId
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_default_cobalt_strike_powershell_beacon_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*func_get_proc_address*", "*$var_unsafe_native_methods*", "*$var_gpa.Invoke*", "*func_get_delegate_type*", "*$var_type_builder*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_default_cobalt_strike_powershell_beacon_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    False positives are very unlikely as this detection targets default Cobalt Strike PowerShell beacon functions and variables. Modifications to the beacon's script may bypass detection but do not create false positives.
+known_false_positives: False positives are very unlikely as this detection targets default Cobalt Strike PowerShell beacon functions and variables. Modifications to the beacon's script may bypass detection but do not create false positives.
+references: []
 drilldown_searches:
     - earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
@@ -43,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Default Cobalt Strike PowerShell beacon activity observed on $dest$ via script block $ScriptBlockId$.
     entity:
diff --git a/detections/endpoint/windows_default_group_policy_object_modified.yml b/detections/endpoint/windows_default_group_policy_object_modified.yml
index b9d4506322a..6c3d7f7d23b 100644
--- a/detections/endpoint/windows_default_group_policy_object_modified.yml
+++ b/detections/endpoint/windows_default_group_policy_object_modified.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic detects modifications to default Group Policy Objects (GPOs) using Event ID 5136. It monitors changes to the `Default Domain Controllers Policy` and `Default Domain Policy`, which are critical for enforcing security settings across domain controllers and all users/computers, respectively. This activity is significant because unauthorized changes to these GPOs can indicate an adversary with privileged access attempting to deploy persistence mechanisms or execute malware across the network. If confirmed malicious, such modifications could lead to widespread compromise, allowing attackers to maintain control and execute arbitrary code on numerous hosts.
 data_source:
     - Windows Event Log Security 5136
-search: |-
-    `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=versionNumber (ObjectDN="CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=*" OR ObjectDN="CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=POLICIES,CN=SYSTEM,DC=*")
-      | stats min(_time) as firstTime max(_time) as lastTime
-        BY ObjectDN SubjectUserSid AttributeValue
-           Computer DSName dest
-      | rename AttributeValue as versionNumber
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_default_group_policy_object_modified_filter`
+search: |
+    `wineventlog_security` EventCode=5136 ObjectClass="groupPolicyContainer" AttributeLDAPDisplayName="versionNumber" ObjectDN IN ("CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=*", "CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=POLICIES,CN=SYSTEM,DC=*") | eval ObjectDN=ObjectDN, SubjectUserName=SubjectUserName, SubjectUserSid=SubjectUserSid, Computer=Computer, User=SubjectUserSid, user=SubjectUserName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_default_group_policy_object_modified_filter`
 how_to_implement: To successfully implement this search, the Advanced Security Audit policy setting `Audit Directory Service Changes` within `DS Access` needs to be enabled. Furthermore, the appropriate system access control lists (SACL) need to be created as the used events are not logged by default. A good guide to accomplish this can be found here https://jgspiers.com/audit-group-policy-changes/.
 known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
 references:
@@ -33,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A default group policy object was modified on $Computer$ by $SubjectUserSid$
     entity:
diff --git a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml
index 447b89a238c..8a6eb6599c5 100644
--- a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml
+++ b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=mmc.exe (Processes.process =*gpme.msc*)
-        AND
-        (Processes.process = "*31B2F340-016D-11D2-945F-00C04FB984F9*"
-        OR
-        Processes.process = "*6AC1786C-016F-11D2-945F-00C04fB984F9*"  )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_default_group_policy_object_modified_with_gpme_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*mmc.exe" Processes.process="*gpme.msc*" Processes.process IN ("*31B2F340-016D-11D2-945F-00C04FB984F9*", "*6AC1786C-016F-11D2-945F-00C04fB984F9*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_default_group_policy_object_modified_with_gpme_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
 references:
@@ -45,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A default group policy object was opened with Group Policy Manage Editor on $dest$
     entity:
diff --git a/detections/endpoint/windows_default_rdp_file_creation_by_non_mstsc_process.yml b/detections/endpoint/windows_default_rdp_file_creation_by_non_mstsc_process.yml
index ea401f7fa79..9fe9614cd9d 100644
--- a/detections/endpoint/windows_default_rdp_file_creation_by_non_mstsc_process.yml
+++ b/detections/endpoint/windows_default_rdp_file_creation_by_non_mstsc_process.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This detection monitors the creation or modification of the Default.rdp file by non mstsc.exe process, typically found in the user's Documents folder. This file is automatically generated or updated by the Remote Desktop Connection client (mstsc.exe) when a user initiates an RDP session. It stores connection settings such as the last-used hostname, screen size, and other preferences. The presence or update of this file strongly suggests that an RDP session has been launched from the system. Since this file is commonly overlooked, it can serve as a valuable artifact in identifying remote access activity, including potential lateral movement or attacker-controlled sessions.
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 11
-search: |-
+search: |
     | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
       WHERE Processes.process_name != mstsc.exe
       BY _time span=1h Processes.action
@@ -48,7 +48,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_default_rdp_file_deletion.yml b/detections/endpoint/windows_default_rdp_file_deletion.yml
index 5f97551e7af..8a99f30d87c 100644
--- a/detections/endpoint/windows_default_rdp_file_deletion.yml
+++ b/detections/endpoint/windows_default_rdp_file_deletion.yml
@@ -10,7 +10,8 @@ description: This detection identifies the deletion of the Default.rdp file from
 data_source:
     - Sysmon EventID 23
     - Sysmon EventID 26
-search: '`sysmon` EventCode IN ("23", "26") TargetFilename = "*\\default.rdp" | stats count min(_time) as firstTime, max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_default_rdp_file_deletion_filter`'
+search: |
+    `sysmon` EventCode=23 EventCode="26" TargetFilename="*\\default.rdp" | stats count min(_time) as firstTime max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_default_rdp_file_deletion_filter`
 how_to_implement: To successfully implement this search, you need to ingest logs that include the deleted target file name, process name, and process ID from your endpoints. If you are using Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_default_rdp_file_unhidden.yml b/detections/endpoint/windows_default_rdp_file_unhidden.yml
index 04fbf7eb978..af25836741d 100644
--- a/detections/endpoint/windows_default_rdp_file_unhidden.yml
+++ b/detections/endpoint/windows_default_rdp_file_unhidden.yml
@@ -9,20 +9,8 @@ type: Anomaly
 description: This detection identifies the use of attrib.exe to remove hidden (-h) or system (-s) attributes from the Default.rdp file, which is automatically created in a user's Documents folder when a Remote Desktop Protocol (RDP) session is initiated using mstsc.exe. The Default.rdp file stores session configuration details such as the remote host address and screen settings. Unhiding this file is uncommon in normal user behavior and may indicate that an attacker or red team operator is attempting to access or manipulate RDP connection history that was previously hidden—either by default or as part of an earlier anti-forensics effort. This activity may represent part of a broader pattern of reconnaissance or staging for credential reuse, lateral movement, or forensic analysis evasion. Monitoring for this behavior can help uncover suspicious manipulation of user artifacts and highlight interactive attacker activity on a compromised host.
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "attrib.exe" Processes.process IN("*-s*", "*-h*") Processes.process = "*default.rdp*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_default_rdp_file_unhidden_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*attrib.exe" Processes.process IN ("*-s*", "*-h*") Processes.process="*default.rdp*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_default_rdp_file_unhidden_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -36,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_defender_asr_audit_events.yml b/detections/endpoint/windows_defender_asr_audit_events.yml
index ad273795234..e6a4fe50d76 100644
--- a/detections/endpoint/windows_defender_asr_audit_events.yml
+++ b/detections/endpoint/windows_defender_asr_audit_events.yml
@@ -6,14 +6,13 @@ modification_date: '2026-09-22'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |-
-    This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes.
+description: This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes.
 data_source:
     - Windows Event Log Defender 1122
     - Windows Event Log Defender 1125
     - Windows Event Log Defender 1132
     - Windows Event Log Defender 1134
-search: |-
+search: |
     `ms_defender`
     EventCode IN (
         1122,
@@ -36,8 +35,7 @@ search: |-
     | `security_content_ctime(lastTime)`
     | `windows_defender_asr_audit_events_filter`
 how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event.
-known_false_positives: |-
-    Some false positives are expected initially as the ASR rules are tuned and configured.
+known_false_positives: Some false positives are expected initially as the ASR rules are tuned and configured.
 references:
     - https://asrgen.streamlit.app/
     - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-overview
@@ -49,7 +47,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_defender_asr_block_events.yml b/detections/endpoint/windows_defender_asr_block_events.yml
index 6d02f418c06..e4a6e2de855 100644
--- a/detections/endpoint/windows_defender_asr_block_events.yml
+++ b/detections/endpoint/windows_defender_asr_block_events.yml
@@ -6,16 +6,16 @@ modification_date: '2026-09-22'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |-
-    This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule.
-    Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves.
+description: 'This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule.
+
+    Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves.'
 data_source:
     - Windows Event Log Defender 1121
     - Windows Event Log Defender 1126
     - Windows Event Log Defender 1129
     - Windows Event Log Defender 1131
     - Windows Event Log Defender 1133
-search: |-
+search: |
     `ms_defender`
     EventCode IN (
         1121,
@@ -38,10 +38,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_defender_asr_block_events_filter`
-how_to_implement: |-
-    The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event.
-known_false_positives: |-
-    Some false positives are expected initially as the ASR rules are tuned and configured.
+how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event.
+known_false_positives: Some false positives are expected initially as the ASR rules are tuned and configured.
 references:
     - https://asrgen.streamlit.app/
     - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-overview
@@ -53,7 +51,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_defender_asr_or_threat_configuration_tamper.yml b/detections/endpoint/windows_defender_asr_or_threat_configuration_tamper.yml
index df732619bb9..b3cdf8d720e 100644
--- a/detections/endpoint/windows_defender_asr_or_threat_configuration_tamper.yml
+++ b/detections/endpoint/windows_defender_asr_or_threat_configuration_tamper.yml
@@ -6,59 +6,37 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects the use of commands to disable Attack Surface Reduction (ASR) rules or change threat default actions in Windows Defender.
+description: 'The following analytic detects the use of commands to disable Attack Surface Reduction (ASR) rules or change threat default actions in Windows Defender.
+
     It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving "Add-MpPreference" or "Set-MpPreference".
+
     This activity is significant because adversaries often use it to bypass Windows Defender, allowing malicious code to execute undetected.
-    If confirmed malicious, this behavior could enable attackers to evade antivirus detection, maintain persistence, and execute further malicious activities without interference from Windows Defender.
+
+    If confirmed malicious, this behavior could enable attackers to evade antivirus detection, maintain persistence, and execute further malicious activities without interference from Windows Defender.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process IN ("*Add-MpPreference *", "*Set-MpPreference *")
-
-    Processes.process IN (
-          "*-AttackSurfaceReductionRules_Actions*",
-          "*-ThreatIDDefaultAction_Actions*"
-          )
-
-    Processes.process IN (
-          "*Allow*",
-          "*NoAction*",
-          "*Disabled*",
-          "*_Actions 6*",
-          "*_Actions 9*",
-          "*_Actions 0*")
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*Add-MpPreference *", "*Set-MpPreference *") Processes.process IN ("*-AttackSurfaceReductionRules_Actions*", "*-ThreatIDDefaultAction_Actions*") Processes.process IN ("*Allow*", "*NoAction*", "*Disabled*", "*_Actions 6*", "*_Actions 9*", "*_Actions 0*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_defender_asr_or_threat_configuration_tamper_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_defender_asr_or_threat_configuration_tamper_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    Certain administrative tasks may require the modification of ASR rules or threat actions due to FPs being generated. Investigate all attempts and filter as needed.
+
+    names and speed up the data modeling process.'
+known_false_positives: Certain administrative tasks may require the modification of ASR rules or threat actions due to FPs being generated. Investigate all attempts and filter as needed.
 references:
     - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2025-ps#-attacksurfacereductionrules-actions
     - https://www.virustotal.com/gui/file/7e805617c313ec2fb59d86719c827074cb7dfbf8f0aa18194ac1ffe6c21c8967/behavior
@@ -70,7 +48,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: ASR or Threat detection tamper activity executed via $process$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_defender_asr_registry_modification.yml b/detections/endpoint/windows_defender_asr_registry_modification.yml
index 06c4bbcb8bb..e80409b55d1 100644
--- a/detections/endpoint/windows_defender_asr_registry_modification.yml
+++ b/detections/endpoint/windows_defender_asr_registry_modification.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects modifications to Windows Defender Attack Surface Reduction (ASR) registry settings. It leverages Windows Defender Operational logs, specifically EventCode 5007, to identify changes in ASR rules. This activity is significant because ASR rules are designed to block actions commonly used by malware to exploit systems. Unauthorized modifications to these settings could indicate an attempt to weaken system defenses. If confirmed malicious, this could allow an attacker to bypass security measures, leading to potential system compromise and data breaches.
 data_source:
     - Windows Event Log Defender 5007
-search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?<New_Registry_Value>\\d+)$" | rex field=Old_Value "0x(?<Old_Registry_Value>\\d+)$" | rex field=New_Value "Rules\\\\(?<ASR_ID>[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup local=t asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)`| rename host as dest | `security_content_ctime(lastTime)` | `windows_defender_asr_registry_modification_filter`'
+search: |
+    `ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?<New_Registry_Value>\\d+)$" | rex field=Old_Value "0x(?<Old_Registry_Value>\\d+)$" | rex field=New_Value "Rules\\\\(?<ASR_ID>[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup local=t asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)`| rename host as dest | `security_content_ctime(lastTime)` | `windows_defender_asr_registry_modification_filter`
 how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name.
 known_false_positives: False positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. For example, Event ID 5007 is generated when a process attempts to modify a registry key that is related to ASR rules. This can be triggered by legitimate applications that attempt to modify registry keys that are not blocked by ASR rules.
 references:
diff --git a/detections/endpoint/windows_defender_asr_rule_disabled.yml b/detections/endpoint/windows_defender_asr_rule_disabled.yml
index eed3e8b8c5f..ef0fa918c81 100644
--- a/detections/endpoint/windows_defender_asr_rule_disabled.yml
+++ b/detections/endpoint/windows_defender_asr_rule_disabled.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies when a Windows Defender ASR rule disabled events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR rule disabled events that are generated when an ASR rule is disabled.
 data_source:
     - Windows Event Log Defender 5007
-search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?<New_Registry_Value>\\d+)$" | rex field=Old_Value "0x(?<Old_Registry_Value>\\d+)$" | rex field=New_Value "Rules\\\\(?<ASR_ID>[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | search New_Registry_Value="Disabled" | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup local=t asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| rename host as dest | `windows_defender_asr_rule_disabled_filter`'
+search: |
+    `ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?<New_Registry_Value>\\d+)$" | rex field=Old_Value "0x(?<Old_Registry_Value>\\d+)$" | rex field=New_Value "Rules\\\\(?<ASR_ID>[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | search New_Registry_Value="Disabled" | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup local=t asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| rename host as dest | `windows_defender_asr_rule_disabled_filter`
 how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name.
 known_false_positives: False positives may occur if applications are typically disabling ASR rules in the environment. Monitor for changes to ASR rules to determine if this is a false positive.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: ASR rule disabled event, $ASR_Rule$, was triggered on $dest$.
     entity:
diff --git a/detections/endpoint/windows_defender_asr_rules_stacking.yml b/detections/endpoint/windows_defender_asr_rules_stacking.yml
index 1f0d5b29282..1d482fcfc3a 100644
--- a/detections/endpoint/windows_defender_asr_rules_stacking.yml
+++ b/detections/endpoint/windows_defender_asr_rules_stacking.yml
@@ -17,7 +17,7 @@ data_source:
     - Windows Event Log Defender 1133
     - Windows Event Log Defender 1134
     - Windows Event Log Defender 5007
-search: |-
+search: |
     `ms_defender` EventCode IN (1121, 1122, 1125, 1126, 1129, 1131, 1132, 1133, 1134, 5007)
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY host Parent_Commandline, Process_Name,
diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml
index 1896fa962c3..8a46635cfa8 100644
--- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml
+++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows Defender exclusion registry entries. It leverages endpoint registry data to identify changes in the registry path "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*". This activity is significant because adversaries often modify these entries to bypass Windows Defender, allowing malicious code to execute without detection. If confirmed malicious, this behavior could enable attackers to evade antivirus defenses, maintain persistence, and execute further malicious activities undetected.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_defender_exclusion_registry_entry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_defender_exclusion_registry_entry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin or user may choose to use this windows features.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Exclusion registry $registry_path$ modified or added on $dest$ for Windows Defender
     entity:
diff --git a/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml
index a5a3a0d4e98..b0577122982 100644
--- a/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml
+++ b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml
@@ -6,14 +6,16 @@ modification_date: '2026-09-30'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects creation and removal of intermediary remediation artifacts of Windows Defender, during exploitation of ShieldCrash attacks.
+description: 'The following analytic detects creation and removal of intermediary remediation artifacts of Windows Defender, during exploitation of ShieldCrash attacks.
+
     Exploit abuses the race condition between file validation and its remediation performed by Windows Defender. In between these steps, ShieldCrash changes the
+
     symbolic link to redirect the remediation process to a staging directory controlled by the attacker. This detection aims to detect creation of defender artifact,
-    its alternate data stream, and their subsequent removal.
+
+    its alternate data stream, and their subsequent removal.'
 data_source:
     - Sysmon EventID 11 AND Sysmon EventID 15 AND Sysmon EventID 23
-search: |-
+search: |
     `sysmon`
     EventID IN (11, 15, 23)
     process_name IN (
@@ -43,13 +45,14 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_defender_intermediary_artifact_was_observed_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting file creation, file stream creation and file deletion events from your endpoints using Sysmon.
+how_to_implement: 'To successfully implement this search, you need to be ingesting file creation, file stream creation and file deletion events from your endpoints using Sysmon.
+
     These logs must be processed using the latest Sysmon Technical Add-on (https://splunkbase.splunk.com/app/5709). Make sure to update Sysmon configuration to include
-    directories you would like to monitor for these kinds of events.
-known_false_positives: |-
-    Remediation of various container files, such as archives, might also lead to creation various defender artifacts
-    SmartScreen interferes with the remediation process, potentially causing additional defender artifacts to be created.
+
+    directories you would like to monitor for these kinds of events.'
+known_false_positives: 'Remediation of various container files, such as archives, might also lead to creation various defender artifacts
+
+    SmartScreen interferes with the remediation process, potentially causing additional defender artifacts to be created.'
 references:
     - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day
     - https://www.cyderes.com/howler-cell/shieldcrash-microsoft-zero-day?hs_amp=true
@@ -62,7 +65,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_defender_mpclient_dll_loaded_by_non_defender_process.yml b/detections/endpoint/windows_defender_mpclient_dll_loaded_by_non_defender_process.yml
index d4ff791a7e5..1f430f4c11b 100644
--- a/detections/endpoint/windows_defender_mpclient_dll_loaded_by_non_defender_process.yml
+++ b/detections/endpoint/windows_defender_mpclient_dll_loaded_by_non_defender_process.yml
@@ -6,13 +6,14 @@ modification_date: '2026-08-19'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects mpclient.dll, the Windows Defender client API library, being loaded by a process that is not part of the Windows Defender platform.
-    mpclient.dll exposes the API surface used to drive on-demand Defender scans (IOAV, MpScan). In the ShieldBreak exploit, the attacker binary loads mpclient.dll directly and calls its scan APIs against an object-manager path in order to trigger a Defender scan against attacker-controlled content as part of a race condition targeting Defender's placeholder-hydration behavior.
-    If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation.
+description: 'The following analytic detects mpclient.dll, the Windows Defender client API library, being loaded by a process that is not part of the Windows Defender platform.
+
+    mpclient.dll exposes the API surface used to drive on-demand Defender scans (IOAV, MpScan). In the ShieldBreak exploit, the attacker binary loads mpclient.dll directly and calls its scan APIs against an object-manager path in order to trigger a Defender scan against attacker-controlled content as part of a race condition targeting Defender''s placeholder-hydration behavior.
+
+    If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender''s own scanning pipeline for local privilege escalation.'
 data_source:
     - Sysmon EventID 7
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -40,11 +41,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_defender_mpclient_dll_loaded_by_non_defender_process_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting logs with the driver/module loaded from your endpoints.
-    If you are using Sysmon, configuration must explicitly include image loading events targeting mpclient.dll.
-known_false_positives: |-
-    Third-party security products or custom AV-integration tooling that legitimately calls into the Defender client API may load mpclient.dll outside the Defender platform directories. Filter as necessary for your environment.
+how_to_implement: 'To successfully implement this search, you need to be ingesting logs with the driver/module loaded from your endpoints.
+
+    If you are using Sysmon, configuration must explicitly include image loading events targeting mpclient.dll.'
+known_false_positives: Third-party security products or custom AV-integration tooling that legitimately calls into the Defender client API may load mpclient.dll outside the Defender platform directories. Filter as necessary for your environment.
 references:
     - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day
     - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet
@@ -56,7 +56,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_defender_threat_detected_on_kernel_object_path.yml b/detections/endpoint/windows_defender_threat_detected_on_kernel_object_path.yml
index 023f83d6a92..ce863058fe2 100644
--- a/detections/endpoint/windows_defender_threat_detected_on_kernel_object_path.yml
+++ b/detections/endpoint/windows_defender_threat_detected_on_kernel_object_path.yml
@@ -6,34 +6,20 @@ modification_date: '2026-08-18'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects a Windows Defender malware detection or remediation event where the scanned path resolves through the NT object manager namespace (\globalroot\).
+description: 'The following analytic detects a Windows Defender malware detection or remediation event where the scanned path resolves through the NT object manager namespace (\globalroot\).
+
     It leverages Windows Defender Operational log EventCodes 1116 and 1117 to identify this activity.
+
     In the ShieldBreak exploit, this is how Defender is coerced into hydrating a cloud file placeholder and copying attacker content through a symbolic link chain that ultimately writes into C:\Windows\System32.
-    If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation.
+
+    If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender''s own scanning pipeline for local privilege escalation.'
 data_source:
     - Windows Event Log Defender 1116
     - Windows Event Log Defender 1117
-search: |-
-    `ms_defender`
-    EventCode IN (1116, 1117)
-    Path="*\\globalroot\\*"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-                  values(EventCode) as EventCode
-                  values(Action_Name) as Action_Name
-                  values(Additional_Actions_String) as Additional_Actions_String
-                  values(FWLink) as FWLink
-      by dvc Detection_User Path Threat_Name Severity_Name Category_Name
-    | rename dvc as dest, Detection_User as user
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_defender_threat_detected_on_kernel_object_path_filter`
-how_to_implement: |-
-    The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line, via the Splunk Add-on for Microsoft Windows. Ensure the Microsoft-Windows-Windows Defender/Operational channel is being collected so that EventCode 1116 (detection) and 1117 (remediation) events are ingested.
-known_false_positives: |-
-    No false positives have been identified at this time. Legitimate Defender scans do not report detections against paths resolved through the NT object manager namespace.
+search: |
+    `ms_defender` EventCode=1116 EventCode="1117" Path="*\\globalroot\\*" | eval dest=dvc | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Path | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_defender_threat_detected_on_kernel_object_path_filter`
+how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line, via the Splunk Add-on for Microsoft Windows. Ensure the Microsoft-Windows-Windows Defender/Operational channel is being collected so that EventCode 1116 (detection) and 1117 (remediation) events are ingested.
+known_false_positives: No false positives have been identified at this time. Legitimate Defender scans do not report detections against paths resolved through the NT object manager namespace.
 references:
     - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day
     - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet
@@ -45,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender reported a detection on a kernel object path $Path$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_delete_or_modify_system_firewall.yml b/detections/endpoint/windows_delete_or_modify_system_firewall.yml
index 090f36aa14e..a9b30868f15 100644
--- a/detections/endpoint/windows_delete_or_modify_system_firewall.yml
+++ b/detections/endpoint/windows_delete_or_modify_system_firewall.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_netsh` Processes.process = "* firewall *" Processes.process = "* del*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_delete_or_modify_system_firewall_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*netsh.exe" OR Processes.original_file_name="netsh.exe" Processes.process="* firewall *" Processes.process="* del*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_delete_or_modify_system_firewall_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator may modify or delete firewall configuration.
 references:
diff --git a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml
index 41b1fb68c49..85be75d56e2 100644
--- a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml
+++ b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the deletion of registry keys by non-critical processes. It leverages Endpoint Detection and Response (EDR) data, focusing on registry deletion events and correlating them with processes not typically associated with system or program files. This activity is significant as it may indicate malware, such as the Double Zero wiper, attempting to evade defenses or cause destructive payload impacts. If confirmed malicious, this behavior could lead to significant system damage, loss of critical configurations, and potential disruption of services.
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 12
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry WHERE Registry.action=deleted BY _time span=1h Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes WHERE NOT (Processes.process_path IN ("*\\windows\\*", "*\\program files*")) by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`] | fields _time parent_process_name parent_process process_name process_path process process_guid registry_path registry_value_name registry_value_data registry_key_name action dest user | `windows_deleted_registry_by_a_non_critical_process_file_path_filter`'
+search: |
+    | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry WHERE Registry.action=deleted BY _time span=1h Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes WHERE NOT (Processes.process_path IN ("*\\windows\\*", "*\\program files*")) by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`] | fields _time parent_process_name parent_process process_name process_path process process_guid registry_path registry_value_name registry_value_data registry_key_name action dest user | `windows_deleted_registry_by_a_non_critical_process_file_path_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: This detection can catch for third party application updates or installation. In this scenario false positive filter is needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_detect_network_scanner_behavior.yml b/detections/endpoint/windows_detect_network_scanner_behavior.yml
index f085bd2bf57..290ded017ce 100644
--- a/detections/endpoint/windows_detect_network_scanner_behavior.yml
+++ b/detections/endpoint/windows_detect_network_scanner_behavior.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects when an application is used to connect a large number of unique ports/targets within a short time frame. Network enumeration may be used by adversaries as a method of discovery, lateral movement, or remote execution. This analytic may require significant tuning depending on the organization and applications being actively used, highly recommended to pre-populate the filter macro prior to activation.
 data_source:
     - Sysmon EventID 3
-search: '| tstats `security_content_summariesonly` count values(All_Traffic.action) as action values(All_Traffic.dest) as dest values(All_Traffic.dest_port) as dest_port values(All_Traffic.dest_ip) as dest_ip values(All_Traffic.dvc) as dvc values(All_Traffic.direction) as direction values(All_Traffic.protocol) as protocol values(All_Traffic.protocol_version) as protocol_version values(All_Traffic.src_port) as src_port values(All_Traffic.transport) as transport dc(All_Traffic.dest_port) as port_count dc(All_Traffic.dest) as dest_count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.process_id) as process_id from datamodel=Network_Traffic.All_Traffic where sourcetype=XmlWinEventLog All_Traffic.app = "*\\*" All_Traffic.dest_port < 32000 NOT All_Traffic.dest_port IN (8443,8080,5353,3268,443,389,88,80,53,25) by All_Traffic.app All_Traffic.src All_Traffic.src_ip All_Traffic.user All_Traffic.vendor_product _time span=5m | `drop_dm_object_name(All_Traffic)` | rex field=app ".*\\\(?<process_name>.*)$" | where port_count > 10 OR dest_count > 10 | stats latest(src) as src, latest(src_ip) as src_ip, max(dest_count) as dest_count, max(port_count) as port_count, latest(dest_port) as dest_port, min(firstTime) as firstTime, max(lastTime) as lastTime, max(count) as count by user,app,process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_detect_network_scanner_behavior_filter`'
+search: |
+    | tstats `security_content_summariesonly` count values(All_Traffic.action) as action values(All_Traffic.dest) as dest values(All_Traffic.dest_port) as dest_port values(All_Traffic.dest_ip) as dest_ip values(All_Traffic.dvc) as dvc values(All_Traffic.direction) as direction values(All_Traffic.protocol) as protocol values(All_Traffic.protocol_version) as protocol_version values(All_Traffic.src_port) as src_port values(All_Traffic.transport) as transport dc(All_Traffic.dest_port) as port_count dc(All_Traffic.dest) as dest_count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.process_id) as process_id from datamodel=Network_Traffic.All_Traffic where sourcetype=XmlWinEventLog All_Traffic.app = "*\\*" All_Traffic.dest_port < 32000 NOT All_Traffic.dest_port IN (8443,8080,5353,3268,443,389,88,80,53,25) by All_Traffic.app All_Traffic.src All_Traffic.src_ip All_Traffic.user All_Traffic.vendor_product _time span=5m | `drop_dm_object_name(All_Traffic)` | rex field=app ".*\\\(?<process_name>.*)$" | where port_count > 10 OR dest_count > 10 | stats latest(src) as src, latest(src_ip) as src_ip, max(dest_count) as dest_count, max(port_count) as port_count, latest(dest_port) as dest_port, min(firstTime) as firstTime, max(lastTime) as lastTime, max(count) as count by user,app,process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_detect_network_scanner_behavior_filter`
 how_to_implement: This detection relies on Sysmon EventID 3 events being ingested AND tagged into the Network_Traffic datamodel.
 known_false_positives: Various, could be noisy depending on processes in the organization and sysmon configuration used. Adjusted port/dest count thresholds as needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/windows_developer_signed_msix_package_installation.yml b/detections/endpoint/windows_developer_signed_msix_package_installation.yml
index 33a4f15b9d8..f75107e737d 100644
--- a/detections/endpoint/windows_developer_signed_msix_package_installation.yml
+++ b/detections/endpoint/windows_developer_signed_msix_package_installation.yml
@@ -9,14 +9,8 @@ type: Anomaly
 description: This detection identifies the installation of developer-signed MSIX packages that lack Microsoft Store signatures. All malicious MSIX packages observed in recent threat campaigns (including those from FIN7, Zloader/Storm-0569, and FakeBat/Storm-1113) were developer-signed rather than Microsoft Store signed. Microsoft Store apps have specific publisher IDs containing '8wekyb3d8bbwe' or 'cw5n1h2txyewy', while developer-signed packages lack these identifiers. This detection focuses on EventID 855 from the Microsoft-Windows-AppXDeployment-Server/Operational logs, which indicates a completed package installation.
 data_source:
     - Windows Event Log AppXDeployment-Server 855
-search: |-
-    `wineventlog_appxdeploymentserver` EventCode=855 NOT PackageMoniker IN ("*8wekyb3d8bbwe*","*cw5n1h2txyewy*")
-      | stats count min(_time) as firstTime max(_time) as lastTime values(PackageMoniker) as PackageMoniker
-        BY dvc EventCode user_id
-      | rename dvc as dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_developer_signed_msix_package_installation_filter`
+search: |
+    `wineventlog_appxdeploymentserver` EventCode="855" NOT (PackageMoniker IN ("*8wekyb3d8bbwe*", "*cw5n1h2txyewy*")) | eval file_name=Path, CallingProcess=CallingProcess | stats count min(_time) as firstTime max(_time) as lastTime by _time dest dvc EventCode user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_developer_signed_msix_package_installation_filter`
 how_to_implement: To implement this detection, you need to be collecting Windows Event logs from the Microsoft-Windows-AppXDeploymentServer/Operational channel. In Splunk, this typically requires the Windows TA and configuration to collect from this specific channel. Ensure your Windows event collection is properly configured to capture EventCode 855 from the Microsoft-Windows-AppXDeploymentServer/Operational log.
 known_false_positives: Legitimate developer-signed applications that are not from the Microsoft Store will trigger this detection. Organizations should maintain a baseline of expected developer-signed applications in their environment and tune the detection accordingly. Common legitimate developer-signed applications include in-house developed applications and some third-party applications that are not distributed through the Microsoft Store.
 references:
@@ -32,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -58,6 +52,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/appx/windows_appxdeploymentserver.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_devtunnels_execution.yml b/detections/endpoint/windows_devtunnels_execution.yml
index 5de1aff9741..3bf086043cc 100644
--- a/detections/endpoint/windows_devtunnels_execution.yml
+++ b/detections/endpoint/windows_devtunnels_execution.yml
@@ -6,37 +6,19 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects the execution of Microsoft devtunnels.exe.
+description: 'Detects the execution of Microsoft devtunnels.exe.
+
     Microsoft Devtunnels is a feature within Visual Studio that allows developers to expose their local development environment to the internet via secure, temporary tunnels, enabling external access for testing webhooks, APIs, and other services.
+
     While designed for legitimate development purposes, an attacker could exploit this feature to expose a compromised system or service to the internet, creating a covert communication channel that bypasses network security measures.
-    By using Dev Tunnels, the attacker can establish a remote connection to the compromised environment, facilitate data exfiltration, or maintain command-and-control communications while avoiding detection by blending their activities with legitimate development traffic.
+
+    By using Dev Tunnels, the attacker can establish a remote connection to the compromised environment, facilitate data exfiltration, or maintain command-and-control communications while avoiding detection by blending their activities with legitimate development traffic.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.original_file_name="devtunnel.dll"
-    OR
-    Processes.process_name="devtunnel.exe"
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_devtunnels_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.original_file_name="devtunnel.dll" OR Processes.process_name="*devtunnel.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_devtunnels_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate developers may use Microsoft Devtunnels for testing and debugging their applications. Filter alerts for approved development environments and users.
 references:
@@ -49,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_devtunnels_image_loaded.yml b/detections/endpoint/windows_devtunnels_image_loaded.yml
index 9b4baa39ea6..96b5c163410 100644
--- a/detections/endpoint/windows_devtunnels_image_loaded.yml
+++ b/detections/endpoint/windows_devtunnels_image_loaded.yml
@@ -6,29 +6,17 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects image load events associated with Microsoft Devtunnels usage.
+description: 'Detects image load events associated with Microsoft Devtunnels usage.
+
     Microsoft Devtunnels is a feature within Visual Studio that allows developers to expose their local development environment to the internet via secure, temporary tunnels, enabling external access for testing webhooks, APIs, and other services.
+
     While designed for legitimate development purposes, an attacker could exploit this feature to expose a compromised system or service to the internet, creating a covert communication channel that bypasses network security measures.
-    By using Dev Tunnels, the attacker can establish a remote connection to the compromised environment, facilitate data exfiltration, or maintain command-and-control communications while avoiding detection by blending their activities with legitimate development traffic.
+
+    By using Dev Tunnels, the attacker can establish a remote connection to the compromised environment, facilitate data exfiltration, or maintain command-and-control communications while avoiding detection by blending their activities with legitimate development traffic.'
 data_source:
     - Sysmon EventID 7
-search: |-
-    `sysmon`
-    EventID=7
-    ImageLoaded="*\\AppData\\Local\\Temp\\.net\\devtunnel\\*"
-    ImageLoaded="*devtunnel.dll"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer ImageLoaded EventID loaded_file loaded_file_path process_exec process_guid
-         process_hash process_id process_name process_path service_dll_signature_exists
-         service_dll_signature_verified signature_id user_id vendor_product
-
-    | rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_devtunnels_image_loaded_filter`
+search: |
+    `sysmon` EventCode=7 ImageLoaded="*\\AppData\\Local\\Temp\\.net\\devtunnel\\*" ImageLoaded="*devtunnel.dll" | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_devtunnels_image_loaded_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate developers using Microsoft Devtunnels for testing and debugging may trigger this detection. Filter alerts for approved development environments and personnel.
 references:
@@ -41,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_dir_piped_to_findstr_activity.yml b/detections/endpoint/windows_dir_piped_to_findstr_activity.yml
index 2fc39639ef1..e3246f2b4e4 100644
--- a/detections/endpoint/windows_dir_piped_to_findstr_activity.yml
+++ b/detections/endpoint/windows_dir_piped_to_findstr_activity.yml
@@ -6,41 +6,24 @@ modification_date: '2026-07-30'
 author: Raven Tait, Splunk
 status: production
 type: Hunting
-description: |-
-    The following analytic detects the execution of the `dir` command piped to `findstr` on Windows systems.
+description: 'The following analytic detects the execution of the `dir` command piped to `findstr` on Windows systems.
+
     This technique is commonly used by attackers during the reconnaissance phase to enumerate files, directories, or sensitive data by filtering directory listings for specific strings or patterns.
+
     While this command combination can have legitimate administrative uses, adversaries frequently leverage it to locate credentials, configuration files, or other high-value targets on a compromised system.
-    If confirmed malicious, this activity could indicate an attacker is actively mapping the file system in preparation for data exfiltration, lateral movement, or further exploitation.
+
+    If confirmed malicious, this activity could indicate an attacker is actively mapping the file system in preparation for data exfiltration, lateral movement, or further exploitation.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-       count min(_time) as firstTime
-             max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*dir *|*findstr *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dir_piped_to_findstr_activity_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: 'Legitimate administrative tasks and scripts may use `dir` piped to `findstr` for routine file searches.
 
-    Processes.process="*dir *|*findstr *"
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name
-       Processes.parent_process Processes.parent_process_path Processes.parent_process_guid
-       Processes.parent_process_id Processes.process_guid
-       Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_dir_piped_to_findstr_activity_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate administrative tasks and scripts may use `dir` piped to `findstr` for routine file searches.
-    Filter based on known user behavior and approved administrative activity.
+    Filter based on known user behavior and approved administrative activity.'
+references: []
 analytic_story:
     - Suspicious Command-Line Executions
     - Windows Discovery Techniques
@@ -56,8 +39,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack_windows.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
+      test_type: unit
diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml
index fa335865bff..c7ad146047d 100644
--- a/detections/endpoint/windows_disable_change_password_through_registry.yml
+++ b/detections/endpoint/windows_disable_change_password_through_registry.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects a suspicious registry modification that disables the Change Password feature on a Windows host. It identifies changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" with a value of "0x00000001". This activity is significant as it can prevent users from changing their passwords, a tactic often used by ransomware to maintain control over compromised systems. If confirmed malicious, this could hinder user response to an attack, allowing the attacker to persist and potentially escalate their access within the network.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_change_password_through_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_change_password_through_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_disable_internet_explorer_addons.yml b/detections/endpoint/windows_disable_internet_explorer_addons.yml
index e40983f3e32..3e2ffb854a0 100644
--- a/detections/endpoint/windows_disable_internet_explorer_addons.yml
+++ b/detections/endpoint/windows_disable_internet_explorer_addons.yml
@@ -6,27 +6,15 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the execution of iexplore.exe (Internet Explorer) with the -extoff command-line flag, which disables all browser extensions. This flag is commonly abused by adversaries to launch a clean browser session that bypasses security controls such as antivirus browser extensions, toolbars, or group policy-enforced add-ons.
-    Malicious documents or scripts may leverage iexplore.exe -extoff to open phishing pages, command-and-control interfaces, or download additional payloads in an environment free from security monitoring plugins. While this flag may be used legitimately by IT administrators for troubleshooting purposes, its use in modern enterprise environments is rare and should be considered suspicious—particularly when launched by Office applications, scripting engines (e.g., PowerShell, WScript), or scheduled tasks.
+description: 'The following analytic detects the execution of iexplore.exe (Internet Explorer) with the -extoff command-line flag, which disables all browser extensions. This flag is commonly abused by adversaries to launch a clean browser session that bypasses security controls such as antivirus browser extensions, toolbars, or group policy-enforced add-ons.
+
+    Malicious documents or scripts may leverage iexplore.exe -extoff to open phishing pages, command-and-control interfaces, or download additional payloads in an environment free from security monitoring plugins. While this flag may be used legitimately by IT administrators for troubleshooting purposes, its use in modern enterprise environments is rare and should be considered suspicious—particularly when launched by Office applications, scripting engines (e.g., PowerShell, WScript), or scheduled tasks.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    (Processes.process_name = "iexplore.exe" OR Processes.original_file_name="IEXPLORE.EXE")
-    Processes.process = "*-extoff*"
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_disable_internet_explorer_addons_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*iexplore.exe" OR Processes.original_file_name="IEXPLORE.EXE" Processes.process="*-extoff*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_internet_explorer_addons_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml
index 39eb28b1dee..0f74944c7b0 100644
--- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml
+++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects a suspicious registry modification that disables the Lock Computer feature in Windows. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" with a value of "0x00000001". This activity is significant because it prevents users from locking their screens, a tactic often used by malware, including ransomware, to maintain control over compromised systems. If confirmed malicious, this could allow attackers to sustain their presence and execute further malicious actions without user interruption.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_lock_workstation_feature_through_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_lock_workstation_feature_through_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml
index 160d9a97553..512c0bd0b1e 100644
--- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml
+++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects a suspicious registry modification that disables the logoff feature on a Windows host. It leverages data from the Endpoint.Registry data model to identify changes to specific registry values associated with logoff functionality. This activity is significant because it can indicate ransomware attempting to make the compromised host unusable and hinder remediation efforts. If confirmed malicious, this action could prevent users from logging off, complicate incident response, and allow attackers to maintain persistence and control over the affected system.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_logoff_button_through_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("*NoLogOff", "*StartMenuLogOff") Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_logoff_button_through_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml
index a47b49b11b7..8eaec809d84 100644
--- a/detections/endpoint/windows_disable_memory_crash_dump.yml
+++ b/detections/endpoint/windows_disable_memory_crash_dump.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects attempts to disable the memory crash dump feature on Windows systems by setting the registry value to 0. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the CrashDumpEnabled registry key. This activity is significant because disabling crash dumps can hinder forensic analysis and incident response efforts. If confirmed malicious, this action could be part of a broader attack strategy, such as data destruction or system destabilization, as seen with HermeticWiper, potentially leading to significant operational disruptions and data loss.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled") AND Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_memory_crash_dump_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_memory_crash_dump_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry` node.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process was identified attempting to disable memory crash dumps on $dest$.
     entity:
diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml
index 22cc088717b..7f69387b80a 100644
--- a/detections/endpoint/windows_disable_notification_center.yml
+++ b/detections/endpoint/windows_disable_notification_center.yml
@@ -9,21 +9,8 @@ type: Anomaly
 description: The following analytic detects the modification of the Windows registry to disable the Notification Center on a host machine. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the "DisableNotificationCenter" registry value set to "0x00000001." This activity is significant because disabling the Notification Center can be a tactic used by RAT malware to hide its presence and subsequent actions. If confirmed malicious, this could allow an attacker to operate stealthily, potentially leading to further system compromise and data exfiltration.
 data_source:
     - Sysmon EventID 13
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
-      WHERE (
-            Registry.registry_value_name= "DisableNotificationCenter" Registry.registry_value_data = "0x00000001"
-        )
-      BY Registry.action Registry.dest Registry.process_guid
-         Registry.process_id Registry.registry_hive Registry.registry_path
-         Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
-         Registry.registry_value_type Registry.status Registry.user
-         Registry.vendor_product
-    | `drop_dm_object_name(Registry)`
-    | where isnotnull(registry_value_data)
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_disable_notification_center_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_name="*DisableNotificationCenter" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_notification_center_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: admin or user may choose to disable this windows features.
 references:
@@ -37,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml
index b204fb00181..aeeb6c0137d 100644
--- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml
+++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "taskkill.exe" Processes.process IN ("* /f*", "* /t*") Processes.process IN ("* /im*", "* /pid*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_disable_or_modify_tools_via_taskkill_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*taskkill.exe" Processes.process IN ("* /f*", "* /t*") Processes.process IN ("* /im*", "* /pid*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_or_modify_tools_via_taskkill_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Network administrator can use this application to kill process during audit or investigation.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_disable_or_stop_browser_process.yml b/detections/endpoint/windows_disable_or_stop_browser_process.yml
index 354d3e7a7d7..0bc8ea08ed8 100644
--- a/detections/endpoint/windows_disable_or_stop_browser_process.yml
+++ b/detections/endpoint/windows_disable_or_stop_browser_process.yml
@@ -9,20 +9,8 @@ type: TTP
 description: The following analytic detects the use of the taskkill command in a process command line to terminate several known browser processes, a technique commonly employed by the Braodo stealer malware to steal credentials. By forcefully closing browsers like Chrome, Edge, and Firefox, the malware can unlock files that store sensitive information, such as passwords and login data. This detection focuses on identifying taskkill commands targeting these browsers, signaling malicious intent. Early detection allows security teams to investigate and prevent further credential theft and system compromise.
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process = "*taskkill*" Processes.process IN("*chrome.exe","*firefox.exe","*brave.exe","*opera.exe","*msedge.exe","*chromium.exe")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_disable_or_stop_browser_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*taskkill*" Processes.process IN ("*chrome.exe", "*firefox.exe", "*brave.exe", "*opera.exe", "*msedge.exe", "*chromium.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_or_stop_browser_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Admin or user may choose to terminate browser via taskkill.exe. Filter as needed.
 references:
@@ -36,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process commandline- [$process$] that tries to kill browser on [$dest$].
     entity:
diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml
index a9d21b8e66e..edb6431834e 100644
--- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml
+++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml
@@ -6,49 +6,23 @@ modification_date: '2026-10-02'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects suspicious registry modifications that disable the shutdown button on a user's logon screen.
+description: 'The following analytic detects suspicious registry modifications that disable the shutdown button on a user''s logon screen.
+
     It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with shutdown policies.
+
     This activity is significant because it is a tactic used by malware, particularly ransomware like KillDisk, to hinder system usability and prevent the removal of malicious changes.
-    If confirmed malicious, this could impede system recovery efforts, making it difficult to restart the machine and remove other harmful modifications.
+
+    If confirmed malicious, this could impede system recovery efforts, making it difficult to restart the machine and remove other harmful modifications.'
 data_source:
     - Sysmon EventID 13
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Registry WHERE
-
-    (
-        (
-        Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon"
-        Registry.registry_value_data = "0x00000000"
-        )
-    OR
-        (
-            Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose"
-            Registry.registry_value_data = "0x00000001"
-        )
-    )
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" Registry.registry_value_data="0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" Registry.registry_value_data="0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_shutdown_button_through_registry_filter`
+how_to_implement: 'To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints.
 
-    by Registry.action Registry.dest Registry.process_guid Registry.process_id
-       Registry.registry_hive Registry.registry_path Registry.registry_key_name
-       Registry.registry_value_data Registry.registry_value_name
-       Registry.registry_value_type Registry.status
-       Registry.user Registry.vendor_product
+    If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709'
+known_false_positives: 'This Windows feature may be implemented by an administrator on some servers where shutdown is restricted.
 
-    | `drop_dm_object_name(Registry)`
-    | where isnotnull(registry_value_data)
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_disable_shutdown_button_through_registry_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints.
-    If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
-known_false_positives: |-
-    This Windows feature may be implemented by an administrator on some servers where shutdown is restricted.
-    In that scenario, filtering by the machines and users allowed to modify this registry key is recommended.
+    In that scenario, filtering by the machines and users allowed to modify this registry key is recommended.'
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/1ba1dd8d9ce6f74700f7aec2e60de5632f667f03/atomics/T1112/T1112.md
     - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L230
@@ -60,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
index cc5b1ad88fc..14f75a63ec9 100644
--- a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
+++ b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE NOT (Processes.parent_process_name  IN ("msiexec.exe", "iissetup.exe")) Processes.process_name=appcmd.exe Processes.process IN ("*httplogging*","*dontlog:true*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_disable_windows_event_logging_disable_http_logging_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT (Processes.parent_process_name IN ("*msiexec.exe", "*iissetup.exe")) Processes.process_name="*appcmd.exe" Processes.process IN ("*httplogging*", "*dontlog:true*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_windows_event_logging_disable_http_logging_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present only if scripts or Administrators are disabling logging. Filter as needed by parent process or other.
 references:
@@ -41,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml
index e39c448c01b..e751e29a98e 100644
--- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml
+++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious registry modifications aimed at disabling Windows Group Policy features. It leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values associated with disabling key Windows functionalities. This activity is significant because it is commonly used by ransomware to hinder mitigation and forensic response efforts. If confirmed malicious, this behavior could severely impair the ability of security teams to analyze and respond to the attack, allowing the attacker to maintain control and persist within the compromised environment.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_windows_group_policy_features_through_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("*NoDesktop", "*NoFind", "*NoControlPanel", "*NoFileMenu", "*NoSetTaskbar", "*NoTrayContextMenu", "*TaskbarLockAll", "*NoThemesTab", "*NoPropertiesMyDocuments", "*NoVisualStyleChoice", "*NoColorChoice") Registry.registry_value_data="0x00000001") OR Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_windows_group_policy_features_through_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: Disabling these features for legitimate purposes is not a common use case but can still be implemented by the administrators. Filter as needed.
 references:
@@ -31,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_disableantispyware_registry.yml b/detections/endpoint/windows_disableantispyware_registry.yml
index 7bc79a33f8c..c4f2c192209 100644
--- a/detections/endpoint/windows_disableantispyware_registry.yml
+++ b/detections/endpoint/windows_disableantispyware_registry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the modification of the Windows Registry key "DisableAntiSpyware" being set to disable. This detection leverages data from the Endpoint.Registry datamodel, specifically looking for the registry value name "DisableAntiSpyware" with a value of "0x00000001". This activity is significant as it is commonly associated with Ryuk ransomware infections, indicating potential malicious intent to disable Windows Defender. If confirmed malicious, this action could allow attackers to disable critical security defenses, facilitating further malicious activities such as data encryption, exfiltration, or additional system compromise.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_value_name="DisableAntiSpyware" AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_name="*DisableAntiSpyware" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disableantispyware_registry_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows DisableAntiSpyware registry key set to 'disabled' on $dest$
     entity:
diff --git a/detections/endpoint/windows_diskcryptor_usage.yml b/detections/endpoint/windows_diskcryptor_usage.yml
index 6650d522add..c51a617ba61 100644
--- a/detections/endpoint/windows_diskcryptor_usage.yml
+++ b/detections/endpoint/windows_diskcryptor_usage.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="dcrypt.exe"
-            OR
-            Processes.original_file_name=dcinst.exe
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_diskcryptor_usage_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*dcrypt.exe" OR Processes.original_file_name="dcinst.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_diskcryptor_usage_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: It is possible false positives may be present based on the internal name dcinst.exe, filter as needed. It may be worthy to alert on the service name.
 references:
diff --git a/detections/endpoint/windows_diskshadow_proxy_execution.yml b/detections/endpoint/windows_diskshadow_proxy_execution.yml
index 87bb2f03e80..59c3be52323 100644
--- a/detections/endpoint/windows_diskshadow_proxy_execution.yml
+++ b/detections/endpoint/windows_diskshadow_proxy_execution.yml
@@ -12,19 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    (Processes.process_name=diskshadow.exe OR Processes.original_file_name=diskshadow.exe)
-    Processes.process IN (*-s*, */s*)
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
-       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
-       Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_diskshadow_proxy_execution_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*diskshadow.exe" OR Processes.original_file_name="diskshadow.exe" Processes.process IN ("*-s*", "*/s*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_diskshadow_proxy_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators using the DiskShadow tool in their infrastructure as a main backup tool with scripts will cause false positives that can be filtered with `windows_diskshadow_proxy_execution_filter`
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible Signed Binary Proxy Execution on $dest$
     entity:
diff --git a/detections/endpoint/windows_dism_install_powershell_web_access.yml b/detections/endpoint/windows_dism_install_powershell_web_access.yml
index 34ba244c0f2..2c0aecb429a 100644
--- a/detections/endpoint/windows_dism_install_powershell_web_access.yml
+++ b/detections/endpoint/windows_dism_install_powershell_web_access.yml
@@ -10,24 +10,8 @@ description: The following analytic detects the installation of PowerShell Web A
 data_source:
     - Windows Event Log Security 4688
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=dism.exe (Processes.process="*WindowsPowerShellWebAccess*"
-        AND
-        Processes.process="*/online*"
-        AND
-        Processes.process="*/enable-feature*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_dism_install_powershell_web_access_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*dism.exe" Processes.process="*WindowsPowerShellWebAccess*" Processes.process="*/online*" Processes.process="*/enable-feature*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dism_install_powershell_web_access_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators using the DISM tool to update and install Windows features may cause false positives that can be filtered with `windows_dism_install_powershell_web_access_filter`.
 references:
@@ -41,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: PowerShell Web Access has been installed on $dest$.
     entity:
@@ -63,6 +47,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/dism_pswa_4688_windows-security.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Security
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml
index b0f9bd96ab0..2d3bea706bd 100644
--- a/detections/endpoint/windows_dism_remove_defender.yml
+++ b/detections/endpoint/windows_dism_remove_defender.yml
@@ -11,26 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=dism.exe (Processes.process="*/online*"
-        AND
-        Processes.process="*/disable-feature*"
-        AND
-        Processes.process="*Windows-Defender*"
-        AND
-        Processes.process="*/remove*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_dism_remove_defender_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*dism.exe" Processes.process="*/online*" Processes.process="*/disable-feature*" Processes.process="*Windows-Defender*" Processes.process="*/remove*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dism_remove_defender_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate administrative tools leverage `dism.exe` to manipulate packages and features of the operating system. Filter as needed.
 references:
@@ -44,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable Windows Defender.
     entity:
diff --git a/detections/endpoint/windows_dll_module_loaded_in_temp_dir.yml b/detections/endpoint/windows_dll_module_loaded_in_temp_dir.yml
index 2866d40b23d..f5f10d7fabf 100644
--- a/detections/endpoint/windows_dll_module_loaded_in_temp_dir.yml
+++ b/detections/endpoint/windows_dll_module_loaded_in_temp_dir.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects instances where a Dynamic Link Library (DLL) is loaded from a temporary directory on a Windows system. Loading DLLs from non-standard paths such as %TEMP% is uncommon for legitimate applications and is often associated with adversary tradecraft, including DLL search order hijacking, side-loading, or execution of malicious payloads staged in temporary folders. Adversaries frequently leverage these directories because they are writable by standard users and often overlooked by security controls, making them convenient locations to drop and execute malicious files. This behavior may indicate attempts to evade detection, execute unauthorized code, or maintain persistence through hijacked execution flows. Detection of DLL loads from %TEMP% can help surface early signs of compromise and should be investigated in the context of the originating process, user account, and potential file creation or modification activity within the same directory.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7 NOT (ImageLoaded IN("C:\\Program Files*")) AND ImageLoaded="*\\temp\\*" AND ImageLoaded="*.dll" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_module_loaded_in_temp_dir_filter`'
+search: |
+    `sysmon` EventCode=7 NOT ImageLoaded="C:\\Program Files*" ImageLoaded="*\\temp\\*" ImageLoaded="*.dll" | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_module_loaded_in_temp_dir_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
index 21e2d8dc1d2..3d104f49ed1 100644
--- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
+++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic identifies potential DLL search order hijacking or DLL sideloading by detecting known Windows libraries loaded from non-standard directories. It leverages Sysmon EventCode 7 to monitor DLL loads and cross-references them with a lookup of known hijackable libraries. This activity is significant as it may indicate an attempt to execute malicious code by exploiting DLL search order vulnerabilities. If confirmed malicious, this could allow attackers to gain code execution, escalate privileges, or maintain persistence within the environment.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*")) | lookup local=t hijacklibs library AS loaded_file OUTPUT islibrary | search islibrary = True | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`'
+search: |
+    `sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*")) | lookup local=t hijacklibs library AS loaded_file OUTPUT islibrary | search islibrary = True | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`
 how_to_implement: The search is written against the latest Sysmon TA 4.0 https://splunkbase.splunk.com/app/5709. For this specific event ID 7, the sysmon TA will extract the ImageLoaded name to the loaded_file field which is used in the search to compare against the hijacklibs lookup.
 known_false_positives: False positives will be present based on paths. Filter or add other paths to the exclusion as needed. Some applications may legitimately load libraries from non-standard paths.
 references:
diff --git a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml
index f6a4eb6febd..f628e98b32d 100644
--- a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml
+++ b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=iscsicpl.exe `windows_shells`
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_dll_search_order_hijacking_with_iscsicpl_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*iscsicpl.exe" Processes.process_name IN ("*cmd.exe", "*powershell.exe", "*powershell_ise.exe", "*pwsh.exe", "*sh.exe", "*bash.exe", "*wscript.exe", "*cscript.exe", "*wt.exe", "*WindowsTerminal.exe", "*mshta.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_search_order_hijacking_with_iscsicpl_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filtering may be required. Remove the Windows Shells macro to determine if other utilities are using iscsicpl.exe.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to elevate access.
     entity:
diff --git a/detections/endpoint/windows_dll_side_loading_in_calc.yml b/detections/endpoint/windows_dll_side_loading_in_calc.yml
index bfcc2d33430..ff2dca47d82 100644
--- a/detections/endpoint/windows_dll_side_loading_in_calc.yml
+++ b/detections/endpoint/windows_dll_side_loading_in_calc.yml
@@ -10,24 +10,7 @@ description: The following analytic detects the loading of the "WindowsCodecs.dl
 data_source:
     - Sysmon EventID 7
 search: |
-    `sysmon`
-    EventCode=7
-    Image="*\\calc.exe"
-    ImageLoaded="*\\WindowsCodecs.dll"
-    NOT Image IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*")
-    NOT ImageLoaded IN("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", "*:\\Windows\\WinSXS\\*")
-
-    | fillnull
-    | stats count min(_time) as firstTime max(_time) as lastTime
-
-    by Image ImageLoaded dest loaded_file loaded_file_path original_file_name
-       process_exec process_guid process_hash process_id process_name
-       process_path service_dll_signature_exists service_dll_signature_verified
-       signature signature_id user_id vendor_product
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_dll_side_loading_in_calc_filter`
+    `sysmon` EventCode=7 Image="*\\calc.exe" ImageLoaded="*\\WindowsCodecs.dll" NOT (Image IN ("*\\system32\\*", "*\\syswow64\\*")) NOT (ImageLoaded IN ("*\\system32\\*", "*\\syswow64\\*", "*:\\Windows\\WinSXS\\*")) | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_side_loading_in_calc_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -41,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The [ $Image$ ] process loaded the [ $ImageLoaded$ ] DLL from a non-standard location on [ $dest$ ]
     entity:
diff --git a/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml b/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml
index 26f3deafed1..b348971f301 100644
--- a/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml
+++ b/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml
@@ -12,23 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    from datamodel=Endpoint.Processes where
-        Processes.parent_process_name = "calc.exe"
-        Processes.process_name != "win32calc.exe"
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process
-       Processes.process_exec Processes.process_guid Processes.process_hash
-       Processes.process_id Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_dll_side_loading_process_child_of_calc_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*calc.exe" NOT Processes.process_name="*win32calc.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_side_loading_process_child_of_calc_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -42,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_dns_gather_network_info.yml b/detections/endpoint/windows_dns_gather_network_info.yml
index 715b516c9fe..304e1ab9731 100644
--- a/detections/endpoint/windows_dns_gather_network_info.yml
+++ b/detections/endpoint/windows_dns_gather_network_info.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "dnscmd.exe" Processes.process = "* /enumrecords *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_dns_gather_network_info_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*dnscmd.exe" Processes.process="* /enumrecords *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dns_gather_network_info_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network administrator can execute this command to enumerate DNS record. Filter or add other paths to the exclusion as needed.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml
index cc66fe2bfe0..7ec07d1418a 100644
--- a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml
+++ b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml
@@ -6,36 +6,21 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects a process located in a potentially suspicious location making DNS queries to known URL shortening services, specifically tinyurl.
+description: 'The following analytic detects a process located in a potentially suspicious location making DNS queries to known URL shortening services, specifically tinyurl.
+
     URL shorteners are frequently used by threat actors to obfuscate malicious destinations, including phishing pages, malware distribution sites, or command-and-control (C2) endpoints.
-    While tinyurl.com is a legitimate service, its use in enterprise environments—particularly by non-browser processes or scripts—should be considered suspicious, especially if correlated with subsequent outbound connections, file downloads, process file path or credential prompts. Analysts should investigate the source process, execution context, and destination domain to determine intent and risk.
+
+    While tinyurl.com is a legitimate service, its use in enterprise environments—particularly by non-browser processes or scripts—should be considered suspicious, especially if correlated with subsequent outbound connections, file downloads, process file path or credential prompts. Analysts should investigate the source process, execution context, and destination domain to determine intent and risk.'
 data_source:
     - Sysmon EventID 22
 search: |
-    `sysmon`
-    EventCode=22
-    QueryName = "tinyurl.com"
-    Image IN (
-      "*\\AppData\\*",
-      "*\\Perflogs\\*",
-      "*\\ProgramData\\*",
-      "*\\Temp\\*",
-      "*\\Users\\Public\\*",
-      "*\\Windows\\Tasks\\*"
-      )
-    | stats count min(_time) as firstTime max(_time) as lastTime
-      by answer answer_count dvc process_exec process_guid process_name query query_count
-         reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_dns_query_request_to_tinyurl_filter`
-how_to_implement: |
-    This detection relies on sysmon logs with the Event ID 22, DNS Query.
-    We suggest you run this detection at least once a day over the last 14 days.
-known_false_positives: |
-    Noise and false positive can be seen if the following instant
-    messaging is allowed to use within corporate network. In this case, a filter is needed.
+    `sysmon` EventCode=22 QueryName="tinyurl.com" Image IN ("*\\AppData\\*", "*\\Perflogs\\*", "*\\ProgramData\\*", "*\\Temp\\*", "*\\Users\\Public\\*", "*\\Windows\\Tasks\\*") | eval process_name=process_name, dvc=dvc, dest=Computer, QueryName=QueryName | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count query query_count reply_code_id src vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dns_query_request_to_tinyurl_filter`
+how_to_implement: 'This detection relies on sysmon logs with the Event ID 22, DNS Query.
+
+    We suggest you run this detection at least once a day over the last 14 days.'
+known_false_positives: 'Noise and false positive can be seen if the following instant
+
+    messaging is allowed to use within corporate network. In this case, a filter is needed.'
 references:
     - https://x.com/Unit42_Intel/status/1919418143476199869
 drilldown_searches:
@@ -46,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dvc
diff --git a/detections/endpoint/windows_dnsadmins_new_member_added.yml b/detections/endpoint/windows_dnsadmins_new_member_added.yml
index 4dbb05cc0c0..7400689d3db 100644
--- a/detections/endpoint/windows_dnsadmins_new_member_added.yml
+++ b/detections/endpoint/windows_dnsadmins_new_member_added.yml
@@ -9,13 +9,8 @@ type: TTP
 description: The following analytic detects the addition of a new member to the DnsAdmins group in Active Directory by leveraging Event ID 4732. This detection uses security event logs to identify changes to this high-privilege group. Monitoring this activity is crucial because members of the DnsAdmins group can manage the DNS service, often running on Domain Controllers, and potentially execute malicious code with SYSTEM privileges. If confirmed malicious, this activity could allow an attacker to escalate privileges and gain control over critical domain services, posing a significant security risk.
 data_source:
     - Windows Event Log Security 4732
-search: |-
-    `wineventlog_security` EventCode=4732 TargetUserName=DnsAdmins
-      | stats min(_time) as firstTime max(_time) as lastTime values(TargetUserName) as target_users_added values(user) as user
-        BY dest src_user
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_dnsadmins_new_member_added_filter`
+search: |
+    `wineventlog_security` EventCode=4732 TargetUserName="DnsAdmins" | eval src_user=src_user, user=user | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dnsadmins_new_member_added_filter`
 how_to_implement: To successfully implement this search, Domain Controller events need to be ingested. The Advanced Security Audit policy setting `Audit Security Group Management` within `Account Management` needs to be enabled.
 known_false_positives: New members can be added to the DnsAdmins group as part of legitimate administrative tasks. Filter as needed.
 references:
@@ -31,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new member $user$ added to the DnsAdmins group by $src_user$
     entity:
diff --git a/detections/endpoint/windows_domain_account_discovery_via_get_netcomputer.yml b/detections/endpoint/windows_domain_account_discovery_via_get_netcomputer.yml
index 86a41775754..7f71fa939ec 100644
--- a/detections/endpoint/windows_domain_account_discovery_via_get_netcomputer.yml
+++ b/detections/endpoint/windows_domain_account_discovery_via_get_netcomputer.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of the PowerView PowerShell cmdlet Get-NetComputer, which is used to query Active Directory for user account details such as "samaccountname," "accountexpires," "lastlogon," and more. It leverages Event ID 4104 from PowerShell Script Block Logging to identify this activity. This behavior is significant as it may indicate an attempt to gather user account information, which is often a precursor to further malicious actions. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, or lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104  ScriptBlockText = "*Get-NetComputer*" ScriptBlockText IN ("*samaccountname*", "*accountexpires*", "*lastlogon*", "*lastlogoff*", "*pwdlastset*", "*logoncount*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_domain_account_discovery_via_get_netcomputer_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-NetComputer*" Processes.process IN ("*samaccountname*", "*accountexpires*", "*lastlogon*", "*lastlogoff*", "*pwdlastset*", "*logoncount*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_domain_account_discovery_via_get_netcomputer_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.=
 known_false_positives: Administrators may leverage PowerView for legitimate purposes, filter as needed.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml
index 5c0981bdc1f..3955d3a04bb 100644
--- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml
+++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies potential Kerberos ticket forging attacks, specifically the Diamond Ticket attack. This is detected when a user logs into a host and the GroupMembership field in event 4627 indicates a privileged group (e.g., Domain Admins), but the user does not actually belong to that group in the directory service. The detection leverages Windows Security Event Log 4627, which logs account logon events. The analytic cross-references the GroupMembership field from the event against a pre-populated lookup of actual group memberships. Its crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. Any discrepancies between the events GroupMembership and the lookup indicate potential ticket forging. Kerberos ticket forging, especially the Diamond Ticket attack, allows attackers to impersonate any user and potentially gain unauthorized access to resources. By forging a ticket that indicates membership in a privileged group, an attacker can bypass security controls and gain elevated privileges. Detecting such discrepancies in group memberships during logon events can be a strong indicator of this attack in progress, making it crucial for security teams to monitor and investigate. If validated as a true positive, this indicates that an attacker has successfully forged a Kerberos ticket and may have gained unauthorized access to critical resources, potentially with elevated privileges.
 data_source:
     - Windows Event Log Security 4627
-search: |-
+search: |
     `wineventlog_security` EventCode=4627 LogonType=3 NOT TargetUserName IN ("*$", "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*")
       | where match(GroupMembership, "Domain Admins")
       | stats count
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$TargetUserName$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$TargetUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $TargetUserName$ may be impersonating a Domain Administrator through a forged Kerberos ticket.
     entity:
diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
index fe022fd4bb9..2bd3d13341f 100644
--- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
+++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
@@ -6,12 +6,15 @@ modification_date: '2026-10-02'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects the execution of native .NET binaries from non-standard directories within the Windows operating system.
+description: 'The following analytic detects the execution of native .NET binaries from non-standard directories within the Windows operating system.
+
     It leverages Endpoint Detection and Response (EDR) telemetry, comparing process names and original file names against a predefined lookup "is_net_windows_file".
+
     This activity is significant because adversaries may move .NET binaries to unconventional paths to evade detection and execute malicious code.
+
     If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
-    Also this analytic leverages a sub-search to enhance performance. sub-searches have limitations on the amount of data they can return. Keep this in mind if you have an extensive list of ransomware note file names.
+
+    Also this analytic leverages a sub-search to enhance performance. sub-searches have limitations on the amount of data they can return. Keep this in mind if you have an extensive list of ransomware note file names.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
@@ -49,16 +52,23 @@ search: |
     | lookup local=t update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile
     | search netFile=true
     | `windows_dotnet_binary_in_non_standard_path_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
+
+    names and speed up the data modeling process.'
 known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
@@ -74,7 +84,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/windows_downdate_registry_activity.yml b/detections/endpoint/windows_downdate_registry_activity.yml
index d3f33e217a5..09962de2d75 100644
--- a/detections/endpoint/windows_downdate_registry_activity.yml
+++ b/detections/endpoint/windows_downdate_registry_activity.yml
@@ -6,38 +6,15 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects the setting of a pending.xml file associated with the Windows Downdate attack which forces a Windows downgrade to enable exploitation.
-    Looks for uses of a pending.xml outside of typical locations.
+description: 'Detects the setting of a pending.xml file associated with the Windows Downdate attack which forces a Windows downgrade to enable exploitation.
+
+    Looks for uses of a pending.xml outside of typical locations.'
 data_source:
     - Sysmon EventID 12
     - Sysmon EventID 13
     - Sysmon EventID 14
-search: |-
-    `sysmon`
-    EventID IN (
-        12,
-        13,
-        14
-    )
-    TargetObject IN (
-        "*PoqexecCmdline",
-        "*COMPONENTS\\PendingXmlIdentifier"
-    )
-    NOT ProcessPath="*:\\Windows\\WinSxS\\*"
-
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-
-      by EventID TargetObject ProcessPath Computer action process_guid process_id
-         registry_hive registry_path registry_key_name registry_value_data registry_value_name
-         status user vendor_product
-
-    | rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_downdate_registry_activity_filter`
+search: |
+    `sysmon` EventCode=13 EventID IN ("13", "14") TargetObject IN ("*PoqexecCmdline", "*COMPONENTS\\PendingXmlIdentifier") NOT ProcessPath="*:\\Windows\\WinSxS\\*" | eval registry_value_name=registry_value_name, object_handle=registry_value_data, registry_value_data_len=registry_value_data_len | stats count min(_time) as firstTime max(_time) as lastTime by action dest process_guid process_id registry_hive registry_path registry_key_name registry_value_data registry_value_name status user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_downdate_registry_activity_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate system updates or rollback processes may create or modify pending.xml files in non-standard locations. Verify with IT change management to reduce false alerts.
 references:
@@ -50,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_driver_inventory.yml b/detections/endpoint/windows_driver_inventory.yml
index 27ff9ddba7b..5c9b40ba4db 100644
--- a/detections/endpoint/windows_driver_inventory.yml
+++ b/detections/endpoint/windows_driver_inventory.yml
@@ -8,7 +8,7 @@ status: production
 type: Hunting
 description: The following analytic identifies drivers being loaded across the fleet. It leverages a PowerShell script input deployed to critical systems to capture driver data. This detection is significant as it helps monitor for unauthorized or malicious drivers that could compromise system integrity. If confirmed malicious, such drivers could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
 data_source: []
-search: |-
+search: |
     `driverinventory`
       | stats values(Path) min(_time) as firstTime max(_time) as lastTime count
         BY host DriverType
diff --git a/detections/endpoint/windows_driver_load_non_standard_path.yml b/detections/endpoint/windows_driver_load_non_standard_path.yml
index 61fa8b274ff..f5fb501f4a3 100644
--- a/detections/endpoint/windows_driver_load_non_standard_path.yml
+++ b/detections/endpoint/windows_driver_load_non_standard_path.yml
@@ -9,23 +9,16 @@ type: TTP
 description: The following analytic detects the loading of new Kernel Mode Drivers from non-standard paths using Windows EventCode 7045. It identifies drivers not located in typical directories like Windows, Program Files, or SystemRoot. This activity is significant because adversaries may use these non-standard paths to load malicious or vulnerable drivers, potentially bypassing security controls. If confirmed malicious, this could allow attackers to execute code at the kernel level, escalate privileges, or maintain persistence within the environment, posing a severe threat to system integrity and security.
 data_source:
     - Windows Event Log System 7045
-search: >-
-    `wineventlog_system`
-    EventCode = 7045
-    ServiceType = "kernel mode driver"
-    | regex ImagePath != "(?i)^(\w:\\\\Program Files\\\\|\w:\\\\Program Files \(x86\)\\\\|\w:\\\\Windows\\\\System32\\\\|\w:\\\\Windows\\\\SysWOW64\\\\|\w:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Definition Updates\\\\|\w:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\|%SystemRoot%|\\\\SystemRoot\\\\|SystemRoot\\\\)"
-    | stats count min(_time) as firstTime max(_time) as lastTime by
+search: |
+    `wineventlog_system` EventCode = 7045 ServiceType = "kernel mode driver" | regex ImagePath != "(?i)^(\w:\\\\Program Files\\\\|\w:\\\\Program Files \(x86\)\\\\|\w:\\\\Windows\\\\System32\\\\|\w:\\\\Windows\\\\SysWOW64\\\\|\w:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Definition Updates\\\\|\w:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\|%SystemRoot%|\\\\SystemRoot\\\\|SystemRoot\\\\)" | stats count min(_time) as firstTime max(_time) as lastTime by
       Computer EventCode ImagePath ServiceName ServiceType
-    | rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_driver_load_non_standard_path_filter`
-how_to_implement: |
-    To implement this analytic, the Windows EventCode 7045 will need to be logged.
-    The Windows TA for Splunk is also recommended.
-known_false_positives: |
-    False positives may be present based on legitimate third party applications needing to install drivers.
-    Filter, or allow list known good drivers consistently being installed in these paths.
+    | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_driver_load_non_standard_path_filter`
+how_to_implement: 'To implement this analytic, the Windows EventCode 7045 will need to be logged.
+
+    The Windows TA for Splunk is also recommended.'
+known_false_positives: 'False positives may be present based on legitimate third party applications needing to install drivers.
+
+    Filter, or allow list known good drivers consistently being installed in these paths.'
 references:
     - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/
     - https://attack.mitre.org/techniques/T1014/
@@ -38,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A kernel mode driver was loaded from a non-standard path on $dest$.
     entity:
diff --git a/detections/endpoint/windows_drivers_loaded_by_signature.yml b/detections/endpoint/windows_drivers_loaded_by_signature.yml
index f68346a0501..f7b9d9aa8c9 100644
--- a/detections/endpoint/windows_drivers_loaded_by_signature.yml
+++ b/detections/endpoint/windows_drivers_loaded_by_signature.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic identifies all drivers being loaded on Windows systems using Sysmon EventCode 6 (Driver Load). It leverages fields such as driver path, signature status, and hash to detect potentially suspicious drivers. This activity is significant for a SOC as malicious drivers can be used to gain kernel-level access, bypass security controls, or persist in the environment. If confirmed malicious, this activity could allow an attacker to execute arbitrary code with high privileges, leading to severe system compromise and potential data exfiltration.
 data_source:
     - Sysmon EventID 6
-search: |-
+search: |
     `sysmon` EventCode=6
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY ImageLoaded dest dvc
diff --git a/detections/endpoint/windows_edrsilencer_custom_outbound_filter_added.yml b/detections/endpoint/windows_edrsilencer_custom_outbound_filter_added.yml
index 0a1f79aff1e..107773d602f 100644
--- a/detections/endpoint/windows_edrsilencer_custom_outbound_filter_added.yml
+++ b/detections/endpoint/windows_edrsilencer_custom_outbound_filter_added.yml
@@ -6,54 +6,22 @@ modification_date: '2026-08-23'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects the EDRSilencer-specific Windows Filtering Platform filter name "Custom Outbound Filter" when it is configured with a block action.
+description: 'The following analytic detects the EDRSilencer-specific Windows Filtering Platform filter name "Custom Outbound Filter" when it is configured with a block action.
+
     EDRSilencer creates WFP filters to block outbound traffic from EDR and security agent processes, impairing endpoint telemetry without requiring the tool binary to keep its original process name.
-    EventCode 5447 identifies creation of the runtime filter with ChangeType %%16384, while EventCode 5441 can show the same persistent filter when the Base Filtering Engine starts.
+
+    EventCode 5447 identifies creation of the runtime filter with ChangeType %%16384, while EventCode 5441 can show the same persistent filter when the Base Filtering Engine starts.'
 data_source:
     - Windows Event Log Security 5441
     - Windows Event Log Security 5447
-search: |-
-    `wineventlog_security`
-    (
-        (
-            (
-                EventCode=5447
-                ChangeType IN ("%%16384", "Add")
-            )
-            OR
-            EventCode=5441
-        )
-        Action IN ("%%16389", "Block")
-        FilterName="Custom Outbound Filter"
-    )
+search: |
+    `wineventlog_security` EventCode=5441 EventCode="5447" ChangeType IN ("%%16384", "Add") Action IN ("%%16389", "Block") FilterName="Custom Outbound Filter" | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_edrsilencer_custom_outbound_filter_added_filter`
+how_to_implement: 'To implement this analytic, enable auditing for Windows Filtering Platform policy changes and ingest Windows Security Event Log data with EventCode 5447 and EventCode 5441.
 
-    | eval user=coalesce(UserName,user,"unknown")
-    | eval filter_action=case(Action="%%16389","Block", true(), Action),
-           change_type=case(ChangeType="%%16384","Add", true(), ChangeType)
+    The Splunk Add-on for Microsoft Windows should extract fields such as EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events.'
+known_false_positives: 'This filter name is associated with EDRSilencer behavior.
 
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-                  values(filter_action) as filter_action
-                  values(change_type) as change_type
-                  values(ProviderName) as provider_name
-                  values(FilterType) as filter_type
-                  values(FilterId) as filter_id
-                  values(FilterKey) as filter_key
-                  values(LayerName) as layer_name
-                  values(LayerId) as layer_id
-                  values(Conditions) as conditions
-                  values(CalloutName) as callout_name
-      BY dest user process_id FilterName
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_edrsilencer_custom_outbound_filter_added_filter`
-how_to_implement: |-
-    To implement this analytic, enable auditing for Windows Filtering Platform policy changes and ingest Windows Security Event Log data with EventCode 5447 and EventCode 5441.
-    The Splunk Add-on for Microsoft Windows should extract fields such as EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events.
-known_false_positives: |-
-    This filter name is associated with EDRSilencer behavior.
-    Validate whether any approved administrative tooling creates WFP block filters with the same name before tuning.
+    Validate whether any approved administrative tooling creates WFP block filters with the same name before tuning.'
 references:
     - https://github.com/netero1010/EDRSilencer
     - https://github.com/mthcht/awesome-lists/blob/main/Lists/Others/windows%20message%20tables/windows_messagetable_strings_list.csv
@@ -67,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: EDRSilencer WFP block filter [$FilterName$] was detected on [$dest$].
     entity:
diff --git a/detections/endpoint/windows_edrsilencer_execution.yml b/detections/endpoint/windows_edrsilencer_execution.yml
index 6f62d3f3cf5..057a4f54f08 100644
--- a/detections/endpoint/windows_edrsilencer_execution.yml
+++ b/detections/endpoint/windows_edrsilencer_execution.yml
@@ -6,42 +6,23 @@ modification_date: '2026-06-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects the usage of EDRSilencer.
+description: 'Detects the usage of EDRSilencer.
+
     Inspired by the closed-source FireBlock tool from MdSec NightHawk, this custom tool was developed to block outbound traffic of running Endpoint Detection and Response (EDR) processes using Windows Filtering Platform (WFP) APIs.
+
     Its features include searching for running EDR processes and applying WFP filters to block outbound traffic, adding filters for specific processes, and removing filters either individually or globally.
+
     The tool includes a custom implementation to avoid file handle access issues with EDR processes by bypassing the CreateFileW API.
+
     It supports a wide range of EDRs, including Microsoft Defender, Carbon Black, SentinelOne, and more, though further testing on various EDRs is recommended.
-    The tool has been tested on Windows 10 and Windows Server 2016, and its usage involves simple commands for blocking or unblocking traffic.
+
+    The tool has been tested on Windows 10 and Windows Server 2016, and its usage involves simple commands for blocking or unblocking traffic.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_name="EDRSilencer.exe"
-    OR
-    (
-        Processes.process IN ("* blockedr", "* blockedr *")
-        NOT Processes.process="*blockedreport*"
-    )
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_edrsilencer_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.process IN ("* blockedr", "* blockedr ") NOT Processes.process="*blockedreport*") OR Processes.process_name="*EDRSilencer.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_edrsilencer_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, parent process, and complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate administrative tools or security workflows may use similar techniques to block or filter EDR traffic for maintenance or troubleshooting. Verify the context and authorized use before flagging.
 references:
@@ -54,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_efi_bootloader_file_modification.yml b/detections/endpoint/windows_efi_bootloader_file_modification.yml
index 26465c38e2a..a621d25488e 100644
--- a/detections/endpoint/windows_efi_bootloader_file_modification.yml
+++ b/detections/endpoint/windows_efi_bootloader_file_modification.yml
@@ -6,32 +6,15 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects where a process writes to critical EFI bootloader files (bootmgfw.efi or bootx64.efi) within the \EFI\Boot\ directory.
+description: 'Detects where a process writes to critical EFI bootloader files (bootmgfw.efi or bootx64.efi) within the \EFI\Boot\ directory.
+
     These files are responsible for initializing the Windows Boot Manager during system startup.
-    Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process.
+
+    Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.file_path IN (
-        "*\\EFI\\Boot\\bootmgfw.efi",
-        "*\\EFI\\Boot\\bootx64.efi"
-    )
-
-    by Filesystem.dest Filesystem.file_create_time Filesystem.process_path
-       Filesystem.process_guid Filesystem.process_id Filesystem.file_path Filesystem.file_name
-       Filesystem.user Filesystem.vendor_product Filesystem.action
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_efi_bootloader_file_modification_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\EFI\\Boot\\bootmgfw.efi", "*\\EFI\\Boot\\bootx64.efi") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_efi_bootloader_file_modification_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate system updates or authorized IT maintenance may modify EFI bootloader files. Review changes against approved maintenance windows and tools.
 references:
@@ -45,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Critical EFI bootloader file activity observed at $file_path$ on $dest$.
     entity:
diff --git a/detections/endpoint/windows_efi_volume_mount_attempt_via_mountvol.yml b/detections/endpoint/windows_efi_volume_mount_attempt_via_mountvol.yml
index 0581932c17a..6b1572bfdaf 100644
--- a/detections/endpoint/windows_efi_volume_mount_attempt_via_mountvol.yml
+++ b/detections/endpoint/windows_efi_volume_mount_attempt_via_mountvol.yml
@@ -6,39 +6,17 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects attempts to mount the EFI volume.
+description: 'Detects attempts to mount the EFI volume.
+
     The EFI system partition (ESP) is a special partition on a data storage device (usually a hard disk drive or solid-state drive) that computers adhering to the UEFI (Unified Extensible Firmware Interface) specification use to store data necessary for the system to boot, such as bootloaders, device drivers, and system utilities.
-    This is used with attacks such as PKFail to modify the system on boot.
+
+    This is used with attacks such as PKFail to modify the system on boot.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    (
-        Processes.process_name="mountvol.exe"
-        OR
-        Processes.original_file_name="MOUNTVOL.EXE"
-    )
-    Processes.process IN ("*-S*", "* /S*")
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_efi_volume_mount_attempt_via_mountvol_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*mountvol.exe" OR Processes.original_file_name="MOUNTVOL.EXE" Processes.process IN ("*-S*", "* /S*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_efi_volume_mount_attempt_via_mountvol_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Mounting the EFI volume can be part of normal system updates or legitimate maintenance tasks. Monitor for unusual timing or context to reduce false alerts.
 references:
@@ -51,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_enable_powershell_web_access.yml b/detections/endpoint/windows_enable_powershell_web_access.yml
index 4b9440d6179..a5eb29f97e3 100644
--- a/detections/endpoint/windows_enable_powershell_web_access.yml
+++ b/detections/endpoint/windows_enable_powershell_web_access.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the enabling of PowerShell Web Access via PowerShell commands. It leverages PowerShell script block logging (EventCode 4104) to identify the execution of the `Install-WindowsFeature` cmdlet with the `WindowsPowerShellWebAccess` parameter. This activity is significant because enabling PowerShell Web Access can facilitate remote execution of PowerShell commands, potentially allowing an attacker to gain unauthorized access to systems and networks.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText IN ("*Install-WindowsFeature*WindowsPowerShellWebAccess*","*Install-PswaWebApplication*","*Add-PswaAuthorizationRule*UserName *ComputerName *")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_enable_powershell_web_access_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*Install-WindowsFeature*WindowsPowerShellWebAccess*", "*Install-PswaWebApplication*", "*Add-PswaAuthorizationRule*UserName *ComputerName *") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_enable_powershell_web_access_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: It is possible that legitimate scripts or network administrators may enable PowerShell Web Access. Monitor and escalate as needed.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: PowerShell Web Access has been enabled on $dest$.
     entity:
@@ -57,6 +47,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/pswa_powershell.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_enable_win32_scheduledjob_via_registry.yml b/detections/endpoint/windows_enable_win32_scheduledjob_via_registry.yml
index 6018e03c7a6..9f332f99a10 100644
--- a/detections/endpoint/windows_enable_win32_scheduledjob_via_registry.yml
+++ b/detections/endpoint/windows_enable_win32_scheduledjob_via_registry.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of a new DWORD value named "EnableAt" in the registry path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration". This modification enables the use of the at.exe or wmi Win32_ScheduledJob commands to add scheduled tasks on a Windows endpoint. The detection leverages registry event data from the Endpoint datamodel. This activity is significant because it may indicate that an attacker is enabling the ability to schedule tasks, potentially to execute malicious code at specific times or intervals. If confirmed malicious, this could allow persistent code execution on the system.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentVersion\\Schedule\\Configuration*" Registry.registry_value_name=EnableAt by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_enable_win32_scheduledjob_via_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentVersion\\Schedule\\Configuration*" Registry.registry_value_name="*EnableAt" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_enable_win32_scheduledjob_via_registry_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: In some cases, an automated script or system may enable this setting continuously, leading to false positives. To avoid such situations, it is recommended to monitor the frequency and context of the registry modification and modify or filter the detection rules as needed. This can help to reduce the number of false positives and ensure that only genuine threats are identified. Additionally, it is important to investigate any detected instances of this modification and analyze them in the broader context of the system and network to determine if further action is necessary.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_entra_user_management_via_azure_cli.yml b/detections/endpoint/windows_entra_user_management_via_azure_cli.yml
index 823b3c0e1df..eeb20399f7d 100644
--- a/detections/endpoint/windows_entra_user_management_via_azure_cli.yml
+++ b/detections/endpoint/windows_entra_user_management_via_azure_cli.yml
@@ -6,42 +6,17 @@ modification_date: '2026-10-09'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic detects the usage of the Azure CLI to interact with user accounts such as creating or deleting a user.
+description: 'This analytic detects the usage of the Azure CLI to interact with user accounts such as creating or deleting a user.
+
     Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected.
-    While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.
+
+    While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process IN (
-        "*az.cmd*",
-        "*azure.cli*"
-    )
-    Processes.process="*ad *"
-    Processes.process="* user*"
-
-    by Processes.process Processes.vendor_product Processes.user_id
-       Processes.process_hash Processes.parent_process_name
-       Processes.parent_process_exec Processes.action Processes.dest
-       Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name
-       Processes.parent_process Processes.parent_process_path
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id
-       Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_entra_user_management_via_azure_cli_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*az.cmd*", "*azure.cli*") Processes.process="*ad *" Processes.process="* user*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_entra_user_management_via_azure_cli_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate IT administrators commonly use the Azure CLI for managing user accounts. Filter alerts to exclude approved administrative or automated user management activities.
 references:
@@ -56,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_error_report_created_in_reportqueue_manually.yml b/detections/endpoint/windows_error_report_created_in_reportqueue_manually.yml
index 23ce74f1623..7bf081f9df9 100644
--- a/detections/endpoint/windows_error_report_created_in_reportqueue_manually.yml
+++ b/detections/endpoint/windows_error_report_created_in_reportqueue_manually.yml
@@ -6,37 +6,19 @@ modification_date: '2026-08-18'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects a .wer file being written into the Windows Error Reporting ReportQueue directory by a process other than the standard error-reporting binaries.
+description: 'The following analytic detects a .wer file being written into the Windows Error Reporting ReportQueue directory by a process other than the standard error-reporting binaries.
+
     Windows Error Reporting normally populates ReportQueue only through werfault.exe, werfaultsecure.exe, or wermgr.exe following an actual application crash.
+
     In the ShieldBreak exploit, the attacker fabricates a .wer report directly and manually invokes the QueueReporting scheduled task, which causes wermgr.exe to process the report and load an attacker-planted phantom DLL at SYSTEM integrity.
-    If confirmed malicious, this activity indicates preparation for a local privilege escalation attempt abusing Windows Error Reporting.
+
+    If confirmed malicious, this activity indicates preparation for a local privilege escalation attempt abusing Windows Error Reporting.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    `sysmon`
-    EventCode=11
-    action IN ("created","modified")
-    file_name="*.wer"
-    file_path="*\\ReportQueue\\*"
-    NOT process_path IN (
-      "*\\svchost.exe",
-      "*\\werfault.exe",
-      "*\\werfaultsecure.exe",
-      "*\\wermgr.exe"
-    )
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by dest file_name file_path file_hash action
-         process_name process_path process_id user vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_error_report_created_in_reportqueue_manually_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting logs with file creation events from your endpoints. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .wer or containing ReportQueue, since these are commonly excluded by default configurations.
-known_false_positives: |-
-    Crash-reporting or telemetry agents that integrate with Windows Error Reporting may stage .wer files outside the standard WER binaries. Tune by Image as necessary for your environment.
+search: |
+    `sysmon` EventCode=11 action IN ("created", "modified") TargetFilename="*.wer" TargetFilename="*\\ReportQueue\\*" NOT (process_path IN ("*\\svchost.exe", "*\\werfault.exe", "*\\werfaultsecure.exe", "*\\wermgr.exe")) | eval process_name=process_name, root_drive=root_drive | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name file_path process_guid process_id user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_error_report_created_in_reportqueue_manually_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting logs with file creation events from your endpoints. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .wer or containing ReportQueue, since these are commonly excluded by default configurations.
+known_false_positives: Crash-reporting or telemetry agents that integrate with Windows Error Reporting may stage .wer files outside the standard WER binaries. Tune by Image as necessary for your environment.
 references:
     - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day
     - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet
@@ -49,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_esx_admins_group_creation_security_event.yml b/detections/endpoint/windows_esx_admins_group_creation_security_event.yml
index 184746f29c7..e316fb68a3b 100644
--- a/detections/endpoint/windows_esx_admins_group_creation_security_event.yml
+++ b/detections/endpoint/windows_esx_admins_group_creation_security_event.yml
@@ -11,16 +11,8 @@ data_source:
     - Windows Event Log Security 4727
     - Windows Event Log Security 4730
     - Windows Event Log Security 4737
-search: |-
-    `wineventlog_security` EventCode IN (4727, 4730, 4737) (TargetUserName="ESX Admins" OR TargetUserName="*ESX Admins*")
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY EventCode TargetUserName TargetDomainName
-           SubjectUserName SubjectDomainName Computer
-      | rename Computer as dest
-      | eval EventCodeDescription=case( EventCode=4727, "Security Enabled Global Group Created", EventCode=4730, "Security Enabled Global Group Deleted", EventCode=4737, "Security Enabled Global Group Modified" )
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_esx_admins_group_creation_security_event_filter`
+search: |
+    `wineventlog_security` EventCode IN ("4727", "4730", "4737") TargetUserName IN ("ESX Admins", "*ESX Admins*") | eval SubjectUserName=SubjectUserName, EventCodeDescription=EventCodeDescription, src_user=src_user, object=object, object_category=object_category, change_type=change_type | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_esx_admins_group_creation_security_event_filter`
 how_to_implement: To successfully implement this search, ensure that Windows Security Event logging is enabled and being ingested into Splunk, particularly for event codes 4727, 4730, and 4737. Configure Group Policy settings to audit these specific events.
 known_false_positives: Legitimate administrators might create, delete, or modify an "ESX Admins" group for valid reasons. Verify that the group changes are authorized and part of normal administrative tasks. Consider the context of the action, such as the user performing it and any related activities.
 references:
@@ -35,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: ESX Admins group $EventCodeDescription$ on $dest$ by user $SubjectUserName$.
     entity:
@@ -66,6 +58,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security-esxadmins.log
-          sourcetype: XmlWinEventLog
           source: Security
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml
index 6271efedb5a..05a502e04ed 100644
--- a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml
+++ b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_net` Processes.process="*group*" Processes.process="*ESX Admins*"
-        AND
-        Processes.process="*/add*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_esx_admins_group_creation_via_net_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*net1.exe" OR Processes.original_file_name="net1.exe" Processes.process="*group*" Processes.process="*ESX Admins*" Processes.process="*/add*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_esx_admins_group_creation_via_net_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: Legitimate administrators might create an "ESX Admins" group for valid reasons. Verify that the group creation is authorized and part of normal administrative tasks. Consider the context of the action, such as the user performing it and any related activities.
 references:
@@ -42,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An attempt to create an "ESX Admins" group was detected on $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml b/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml
index 67708941adb..3e01b338f43 100644
--- a/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml
+++ b/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml
@@ -9,18 +9,8 @@ type: TTP
 description: This analytic detects attempts to create an "ESX Admins" group using PowerShell commands. This activity may indicate an attempt to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi hosts by recreating the 'ESX Admins' group after its deletion from Active Directory.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText="*New-ADGroup*" OR ScriptBlockText="*New-LocalGroup*") ScriptBlockText="*ESX Admins*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_esx_admins_group_creation_via_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*New-ADGroup*", "*New-LocalGroup*") Processes.process="*ESX Admins*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_esx_admins_group_creation_via_powershell_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. You can find additional setup instructions in the Splunk documentation for configuring PowerShell logging.
 known_false_positives: Legitimate administrators might create an "ESX Admins" group for valid reasons. Verify that the group creation is authorized and part of normal administrative tasks. Consider the context of the action, such as the user performing it and any related activities.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_id$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: PowerShell command to create "ESX Admins" group detected on host $dest$ by user $user_id$.
     entity:
diff --git a/detections/endpoint/windows_event_for_service_disabled.yml b/detections/endpoint/windows_event_for_service_disabled.yml
index 89146309d48..e9a88d292a9 100644
--- a/detections/endpoint/windows_event_for_service_disabled.yml
+++ b/detections/endpoint/windows_event_for_service_disabled.yml
@@ -9,15 +9,8 @@ type: Hunting
 description: The following analytic detects when a Windows service is modified from a start type to disabled. It leverages system event logs, specifically EventCode 7040, to identify this change. This activity is significant because adversaries often disable security or other critical services to evade detection and maintain control over a compromised host. If confirmed malicious, this action could allow attackers to bypass security defenses, leading to further exploitation and persistence within the environment.
 data_source:
     - Windows Event Log System 7040
-search: |-
-    `wineventlog_system` EventCode=7040  EventData_Xml="*disabled*"
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY Computer EventCode Name
-           UserID service ServiceName
-      | rename Computer as dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_event_for_service_disabled_filter`
+search: |
+    `wineventlog_system` EventCode=7040 EventData_Xml="*disabled*" | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_for_service_disabled_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
 known_false_positives: Windows service update may cause this event. In that scenario, filtering is needed.
 references:
diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml
index 9998dbbd779..247dd664c40 100644
--- a/detections/endpoint/windows_event_log_cleared.yml
+++ b/detections/endpoint/windows_event_log_cleared.yml
@@ -10,15 +10,8 @@ description: The following analytic detects the clearing of Windows event logs b
 data_source:
     - Windows Event Log Security 1102
     - Windows Event Log System 104
-search: |-
-    (`wineventlog_security` EventCode=1102)
-    OR
-    (`wineventlog_system` EventCode=104)
-    | stats count min(_time) as firstTime max(_time) as lastTime
-      by action change_type dest dvc object_category signature_id status user vendor_product object EventCode
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_event_log_cleared_filter`
+search: |
+    `wineventlog_security` EventCode=1102 EventCode="104" | stats count min(_time) as firstTime max(_time) as lastTime by action change_type dest dvc object_category signature_id status user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
 known_false_positives: It is possible that these logs may be legitimately cleared by Administrators. Filter as needed.
 references:
@@ -35,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows $object$ cleared on $dest$ via EventCode $EventCode$
     entity:
diff --git a/detections/endpoint/windows_event_logging_service_has_shutdown.yml b/detections/endpoint/windows_event_logging_service_has_shutdown.yml
index db584fffad9..dad22e8146d 100644
--- a/detections/endpoint/windows_event_logging_service_has_shutdown.yml
+++ b/detections/endpoint/windows_event_logging_service_has_shutdown.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic detects the shutdown of the Windows Event Log service by leveraging Windows Event ID 1100. This event is logged every time the service stops, including during normal system shutdowns. Monitoring this activity is crucial as it can indicate attempts to cover tracks or disable logging. If confirmed malicious, an attacker could hide their activities, making it difficult to trace their actions and investigate further incidents. Analysts should verify if the shutdown was planned and review other alerts and data sources for additional suspicious behavior.
 data_source:
     - Windows Event Log Security 1100
-search: |-
+search: |
     `wineventlog_security` EventCode=1100
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY action app change_type
diff --git a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
index c6c2369d6fc..b79baeac70f 100644
--- a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
+++ b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic identifies the creation or modification of Image File Execution Options (IFEO) registry keys, detected via EventCode 3000 in the Application channel. This detection leverages Windows Event Logs to monitor for process names added to IFEO under specific registry paths. This activity is significant as it can indicate attempts to set traps for process monitoring or debugging, often used by attackers for persistence or evasion. If confirmed malicious, this could allow an attacker to execute arbitrary code or manipulate process behavior, leading to potential system compromise.
 data_source:
     - Windows Event Log Application 3000
-search: |-
+search: |
     `wineventlog_application` EventCode=3000
       | rename param1 AS "Process" param2 AS "Exit_Code"
       | stats count min(_time) as firstTime max(_time) as lastTime
diff --git a/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml b/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml
index 3a9363e33c4..533a4438891 100644
--- a/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml
+++ b/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml
@@ -6,14 +6,14 @@ modification_date: '2026-10-02'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the usage of wevtutil.exe with the "clear-log" parameter in order to clear the contents of logs.
-    Clearing the event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations.
+description: 'The following analytic detects the usage of wevtutil.exe with the "clear-log" parameter in order to clear the contents of logs.
+
+    Clearing the event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count values(Processes.process) as process
             min(_time) as firstTime
@@ -77,7 +77,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_eventlog_recon_activity_using_log_query_utilities.yml b/detections/endpoint/windows_eventlog_recon_activity_using_log_query_utilities.yml
index d0cb63ed6d0..e139f30bde5 100644
--- a/detections/endpoint/windows_eventlog_recon_activity_using_log_query_utilities.yml
+++ b/detections/endpoint/windows_eventlog_recon_activity_using_log_query_utilities.yml
@@ -6,76 +6,31 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects EventLog reconnaissance activity using utilities such as `wevtutil.exe`, `wmic.exe`, PowerShell cmdlets like `Get-WinEvent`, or WMI queries targeting `Win32_NTLogEvent`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. These tools are often used by adversaries to extract usernames, IP addresses, session data, and event information for credential access or situational awareness during lateral movement. While these utilities are legitimate, execution with specific arguments or targeting sensitive logs like `Security`, `PowerShell`, or specific EventIDs (e.g., 4624, 4778) can indicate malicious intent. If confirmed malicious, this behavior could allow an attacker to extract sensitive info and potentially have leveraged access or move laterally.
+description: This analytic detects EventLog reconnaissance activity using utilities such as `wevtutil.exe`, `wmic.exe`, PowerShell cmdlets like `Get-WinEvent`, or WMI queries targeting `Win32_NTLogEvent`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. These tools are often used by adversaries to extract usernames, IP addresses, session data, and event information for credential access or situational awareness during lateral movement. While these utilities are legitimate, execution with specific arguments or targeting sensitive logs like `Security`, `PowerShell`, or specific EventIDs (e.g., 4624, 4778) can indicate malicious intent. If confirmed malicious, this behavior could allow an attacker to extract sensitive info and potentially have leveraged access or move laterally.
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` values(Processes.process) as process
-      min(_time) as firstTime max(_time) as lastTime
-      from datamodel=Endpoint.Processes
-      where (
-        (
-          (
-            Processes.process_name IN ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
-            OR
-            Processes.original_file_name IN ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
-          )
-          Processes.process IN ("*Get-WinEvent*", "*Get-EventLog*", "*EventLogQuery*", "*.ReadEvent(*")
-        )
-        OR
-        (
-          (
-            Processes.process_name = wevtutil.exe
-            OR
-            Processes.original_file_name = wevtutil.exe
-          )
-          Processes.process IN ("* qe *", "* query-events *")
-        )
-        OR
-        (
-          (
-            Processes.process_name = wmic.exe
-            OR
-            Processes.original_file_name = wmic.exe
-          )
-          Processes.process IN ("*ntevent*")
-        )
-        OR
-        (
-          Processes.process="*Win32_NTLogEvent*"
-          Processes.process="*EventCode*"
-        )
-        OR
-        (
-          Processes.process IN ("*PsLogList*", "*Eventquery*")
-        )
-      )
-      by
-        Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
-        Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
-        Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
-        Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
-        Processes.process_path Processes.user Processes.user_id Processes.vendor_product
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.process_name IN ("*powershell.exe", "*pwsh.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE") Processes.process IN ("*Get-WinEvent*", "*Get-EventLog*", "*EventLogQuery*", "*.ReadEvent(*")) OR (Processes.process_name="*wevtutil.exe" OR Processes.original_file_name="wevtutil.exe" Processes.process IN ("* qe *", "* query-events *")) OR (Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process="*ntevent*") OR (Processes.process="*Win32_NTLogEvent*" Processes.process="*EventCode*") OR Processes.process IN ("*PsLogList*", "*Eventquery*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_eventlog_recon_activity_using_log_query_utilities_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_eventlog_recon_activity_using_log_query_utilities_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    System administrators or monitoring tools may legitimately use these utilities to gather logs for troubleshooting or auditing. Filter known admin behavior or monitoring solutions as needed.
+
+    names and speed up the data modeling process.'
+known_false_positives: System administrators or monitoring tools may legitimately use these utilities to gather logs for troubleshooting or auditing. Filter known admin behavior or monitoring solutions as needed.
 references:
     - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
     - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
@@ -93,7 +48,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_excel_spawning_microsoft_project_application.yml b/detections/endpoint/windows_excel_spawning_microsoft_project_application.yml
index af77b9ca634..e1acda68c34 100644
--- a/detections/endpoint/windows_excel_spawning_microsoft_project_application.yml
+++ b/detections/endpoint/windows_excel_spawning_microsoft_project_application.yml
@@ -6,39 +6,29 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic identifies the execution of uncommon Microsoft application executables as child processes of Microsoft Excel.
+description: 'The following analytic identifies the execution of uncommon Microsoft application executables as child processes of Microsoft Excel.
+
     Under normal conditions, Excel primarily spawns internal Office-related processes, and the creation of executables such as WINPROJ.EXE, FOXPROW.exe, or SCHDPLUS.exe is uncommon in typical business workflows.
+
     Adversaries may abuse this behavior to blend malicious activity within trusted applications, execute unauthorized code, or bypass application control mechanisms.
+
     This technique aligns with common tradecraft where Office applications are leveraged as initial access or execution vectors due to their prevalence in enterprise environments.
+
     Detecting this relationship helps defenders spot suspicious child processes that may indicate malware execution, persistence mechanisms, or attempts to establish command-and-control.
+
     Security teams should investigate the parent Excel process, the context of the ActivateMicrosoftApp() execution, and any subsequent network or file activity.
-    While certain legitimate Office features could trigger this process in specific environments, its occurrence generally warrants further scrutiny to validate intent and rule out compromise.
+
+    While certain legitimate Office features could trigger this process in specific environments, its occurrence generally warrants further scrutiny to validate intent and rule out compromise.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
-    FROM datamodel=Endpoint.Processes WHERE
-    Processes.parent_process_name = "EXCEL.EXE"
-    Processes.process_name IN ("WINPROJ.EXE", "FOXPROW.exe","SCHDPLUS.exe")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_excel_spawning_microsoft_project_application_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    Microsoft Project has been discontinued since January 2010, so its presence is unlikely in modern environments.
-    If a related child process is observed, verify its legitimacy to rule out potential misuse.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*EXCEL.EXE" Processes.process_name IN ("*WINPROJ.EXE", "*FOXPROW.exe", "*SCHDPLUS.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_excel_spawning_microsoft_project_application_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: 'Microsoft Project has been discontinued since January 2010, so its presence is unlikely in modern environments.
+
+    If a related child process is observed, verify its legitimacy to rule out potential misuse.'
 references:
     - https://specterops.io/blog/2023/10/30/lateral-movement-abuse-the-power-of-dcom-excel-application/
     - https://blog.talosintelligence.com/pathwiper-targets-ukraine/
@@ -51,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_excessive_disabled_services_event.yml b/detections/endpoint/windows_excessive_disabled_services_event.yml
index aa05ed2ae94..49655495e3e 100644
--- a/detections/endpoint/windows_excessive_disabled_services_event.yml
+++ b/detections/endpoint/windows_excessive_disabled_services_event.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies an excessive number of system events where services are modified from start to disabled. It leverages Windows Event Logs (EventCode 7040) to detect multiple service state changes on a single host. This activity is significant as it may indicate an adversary attempting to disable security applications or other critical services, potentially leading to defense evasion or destructive actions. If confirmed malicious, this behavior could allow attackers to disable security defenses, disrupt system operations, and achieve their objectives on the compromised system.
 data_source:
     - Windows Event Log System 7040
-search: |-
+search: |
     `wineventlog_system` EventCode=7040 "disabled"
       | stats count values(EventData_Xml) as MessageList dc(EventData_Xml) as MessageCount min(_time) as firstTime max(_time) as lastTime
         BY Computer EventCode UserID
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An excessive number (Count - $MessageCount$) of Windows services were disabled on dest - $dest$.
     entity:
diff --git a/detections/endpoint/windows_excessive_service_stop_attempt.yml b/detections/endpoint/windows_excessive_service_stop_attempt.yml
index e52a8369854..8e9bfc40ec3 100644
--- a/detections/endpoint/windows_excessive_service_stop_attempt.yml
+++ b/detections/endpoint/windows_excessive_service_stop_attempt.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.action) as action values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user) as user  values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            `process_net`
-            OR
-            `process_sc`
-        )
-        AND Processes.process="*stop*" OR Processes.process="*delete*"
-      BY Processes.process_name Processes.original_file_name Processes.parent_process_name
-         Processes.dest Processes.user _time
-         span=1m
-    | where count >=5
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_excessive_service_stop_attempt_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*net1.exe", "*sc.exe") OR Processes.original_file_name IN ("net1.exe", "sc.exe") Processes.process IN ("*stop*", "*delete*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_excessive_service_stop_attempt_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -39,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services.
     entity:
diff --git a/detections/endpoint/windows_excessive_usage_of_net_app.yml b/detections/endpoint/windows_excessive_usage_of_net_app.yml
index 2391093670c..bff7e85592c 100644
--- a/detections/endpoint/windows_excessive_usage_of_net_app.yml
+++ b/detections/endpoint/windows_excessive_usage_of_net_app.yml
@@ -11,17 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.action) as action values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user) as user  values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_net`
-      BY Processes.process_name Processes.parent_process_name Processes.original_file_name
-         Processes.dest Processes.user _time
-         span=1m
-    | where count >=10
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_excessive_usage_of_net_app_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*net1.exe" OR Processes.original_file_name="net1.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_excessive_usage_of_net_app_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -34,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_executable_in_loaded_modules.yml b/detections/endpoint/windows_executable_in_loaded_modules.yml
index 5590010b7ba..e6c4ea10e4e 100644
--- a/detections/endpoint/windows_executable_in_loaded_modules.yml
+++ b/detections/endpoint/windows_executable_in_loaded_modules.yml
@@ -9,20 +9,8 @@ type: TTP
 description: The following analytic identifies instances where executable files (.exe) are loaded as modules, detected through 'ImageLoaded' events in Sysmon logs. This method leverages Sysmon EventCode 7 to track unusual module loading behavior, which is significant as it deviates from the norm of loading .dll files. This activity is crucial for SOC monitoring because it can indicate the presence of malware like NjRAT, which uses this technique to load malicious modules. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, maintain persistence, and further compromise the host system.
 data_source:
     - Sysmon EventID 7
-search: |-
-    `sysmon` EventCode=7 ImageLoaded != *.dll AND Signed != true
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY Image ImageLoaded dest
-           loaded_file loaded_file_path original_file_name
-           process_exec process_guid process_hash
-           process_id process_name process_path
-           service_dll_signature_exists service_dll_signature_verified signature
-           Signed signature_id user_id
-           vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_executable_in_loaded_modules_filter`
+search: |
+    `sysmon` EventCode=7 NOT ImageLoaded="*.dll" NOT Signed="true" | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_executable_in_loaded_modules_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -35,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An executable $ImageLoaded$ loaded by $Image$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml b/detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml
index 7e97bec325f..40fac8b09e7 100644
--- a/detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml
+++ b/detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml
@@ -6,23 +6,13 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the presence of executable files masquerading as benign file types on Windows systems. Adversaries employ this technique to evade defenses and trick users into executing malicious code by renaming executables with extensions commonly associated with documents, images, or other non-executable formats (e.g., .pdf, .jpg, .doc, .png).
+description: The following analytic detects the presence of executable files masquerading as benign file types on Windows systems. Adversaries employ this technique to evade defenses and trick users into executing malicious code by renaming executables with extensions commonly associated with documents, images, or other non-executable formats (e.g., .pdf, .jpg, .doc, .png).
 data_source:
     - Sysmon EventID 29
 search: |
-    `sysmon`
-    EventCode=29
-    NOT `executable_extensions`
-    | stats count min(_time) as firstTime max(_time) as lastTime
-      by Image file_name file_path process_guid file_hash process_id dest user EventCode
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_executable_masquerading_as_benign_file_types_filter`
-how_to_implement: |
-    To implement Sysmon EventCode 29 (File Block Executable), you must ensure that your Sysmon deployment is configured to log instances where executable file creation is blocked based on your organization's FileBlockExecutable rules. Once enabled, the corresponding Splunk search requires Sysmon operational logs and an input macro named sysmon, which should be customized to match your environment-specific index, source, and sourcetype settings for Windows Sysmon data. We strongly recommend replacing this macro with values appropriate to your Splunk environment so the search scopes correctly. The search also uses a post-filter macro designed to filter out known false positives.
-known_false_positives: |
-    File types that are not included in the filter for this detection may generate false positives, so proper filtering is required.
+    `sysmon` EventCode="29" NOT (TargetFilename IN ("*.exe", "*.dll", "*.sys", "*.ocx", "*.scr", "*.cpl", "*.efi", "*.drv", "*.bpl", "*.ax", "*.ime", "*.acm", "*.rll", "*.tsp")) | stats count min(_time) as firstTime max(_time) as lastTime by Image file_name file_path process_guid file_hash process_id dest user EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_executable_masquerading_as_benign_file_types_filter`
+how_to_implement: To implement Sysmon EventCode 29 (File Block Executable), you must ensure that your Sysmon deployment is configured to log instances where executable file creation is blocked based on your organization's FileBlockExecutable rules. Once enabled, the corresponding Splunk search requires Sysmon operational logs and an input macro named sysmon, which should be customized to match your environment-specific index, source, and sourcetype settings for Windows Sysmon data. We strongly recommend replacing this macro with values appropriate to your Splunk environment so the search scopes correctly. The search also uses a post-filter macro designed to filter out known false positives.
+known_false_positives: File types that are not included in the filter for this detection may generate false positives, so proper filtering is required.
 references:
     - https://www.linkedin.com/posts/mauricefielenbach_cybersecurity-incidentresponse-dfir-activity-7394805779448418304-g0gZ?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAuFTjIB5weY_kcyu4qp3kHbI4v49tO0zEk
     - https://www.blackhillsinfosec.com/a-sysmon-event-id-breakdown/
@@ -36,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
index 9fa9fdd338d..533bda3d2ef 100644
--- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
+++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml
@@ -11,28 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=msdt.exe Processes.process IN ("*msdt*","*ms-msdt:*","*ms-msdt:/id*","*ms-msdt:-id*","*/id*")
-        AND
-        (Processes.process="*IT_BrowseForFile=*"
-        OR
-        Processes.process="*IT_RebrowseForFile=*"
-        OR
-        Processes.process="*.xml*")
-        AND
-        Processes.process="*PCWDiagnostic*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_execute_arbitrary_commands_with_msdt_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*msdt.exe" Processes.process IN ("*msdt*", "*ms-msdt:*", "*ms-msdt:/id*", "*ms-msdt:-id*", "*/id*") Processes.process IN ("*IT_BrowseForFile=*", "*IT_RebrowseForFile=*", "*.xml*") Processes.process="*PCWDiagnostic*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_execute_arbitrary_commands_with_msdt_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed. Added .xml to potentially capture any answer file usage. Remove as needed.
 references:
@@ -50,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A parent process $parent_process_name$ has spawned a child process $process_name$ on host $dest$ possibly indicative of indirect command execution.
     entity:
diff --git a/detections/endpoint/windows_execution_of_microsoft_msc_file_in_suspicious_path.yml b/detections/endpoint/windows_execution_of_microsoft_msc_file_in_suspicious_path.yml
index e115cf912ab..f4fcfd3476d 100644
--- a/detections/endpoint/windows_execution_of_microsoft_msc_file_in_suspicious_path.yml
+++ b/detections/endpoint/windows_execution_of_microsoft_msc_file_in_suspicious_path.yml
@@ -60,7 +60,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml
index 70cc0107d9f..7be472c0984 100644
--- a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml
+++ b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects potential data exfiltration using PowerShell's Invoke-RestMethod. It leverages PowerShell Script Block Logging to identify scripts that attempt to upload files via HTTP POST requests. This activity is significant as it may indicate an attacker is exfiltrating sensitive data, such as desktop screenshots or files, to an external command and control (C2) server. If confirmed malicious, this could lead to data breaches, loss of sensitive information, and further compromise of the affected systems. Immediate investigation is recommended to determine the intent and scope of the activity.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*Invoke-RestMethod *" AND ScriptBlockText = "* -Uri *" AND ScriptBlockText = "* -Method *" AND ScriptBlockText = "* Post *" AND ScriptBlockText = "* -InFile *"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_exfiltration_over_c2_via_invoke_restmethod_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Invoke-RestMethod *" Processes.process="* -Uri *" Processes.process="* -Method *" Processes.process="* Post *" Processes.process="* -InFile *" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_exfiltration_over_c2_via_invoke_restmethod_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: False positives should be limited. Filter as needed.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A PowerShell script on $dest$ is attempting to transfer files to a remote URL.
     entity:
diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml
index 877fdff9553..dbbaeeb1cdb 100644
--- a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml
+++ b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic identifies potential data exfiltration using the PowerShell `net.webclient` command with the `UploadString` method. It leverages PowerShell Script Block Logging to detect instances where this command is executed. This activity is significant as it may indicate an attempt to upload sensitive data, such as desktop screenshots or files, to an external or internal URI, often associated with malware like Winter-Vivern. If confirmed malicious, this could lead to unauthorized data transfer, compromising sensitive information and potentially leading to further exploitation of the compromised host.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*Net.webclient*" AND ScriptBlockText = "*.UploadString*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_exfiltration_over_c2_via_powershell_uploadstring_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Net.webclient*" Processes.process="*.UploadString*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_exfiltration_over_c2_via_powershell_uploadstring_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: False positives should be limited. Filter as needed.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A PowerShell script on $dest$ is attempting to transfer files to a remote URL.
     entity:
diff --git a/detections/endpoint/windows_explorer_exe_spawning_powershell_or_cmd.yml b/detections/endpoint/windows_explorer_exe_spawning_powershell_or_cmd.yml
index ff26ac75c86..9e807247af4 100644
--- a/detections/endpoint/windows_explorer_exe_spawning_powershell_or_cmd.yml
+++ b/detections/endpoint/windows_explorer_exe_spawning_powershell_or_cmd.yml
@@ -10,7 +10,8 @@ description: This detection identifies instances where Windows Explorer.exe spaw
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_path="*\\explorer.exe" `process_powershell` OR `process_cmd`  by  Processes.dest Processes.process_current_directory Processes.process_path Processes.process Processes.original_file_name Processes.parent_process Processes.parent_process_name Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id Processes.process_guid Processes.process_id Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_explorer_exe_spawning_powershell_or_cmd_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe", "*cmd.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE", "Cmd.Exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_explorer_exe_spawning_powershell_or_cmd_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate user actions may trigger Explorer.exe to spawn PowerShell or cmd.exe, such as right-clicking and selecting "Open PowerShell window here" or similar options. Filter as needed based on your environment's normal behavior patterns.
 references:
@@ -32,6 +33,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/explorer_spawns_windows-sysmon.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_explorer_lnk_exploit_process_launch_with_padding.yml b/detections/endpoint/windows_explorer_lnk_exploit_process_launch_with_padding.yml
index 48003803613..710e34d39b6 100644
--- a/detections/endpoint/windows_explorer_lnk_exploit_process_launch_with_padding.yml
+++ b/detections/endpoint/windows_explorer_lnk_exploit_process_launch_with_padding.yml
@@ -10,7 +10,8 @@ description: This detection identifies instances where Windows Explorer.exe spaw
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_path="*\\explorer.exe" (Processes.process_path="*\\cmd.exe" OR Processes.process_path="*\\powershell.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | regex process=".*?\s{50,}.*" | `windows_explorer_lnk_exploit_process_launch_with_padding_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_path="*\\explorer.exe" (Processes.process_path="*\\cmd.exe" OR Processes.process_path="*\\powershell.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | regex process=".*?\s{50,}.*" | `windows_explorer_lnk_exploit_process_launch_with_padding_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate user actions may trigger Explorer.exe to spawn PowerShell or cmd.exe, such as right-clicking and selecting "Open PowerShell window here" or similar options. Filter as needed based on your environment's normal behavior patterns. Reduce or increase the padding threshold based on observed false positives.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Explorer.exe spawning PowerShell or cmd.exe with excessive padding (50+ spaces) on $dest$ by $user$.
     entity:
@@ -55,6 +56,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/padded_windows-sysmon.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_export_certificate.yml b/detections/endpoint/windows_export_certificate.yml
index 2eb87319c46..a7148828100 100644
--- a/detections/endpoint/windows_export_certificate.yml
+++ b/detections/endpoint/windows_export_certificate.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the export of a certificate from the Windows Certificate Store. It leverages the Certificates Lifecycle log channel, specifically event ID 1007, to identify this activity. Monitoring certificate exports is crucial as certificates can be used for authentication to VPNs or private resources. If malicious actors export certificates, they could potentially gain unauthorized access to sensitive systems or data, leading to significant security breaches.
 data_source:
     - Windows Event Log CertificateServicesClient 1007
-search: |-
+search: |
     `certificateservices_lifecycle` EventCode=1007
       | xmlkv UserData_Xml
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_ffmpeg_audio_and_video_device_discovery.yml b/detections/endpoint/windows_ffmpeg_audio_and_video_device_discovery.yml
index 61c5c27e24f..72098c2cd14 100644
--- a/detections/endpoint/windows_ffmpeg_audio_and_video_device_discovery.yml
+++ b/detections/endpoint/windows_ffmpeg_audio_and_video_device_discovery.yml
@@ -12,29 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-              (
-                Processes.process_name = ffmpeg.exe OR
-                Processes.original_file_name = ffmpeg.exe
-               ) AND
-
-              Processes.process_path IN ("*\\temp\\*") AND
-              Processes.process = "*-list_devices*" AND
-              Processes.process = "*-hide_banner*" AND
-              Processes.process = "* dshow *"
-            )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_ffmpeg_audio_and_video_device_discovery_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*ffmpeg.exe" OR Processes.original_file_name="ffmpeg.exe" Processes.process_path="*\\temp\\*" Processes.process="*-list_devices*" Processes.process="*-hide_banner*" Processes.process="* dshow *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ffmpeg_audio_and_video_device_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or administrative scripts may use this application. Filter as needed.
 references:
@@ -48,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_ffmpeg_directshow_video_capture.yml b/detections/endpoint/windows_ffmpeg_directshow_video_capture.yml
index d27cb6bf8a5..9e38a75e81b 100644
--- a/detections/endpoint/windows_ffmpeg_directshow_video_capture.yml
+++ b/detections/endpoint/windows_ffmpeg_directshow_video_capture.yml
@@ -12,29 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-          WHERE (
-                  (
-                    Processes.process_name = ffmpeg.exe OR
-                    Processes.original_file_name = ffmpeg.exe
-                  ) AND
-
-                  Processes.process_path IN ("*\\temp\\*") AND
-                  Processes.process = "*video=*" AND
-                  Processes.process = "* mjpeg *" AND
-                  Processes.process = "* dshow *"
-                )
-          BY Processes.action Processes.dest Processes.original_file_name
-            Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-            Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-            Processes.process Processes.process_exec Processes.process_guid
-            Processes.process_hash Processes.process_id Processes.process_integrity_level
-            Processes.process_name Processes.process_path Processes.user
-            Processes.user_id Processes.vendor_product
-        | `drop_dm_object_name(Processes)`
-        | `security_content_ctime(firstTime)`
-        | `security_content_ctime(lastTime)`
-    | `windows_ffmpeg_directshow_video_capture_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*ffmpeg.exe" OR Processes.original_file_name="ffmpeg.exe" Processes.process_path="*\\temp\\*" Processes.process="*video=*" Processes.process="* mjpeg *" Processes.process="* dshow *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ffmpeg_directshow_video_capture_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or administrative scripts may use this application. Filter as needed.
 references:
@@ -48,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml
index 24983914b96..73ccdad9d7b 100644
--- a/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml
+++ b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml
@@ -10,7 +10,8 @@ description: The following analytic detects instances where file or folder permi
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
-search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe") AND Processes.process IN ("*/grant*", "*/G*") AND Processes.process IN ("*SYSTEM*", "*admin*", "*S-1-1-0*", "*EVERYONE*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | rex field=process ":\\((?<permission>[^)]+)\\)" | eval has_read_attribute=if(match(permission, "R"), "true", "false") | eval has_write_execute=if(match(permission, "(W|GA|X|M|F|AD|DC|DE)"), "true", "false") | where has_write_execute="false" and has_read_attribute = "true" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_and_directory_enable_readonly_permissions_filter`'
+search: |
+    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe") AND Processes.process IN ("*/grant*", "*/G*") AND Processes.process IN ("*SYSTEM*", "*admin*", "*S-1-1-0*", "*EVERYONE*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | rex field=process ":\\((?<permission>[^)]+)\\)" | eval has_read_attribute=if(match(permission, "R"), "true", "false") | eval has_write_execute=if(match(permission, "(W|GA|X|M|F|AD|DC|DE)"), "true", "false") | where has_write_execute="false" and has_read_attribute = "true" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_and_directory_enable_readonly_permissions_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or administrative scripts may use this application. Filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A [$process_name$] was executed on [$dest$] attempting to change the access to a file or directory into readonly permissions.
     entity:
diff --git a/detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml b/detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml
index f930ccadd7f..46209d066fa 100644
--- a/detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml
+++ b/detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml
@@ -10,22 +10,8 @@ description: The following analytic detects the enabling of permission inheritan
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe")
-        AND
-        Processes.process = "*/inheritance:e*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_file_and_directory_permissions_enable_inheritance_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*icacls.exe", "*cacls.exe", "*xcacls.exe") Processes.process="*/inheritance:e*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_and_directory_permissions_enable_inheritance_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or administrative scripts may use this application. Filter as needed.
 references:
@@ -38,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 analytic_story:
     - Crypto Stealer
     - NetSupport RMM Tool Abuse
diff --git a/detections/endpoint/windows_file_and_directory_permissions_remove_inheritance.yml b/detections/endpoint/windows_file_and_directory_permissions_remove_inheritance.yml
index e892cfb948d..3b14b137927 100644
--- a/detections/endpoint/windows_file_and_directory_permissions_remove_inheritance.yml
+++ b/detections/endpoint/windows_file_and_directory_permissions_remove_inheritance.yml
@@ -10,22 +10,8 @@ description: The following analytic detects the removal of permission inheritanc
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe")
-        AND
-        Processes.process = "*/inheritance:r*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_file_and_directory_permissions_remove_inheritance_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*icacls.exe", "*cacls.exe", "*xcacls.exe") Processes.process="*/inheritance:r*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_and_directory_permissions_remove_inheritance_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or administrative scripts may use this application. Filter as needed.
 references:
@@ -38,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_file_association_modification_via_ftype.yml b/detections/endpoint/windows_file_association_modification_via_ftype.yml
index 15ff93906a8..7765b08a85b 100644
--- a/detections/endpoint/windows_file_association_modification_via_ftype.yml
+++ b/detections/endpoint/windows_file_association_modification_via_ftype.yml
@@ -6,39 +6,20 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic detects the use of the `ftype` command to modify Windows file associations.
+description: 'This analytic detects the use of the `ftype` command to modify Windows file associations.
+
     Attackers can abuse this functionality to change how specific file types are handled, potentially redirecting legitimate file execution to malicious payloads.
-    If confirmed malicious, this behavior may enable persistence, execution of unauthorized code, or evasion of security controls.
+
+    If confirmed malicious, this behavior may enable persistence, execution of unauthorized code, or evasion of security controls.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process="*ftype*=*"
-
-    by Processes.process Processes.vendor_product Processes.user_id
-       Processes.process_hash Processes.parent_process_name
-       Processes.parent_process_exec Processes.action Processes.dest
-       Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name
-       Processes.parent_process Processes.parent_process_path
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id
-       Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_file_association_modification_via_ftype_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*ftype*=*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_association_modification_via_ftype_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate users or administrators may run the ftype command to check or modify file associations. Filter alerts if used within authorized maintenance activities.
+references: []
 drilldown_searches:
     - earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
@@ -47,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_file_collection_via_copy_utilities.yml b/detections/endpoint/windows_file_collection_via_copy_utilities.yml
index 0478957d9f5..a7e9ddba6a3 100644
--- a/detections/endpoint/windows_file_collection_via_copy_utilities.yml
+++ b/detections/endpoint/windows_file_collection_via_copy_utilities.yml
@@ -12,42 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
-    from datamodel=Endpoint.Processes where
-    (
-      Processes.process_name IN ("copy.exe", "xcopy.exe")
-      OR
-      Processes.original_file_name IN ("copy.exe", "xcopy.exe")
-    )
-    Processes.process IN (
-      "*.7z*",
-      "*.bmp*",
-      "*.db*",
-      "*.doc*",
-      "*.gif*",
-      "*.gz*",
-      "*.jpg*",
-      "*.log*",
-      "*.pdf*",
-      "*.png*",
-      "*.ppt*",
-      "*.rar*",
-      "*.rtf*",
-      "*.tar*",
-      "*.txt*",
-      "*.xls*",
-      "*.zip*"
-    )
-    by Processes.action Processes.dest Processes.original_file_name
-    Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-    Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-    Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
-    Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
-    Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_file_collection_via_copy_utilities_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*copy.exe", "*xcopy.exe") OR Processes.original_file_name IN ("copy.exe", "xcopy.exe") Processes.process IN ("*.7z*", "*.bmp*", "*.db*", "*.doc*", "*.gif*", "*.gz*", "*.jpg*", "*.log*", "*.pdf*", "*.png*", "*.ppt*", "*.rar*", "*.rtf*", "*.tar*", "*.txt*", "*.xls*", "*.zip*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_collection_via_copy_utilities_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may execute this command for testing or auditing.
 references:
@@ -60,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_file_download_via_certutil.yml b/detections/endpoint/windows_file_download_via_certutil.yml
index 1c1e9b3c7c3..d62a1195921 100644
--- a/detections/endpoint/windows_file_download_via_certutil.yml
+++ b/detections/endpoint/windows_file_download_via_certutil.yml
@@ -12,26 +12,8 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
     - Cisco Network Visibility Module Flow Data
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_certutil`
-        AND
-        ((Processes.process IN ("*-URL *", "*/URL *"))
-        OR
-        (Processes.process IN ("*urlcache*", "*verifyctl*")
-        AND
-        Processes.process IN ("*/f *", "*-f *")))
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_file_download_via_certutil_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*certutil.exe" OR Processes.original_file_name="CertUtil.exe" Processes.process IN ("*urlcache*", "*verifyctl*") Processes.process IN ("*-URL *", "*/URL *", "*/f *", "*-f *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_download_via_certutil_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives in most environments, however tune as needed based on parent-child relationship or network connection.
 references:
@@ -51,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file.
     entity:
diff --git a/detections/endpoint/windows_file_download_via_powershell.yml b/detections/endpoint/windows_file_download_via_powershell.yml
index 1139e233861..2fee98dff12 100644
--- a/detections/endpoint/windows_file_download_via_powershell.yml
+++ b/detections/endpoint/windows_file_download_via_powershell.yml
@@ -6,37 +6,54 @@ modification_date: '2026-10-02'
 author: Michael Haag, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the use of PowerShell's download methods such as
+description: 'The following analytic detects the use of PowerShell''s download methods such as
+
     "DownloadString" and "DownloadData" from the WebClient class or Invoke-WebRequest
-    and it's aliases "IWR" or "Curl".
+
+    and it''s aliases "IWR" or "Curl".
+
     It leverages data from Endpoint Detection and Response (EDR) agents, focusing on
+
     process execution logs that include command-line details.
+
     This activity can be significant such methods and functions are commonly used in malicious
+
     PowerShell scripts to fetch and execute remote code.
+
     If confirmed malicious, this behavior could allow an attacker to download and run
+
     arbitrary code, potentially leading to unauthorized access, data exfiltration,
-    or further compromise of the affected system.
+
+    or further compromise of the affected system.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
     - Cisco Network Visibility Module Flow Data
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process IN ( "*iwr *", "*Invoke-WebRequest*", "*wget *", "curl", "*.DownloadData*", "*.DownloadFile*", "*.DownloadString*" ) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_download_via_powershell_filter`'
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") Processes.process IN ("*iwr *", "*Invoke-WebRequest*", "*wget *", "*curl*", "*.DownloadData*", "*.DownloadFile*", "*.DownloadString*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_download_via_powershell_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    False positives may be present and filtering will need to occur
+
+    names and speed up the data modeling process.'
+known_false_positives: 'False positives may be present and filtering will need to occur
+
     by parent process or command line argument. It may be required to modify this query
-    to an EDR product for more granular coverage.
+
+    to an EDR product for more granular coverage.'
 references:
     - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient?view=net-9.0#methods
     - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
@@ -51,7 +68,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_file_share_discovery_with_powerview.yml b/detections/endpoint/windows_file_share_discovery_with_powerview.yml
index 0f2792ccfe0..b4cf055574a 100644
--- a/detections/endpoint/windows_file_share_discovery_with_powerview.yml
+++ b/detections/endpoint/windows_file_share_discovery_with_powerview.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the Invoke-ShareFinder PowerShell cmdlet from PowerView. This detection leverages PowerShell Script Block Logging to identify instances where this specific command is executed. Monitoring this activity is crucial as it indicates an attempt to enumerate network file shares, which may contain sensitive information such as backups, scripts, and credentials. If confirmed malicious, this activity could enable an attacker to escalate privileges or move laterally within the network, potentially compromising additional systems and sensitive data.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104  (ScriptBlockText=Invoke-ShareFinder*)
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_file_share_discovery_with_powerview_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="Invoke-ShareFinder*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_share_discovery_with_powerview_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.=
 known_false_positives: Security teams may leverage PowerView proactively to identify and remediate sensitive file shares. Filter as needed.
 references:
@@ -36,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Invoke-ShareFinder commandlet was executed on $dest$
     entity:
diff --git a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml
index 7ab7b05ab6b..0bb657d9379 100644
--- a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml
+++ b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml
@@ -10,28 +10,7 @@ description: The following analytic detects FTP connections initiated by process
 data_source:
     - Sysmon EventID 3
 search: |
-    `sysmon`
-    EventCode=3
-    NOT Image IN(
-      "C:\\Program Files \(x86\)\\*",
-      "C:\\Program Files\\*",
-      "C:\\Windows\\System32\\*",
-      "C:\\Windows\\SysWOW64\\*"
-    )
-    (
-      DestinationPortName="ftp"
-      OR
-      DestinationPort=21
-    )
-    | stats count min(_time) as firstTime
-            max(_time) as lastTime
-
-    by action app dest dest_ip dest_port direction dvc protocol protocol_version
-       src src_ip src_port transport user vendor_product process_name
-       process_exec process_guid process_id
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_file_transfer_protocol_in_non_common_process_path_filter`
+    `sysmon` EventCode=3 NOT (Image IN ("C:\\Program Files (x86)\\*", "C:\\Program Files\\*", "C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*")) DestinationPortName="ftp" OR DestinationPort="21" | eval process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by action app dest dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port transport user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_transfer_protocol_in_non_common_process_path_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: Third party FTP based applications will trigger this. Apply additional filters as needed. Also consider excluding known FTP based clients installed outside of the Program Files and Windows directories.
 references:
@@ -44,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml
index 0283a3a04e3..7927933d465 100644
--- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml
+++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml
@@ -6,12 +6,15 @@ modification_date: '2026-07-27'
 author: Teoderick Contreras, Bhavin Patel, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic detects the creation of files without extensions in critical Windows system and driver-related directories, including but not limited to System32\Drivers, and other known Windows driver storage and loading paths.
+description: 'This analytic detects the creation of files without extensions in critical Windows system and driver-related directories, including but not limited to System32\Drivers, and other known Windows driver storage and loading paths.
+
     The analytic leverages telemetry from the Endpoint.Filesystem data model, with a focus on file creation events and file path analysis.
+
     File creation activity in these directories—particularly involving extensionless files—is highly suspicious, as it may indicate the presence of destructive or stealthy malware.
+
     This behavior is consistent with malware families such as HermeticWiper, which deploy kernel driver components into trusted Windows driver directories to obtain low-level access and execute destructive payloads.
-    If confirmed malicious, this activity can result in severe system compromise, including the deployment of malicious drivers, boot-sector or filesystem destruction, and ultimately system inoperability and irreversible data loss.
+
+    If confirmed malicious, this activity can result in severe system compromise, including the deployment of malicious drivers, boot-sector or filesystem destruction, and ultimately system inoperability and irreversible data loss.'
 data_source:
     - Sysmon EventID 11
 search: |
@@ -45,8 +48,7 @@ search: |
     | `security_content_ctime(lastTime)`
     | `windows_file_without_extension_in_critical_folder_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
-known_false_positives: |-
-    If you are leveraging Sysmon, you may see false positives related to folder creation, since Event ID 11 does not contain enough information to determine if the file is a File or a Directory. Filter out those entries when leveraging this analytic.
+known_false_positives: If you are leveraging Sysmon, you may see false positives related to folder creation, since Event ID 11 does not contain enough information to determine if the file is a File or a Directory. Filter out those entries when leveraging this analytic.
 references:
     - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
     - https://www.splunk.com/en_us/blog/security/detecting-hermeticwiper.html
@@ -59,7 +61,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml
index 6d31c42deee..de1db00cd9a 100644
--- a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml
+++ b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml
@@ -6,33 +6,27 @@ modification_date: '2026-10-02'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic identifies the modification of security permissions
+description: 'The following analytic identifies the modification of security permissions
+
     on files or directories using tools like icacls.exe, cacls.exe, or xcacls.exe. It
+
     leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific
+
     command-line executions. This activity is significant as it is commonly used by
+
     Advanced Persistent Threats (APTs) and coinminer scripts to evade detection and
+
     maintain control over compromised systems. If confirmed malicious, this behavior
+
     could allow attackers to hinder investigation, impede remediation efforts, and maintain
-    persistent access to the compromised environment.
+
+    persistent access to the compromised environment.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    Processes.process_name IN ("icacls.exe", "cacls.exe","xcacls.exe") AND
-    Processes.process IN ("*:R*", "*:W*", "*:F*", "*:C*", "*:N*", "*/P*", "*/E*")
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_files_and_dirs_access_rights_modification_via_icacls_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*icacls.exe", "*cacls.exe", "*xcacls.exe") Processes.process IN ("*:R*", "*:W*", "*:F*", "*:C*", "*:N*", "*/P*", "*/E*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_files_and_dirs_access_rights_modification_via_icacls_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time. Filter as needed.
 references:
@@ -46,7 +40,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_filtering_platform_filter_added_to_block_edr_process.yml b/detections/endpoint/windows_filtering_platform_filter_added_to_block_edr_process.yml
index 38d0ae316df..26cfe05e9c1 100644
--- a/detections/endpoint/windows_filtering_platform_filter_added_to_block_edr_process.yml
+++ b/detections/endpoint/windows_filtering_platform_filter_added_to_block_edr_process.yml
@@ -6,13 +6,14 @@ modification_date: '2026-08-23'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects Windows Filtering Platform filters that are added and configured to block outbound traffic for known EDR and security agent processes.
+description: 'The following analytic detects Windows Filtering Platform filters that are added and configured to block outbound traffic for known EDR and security agent processes.
+
     Tools such as EDRSilencer abuse WFP to disrupt outbound telemetry from EDR processes, which can bypass detections that only look for the tool process name.
-    This detection looks for WFP add events with a block action and EDR process names embedded in the hexdump-like Conditions field.
+
+    This detection looks for WFP add events with a block action and EDR process names embedded in the hexdump-like Conditions field.'
 data_source:
     - Windows Event Log Security 5447
-search: |-
+search: |
     `wineventlog_security`
     EventCode=5447
     ChangeType IN ("%%16384", "Add")
@@ -103,11 +104,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_filtering_platform_filter_added_to_block_edr_process_filter`
-how_to_implement: |-
-    To implement this analytic, enable auditing for Windows Filtering Platform policy changes and ingest Windows Security Event Log data with EventCode 5447. The Splunk Add-on for Microsoft Windows should extract fields such as EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events.
-known_false_positives: |-
-    Legitimate firewall, VPN, EDR, and Group Policy changes can add WFP block filters.
-    Tune by approved ProviderName, LayerName, FilterName, or known administrative windows after validating the WFP filter context.
+how_to_implement: To implement this analytic, enable auditing for Windows Filtering Platform policy changes and ingest Windows Security Event Log data with EventCode 5447. The Splunk Add-on for Microsoft Windows should extract fields such as EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events.
+known_false_positives: 'Legitimate firewall, VPN, EDR, and Group Policy changes can add WFP block filters.
+
+    Tune by approved ProviderName, LayerName, FilterName, or known administrative windows after validating the WFP filter context.'
 references:
     - https://github.com/netero1010/EDRSilencer
     - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5447
@@ -120,7 +120,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Filtering Platform block filter targeting [$edr_process$] was detected on [$dest$].
     entity:
diff --git a/detections/endpoint/windows_filtering_platform_policy_added_to_block_edr_process.yml b/detections/endpoint/windows_filtering_platform_policy_added_to_block_edr_process.yml
index d5fdd1252e6..df4f0c3db62 100644
--- a/detections/endpoint/windows_filtering_platform_policy_added_to_block_edr_process.yml
+++ b/detections/endpoint/windows_filtering_platform_policy_added_to_block_edr_process.yml
@@ -6,88 +6,13 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects the modification of a Windows Filtering Platform Policy to block the communication of known EDR processes.
-    This can be used by attackers to impair the functionality of these tools and to hide their activities on the machine.
+description: 'Detects the modification of a Windows Filtering Platform Policy to block the communication of known EDR processes.
+
+    This can be used by attackers to impair the functionality of these tools and to hide their activities on the machine.'
 data_source:
     - Sysmon EventID 13
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Registry where
-
-    Registry.action="modified"
-    Registry.registry_path="*\\Parameters\\FirewallPolicy\\FirewallRules*"
-    Registry.registry_value_data="*Action=Block*"
-    Registry.registry_value_data="*App=*"
-    Registry.registry_value_data IN (
-        "*AmSvc.exe*",
-        "*cb.exe*",
-        "*CETASvc.exe*",
-        "*CNTAoSMgr.exe*",
-        "*CrAmTray.exe*",
-        "*CrsSvc.exe*",
-        "*CybereasonAV.exe*",
-        "*CylanceSvc.exe*",
-        "*cyserver.exe*",
-        "*CyveraService.exe*",
-        "*CyvrFsFlt.exe*",
-        "*EIConnector.exe*",
-        "*ekrn.exe*",
-        "*elastic-agent.exe*",
-        "*elastic-endpoint.exe*",
-        "*EndpointBasecamp.exe*",
-        "*ExecutionPreventionSvc.exe*",
-        "*filebeat.exe*",
-        "*fortiedr.exe*",
-        "*hurukai.exe*",
-        "*LogProcessorService.exe*",
-        "*MsMpEng.exe*",
-        "*MsSense.exe*",
-        "*Ntrtscan.exe*",
-        "*PccNTMon.exe*",
-        "*QualysAgent.exe*",
-        "*RepMgr.exe*",
-        "*RepUtils.exe*",
-        "*RepUx.exe*",
-        "*RepWAV.exe*",
-        "*RepWSC.exe*",
-        "*SenseCncProxy.exe*",
-        "*SenseIR.exe*",
-        "*SenseNdr.exe*",
-        "*SenseSampleUploader.exe*",
-        "*SentinelAgent.exe*",
-        "*SentinelAgentWorker.exe*",
-        "*SentinelBrowserNativeHost.exe*",
-        "*SentinelHelperService.exe*",
-        "*SentinelServiceHost.exe*",
-        "*SentinelStaticEngine.exe*",
-        "*SentinelStaticEngineScanner.exe*",
-        "*sfc.exe*",
-        "*TaniumClient.exe*",
-        "*TaniumCX.exe*",
-        "*TaniumDetectEngine.exe*",
-        "*TMBMSRV.exe*",
-        "*TmCCSF.exe*",
-        "*TmListen.exe*",
-        "*TmWSCSvc.exe*",
-        "*Traps.exe*",
-        "*winlogbeat.exe*",
-        "*WSCommunicator.exe*",
-        "*xagt.exe*"
-    )
-
-    by Registry.dest Registry.vendor_product Registry.user Registry.status
-       Registry.registry_value_name Registry.registry_path Registry.registry_hive
-       Registry.registry_value_data Registry.action Registry.process_path
-       Registry.process_guid Registry.process_id Registry.registry_key_name
-
-    | `drop_dm_object_name(Registry)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_filtering_platform_policy_added_to_block_edr_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action="modified" Registry.registry_path="*\\Parameters\\FirewallPolicy\\FirewallRules*" Registry.registry_value_data="*Action=Block*" Registry.registry_value_data="*App=*" Registry.registry_value_data IN ("*AmSvc.exe*", "*cb.exe*", "*CETASvc.exe*", "*CNTAoSMgr.exe*", "*CrAmTray.exe*", "*CrsSvc.exe*", "*CybereasonAV.exe*", "*CylanceSvc.exe*", "*cyserver.exe*", "*CyveraService.exe*", "*CyvrFsFlt.exe*", "*EIConnector.exe*", "*ekrn.exe*", "*elastic-agent.exe*", "*elastic-endpoint.exe*", "*EndpointBasecamp.exe*", "*ExecutionPreventionSvc.exe*", "*filebeat.exe*", "*fortiedr.exe*", "*hurukai.exe*", "*LogProcessorService.exe*", "*MsMpEng.exe*", "*MsSense.exe*", "*Ntrtscan.exe*", "*PccNTMon.exe*", "*QualysAgent.exe*", "*RepMgr.exe*", "*RepUtils.exe*", "*RepUx.exe*", "*RepWAV.exe*", "*RepWSC.exe*", "*SenseCncProxy.exe*", "*SenseIR.exe*", "*SenseNdr.exe*", "*SenseSampleUploader.exe*", "*SentinelAgent.exe*", "*SentinelAgentWorker.exe*", "*SentinelBrowserNativeHost.exe*", "*SentinelHelperService.exe*", "*SentinelServiceHost.exe*", "*SentinelStaticEngine.exe*", "*SentinelStaticEngineScanner.exe*", "*sfc.exe*", "*TaniumClient.exe*", "*TaniumCX.exe*", "*TaniumDetectEngine.exe*", "*TMBMSRV.exe*", "*TmCCSF.exe*", "*TmListen.exe*", "*TmWSCSvc.exe*", "*Traps.exe*", "*winlogbeat.exe*", "*WSCommunicator.exe*", "*xagt.exe*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_filtering_platform_policy_added_to_block_edr_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate administrative tasks or security configurations may create filtering platform policies. Verify actions with authorized IT personnel before alerting.
 references:
@@ -101,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious Windows Filtering Platform Policy with value $registry_value_data$ created on $dest$.
     entity:
diff --git a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml
index 3f27e2f0a6a..d979fd4e8b8 100644
--- a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml
+++ b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Get-DomainOU` cmdlet, a part of the PowerView toolkit used for Windows domain enumeration. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this activity. Detecting `Get-DomainOU` usage is significant as adversaries may use it to gather information about organizational units within Active Directory, which can facilitate lateral movement or privilege escalation. If confirmed malicious, this activity could allow attackers to map the domain structure, aiding in further exploitation and persistence within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*Get-DomainOU*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_find_domain_organizational_units_with_getdomainou_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-DomainOU*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_find_domain_organizational_units_with_getdomainou_filter`
 how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators may leverage PowerSploit tools for legitimate reasons, filter as needed.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious PowerShell Get-DomainOU was identified on endpoint $dest$ by user $user_id$.
     entity:
diff --git a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml
index bb94e414773..27b062f3fd6 100644
--- a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml
+++ b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Find-InterestingDomainAcl` cmdlet, part of the PowerView toolkit, using PowerShell Script Block Logging (EventCode=4104). This detection leverages logs to identify when this command is run, which is significant as adversaries may use it to find misconfigured or unusual Access Control Lists (ACLs) within a domain. If confirmed malicious, this activity could allow attackers to identify privilege escalation opportunities or weak security configurations in Active Directory, potentially leading to unauthorized access or further exploitation.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*Find-InterestingDomainAcl*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_find_interesting_acl_with_findinterestingdomainacl_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Find-InterestingDomainAcl*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_find_interesting_acl_with_findinterestingdomainacl_filter`
 how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators may leverage PowerSploit tools for legitimate reasons, filter as needed.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious PowerShell Find-InterestingDomainAcl was identified on endpoint $dest$ by user $user_id$.
     entity:
diff --git a/detections/endpoint/windows_findstr_gpp_discovery.yml b/detections/endpoint/windows_findstr_gpp_discovery.yml
index ba1a2d02d0c..0a9b2fda31c 100644
--- a/detections/endpoint/windows_findstr_gpp_discovery.yml
+++ b/detections/endpoint/windows_findstr_gpp_discovery.yml
@@ -11,26 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=findstr.exe
-            AND
-            Processes.process=*sysvol*
-            AND
-            Processes.process=*cpassword*
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_findstr_gpp_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*findstr.exe" Processes.process="*sysvol*" Processes.process="*cpassword*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_findstr_gpp_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may leverage findstr to find passwords in GPO to validate exposure. Filter as needed.
 references:
@@ -47,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Findstr was executed to discover GPP credentials on $dest$
     entity:
diff --git a/detections/endpoint/windows_finger_exe_connecting_to_a_remote_host.yml b/detections/endpoint/windows_finger_exe_connecting_to_a_remote_host.yml
index 40b37b55986..74fa50ff5c0 100644
--- a/detections/endpoint/windows_finger_exe_connecting_to_a_remote_host.yml
+++ b/detections/endpoint/windows_finger_exe_connecting_to_a_remote_host.yml
@@ -6,48 +6,28 @@ modification_date: '2026-09-16'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic identifies the `finger.exe` utility being spawned with a command line containing an `@` character, indicating a remote host/server was specified.
+description: 'The following analytic identifies the `finger.exe` utility being spawned with a command line containing an `@` character, indicating a remote host/server was specified.
+
     The Finger protocol utility is largely obsolete in modern environments and has been abused by adversaries as a living-off-the-land binary (LOLBIN) to retrieve encoded payloads or establish covert command-and-control communication with an attacker-controlled finger server.
-    This behavior is uncommon in legitimate enterprise usage and warrants investigation.
+
+    This behavior is uncommon in legitimate enterprise usage and warrants investigation.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    FROM datamodel=Endpoint.Processes WHERE
-
-    (
-        Processes.process_name="finger.exe"
-        OR
-        Processes.original_file_name="finger.exe"
-    )
-    Processes.process="*@*"
-
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user Processes.user_id
-       Processes.vendor_product
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*finger.exe" OR Processes.original_file_name="finger.exe" Processes.process="*@*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_finger_exe_connecting_to_a_remote_host_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are
 
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_finger_exe_connecting_to_a_remote_host_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are
     designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this
+
     search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must
+
     ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons
+
     that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data
-    model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+
+    model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.'
 known_false_positives: No false positives have been identified at this time.
 references:
     - https://packetwatch.com/resources/threat-profile/clickfix-abuses-finger-to-deliver-castleloader
diff --git a/detections/endpoint/windows_firewall_rule_added.yml b/detections/endpoint/windows_firewall_rule_added.yml
index 30113438a76..f78a35ce8b1 100644
--- a/detections/endpoint/windows_firewall_rule_added.yml
+++ b/detections/endpoint/windows_firewall_rule_added.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This detection identifies instances where a Windows Firewall rule is added by monitoring Event ID 4946 in the Windows Security Event Log. Firewall rule modifications can indicate legitimate administrative actions, but they may also signal unauthorized changes, misconfigurations, or malicious activity such as attackers allowing traffic for backdoors or persistence mechanisms. By analyzing fields like RuleName, RuleId, Computer, and ProfileChanged, security teams can determine whether the change aligns with expected behavior. Correlating with user activity and process execution can help distinguish false positives from real threats, ensuring better visibility into potential security risks.
 data_source:
     - Windows Event Log Security 4946
-search: |-
+search: |
     `wineventlog_security` EventCode=4946
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY RuleName signature subject
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_firewall_rule_deletion.yml b/detections/endpoint/windows_firewall_rule_deletion.yml
index f39f21698b3..192f871962f 100644
--- a/detections/endpoint/windows_firewall_rule_deletion.yml
+++ b/detections/endpoint/windows_firewall_rule_deletion.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This detection identifies instances where a Windows Firewall rule has been deleted, potentially exposing the system to security risks. Unauthorized removal of firewall rules can indicate an attacker attempting to bypass security controls or malware disabling protections for persistence and command-and-control communication. The event logs details such as the deleted rule name, protocol, port, and the user responsible for the action. Security teams should monitor for unexpected deletions, correlate with related events, and investigate anomalies to prevent unauthorized access and maintain network security posture.
 data_source:
     - Windows Event Log Security 4948
-search: |-
+search: |
     `wineventlog_security` EventCode=4948
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY RuleName signature subject
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_firewall_rule_modification.yml b/detections/endpoint/windows_firewall_rule_modification.yml
index 02d3c3c40d0..cf30b9ace43 100644
--- a/detections/endpoint/windows_firewall_rule_modification.yml
+++ b/detections/endpoint/windows_firewall_rule_modification.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This detection identifies instances where a Windows Firewall rule has been modified, which may indicate an attempt to alter security policies. Unauthorized modifications can weaken firewall protections, allowing malicious traffic or preventing legitimate communications. The event logs details such as the modified rule name, protocol, ports, application path, and the user responsible for the change. Security teams should monitor unexpected modifications, correlate them with related events, and investigate anomalies to prevent unauthorized access and maintain network security integrity.
 data_source:
     - Windows Event Log Security 4947
-search: |-
+search: |
     `wineventlog_security` EventCode=4947
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY RuleName signature subject
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml b/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml
index f3dc13d6c8c..b7a16f484e5 100644
--- a/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml
+++ b/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml
@@ -6,52 +6,27 @@ modification_date: '2026-10-09'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies the use of a `for /f` loop with the `delims=` option within `cmd.exe`, a technique commonly used to parse and extract data from the output of other commands.
-    Adversaries and malicious scripts leverage this pattern to programmatically process command output for discovery, data extraction, or execution purposes while evading simpler detection logic.
+description: 'The following analytic identifies the use of a `for /f` loop with the `delims=` option within `cmd.exe`, a technique commonly used to parse and extract data from the output of other commands.
+
+    Adversaries and malicious scripts leverage this pattern to programmatically process command output for discovery, data extraction, or execution purposes while evading simpler detection logic.'
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    Processes.parent_process="*for /f*"
-    Processes.parent_process="*delims=*"
-    NOT Processes.user="SYSTEM"
-    NOT Processes.user="*$"
-    NOT Processes.parent_process IN (
-        "*__VIARelease*",
-        "*:\\Program Files\\Microsoft SQL Server\\*",
-        "*^| findstr *"
-    )
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process="*for /f*" Processes.parent_process="*delims=*" NOT Processes.user="SYSTEM" NOT Processes.user="*$" NOT (Processes.parent_process IN ("*__VIARelease*", "*:\\Program Files\\Microsoft SQL Server\\*", "*^| findstr *")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_for_loop_usage_within_cmd_exe_to_execute_commands_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
 
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user Processes.user_id
-       Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_for_loop_usage_within_cmd_exe_to_execute_commands_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
     These agents are designed to provide security-related telemetry from the endpoints where the agent
+
     is installed. To implement this search, you must ingest logs that contain the process GUID, process
+
     name, and parent process. Additionally, you must ingest complete command-line executions. These logs
+
     must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product.
+
     The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk
-    Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Administrators or power users may use `for /f` loops with `delims=` in legitimate scripts for automation or troubleshooting purposes.
+
+    Common Information Model (CIM) to normalize the field names and speed up the data modeling process.'
+known_false_positives: Administrators or power users may use `for /f` loops with `delims=` in legitimate scripts for automation or troubleshooting purposes.
 references:
     - https://packetwatch.com/resources/threat-profile/clickfix-abuses-finger-to-deliver-castleloader
 drilldown_searches:
diff --git a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml
index ae08d1dba5e..3ae5ca9cc13 100644
--- a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml
+++ b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Get-ForestDomain` cmdlet, a component of the PowerView toolkit used for Windows domain enumeration. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this activity. Detecting `Get-ForestDomain` is significant because adversaries and Red Teams use it to gather detailed information about Active Directory forest and domain configurations. If confirmed malicious, this activity could enable attackers to understand the domain structure, facilitating lateral movement or privilege escalation within the environment.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*Get-ForestDomain*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_forest_discovery_with_getforestdomain_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-ForestDomain*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_forest_discovery_with_getforestdomain_filter`
 how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators may leverage PowerSploit tools for legitimate reasons, filter as needed.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious PowerShell Get-ForestDomain was identified on endpoint $dest$ by user $user_id$.
     entity:
diff --git a/detections/endpoint/windows_gather_victim_host_information_camera.yml b/detections/endpoint/windows_gather_victim_host_information_camera.yml
index aaf20b36b34..8d0f5f63333 100644
--- a/detections/endpoint/windows_gather_victim_host_information_camera.yml
+++ b/detections/endpoint/windows_gather_victim_host_information_camera.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects a PowerShell script that enumerates camera devices on the targeted host. This detection leverages PowerShell Script Block Logging, specifically looking for commands querying Win32_PnPEntity for camera-related information. This activity is significant as it is commonly observed in DCRat malware, which collects camera data to send to its command-and-control server. If confirmed malicious, this behavior could indicate an attempt to gather sensitive visual information from the host, potentially leading to privacy breaches or further exploitation.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText = "*PNPClass*" ScriptBlockText IN ("*Image*", "*Camera*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_gather_victim_host_information_camera_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="* Win32_PnPEntity *" Processes.process="*SELECT*" Processes.process="*WHERE*" Processes.process="*PNPClass*" Processes.process IN ("*Image*", "*Camera*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_gather_victim_host_information_camera_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Administrators may execute this powershell command to get hardware information related to camera on $dest$.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_gather_victim_identity_sam_info.yml b/detections/endpoint/windows_gather_victim_identity_sam_info.yml
index 35eafebf8ba..b360be9b7a3 100644
--- a/detections/endpoint/windows_gather_victim_identity_sam_info.yml
+++ b/detections/endpoint/windows_gather_victim_identity_sam_info.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects processes loading the samlib.dll or samcli.dll modules, which are often abused to access Security Account Manager (SAM) objects or credentials on domain controllers. This detection leverages Sysmon EventCode 7 to identify these DLLs being loaded outside typical system directories. Monitoring this activity is crucial as it may indicate attempts to gather sensitive identity information. If confirmed malicious, this behavior could allow attackers to obtain credentials, escalate privileges, or further infiltrate the network.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7  (ImageLoaded = "*\\samlib.dll" AND OriginalFileName = "samlib.dll") OR (ImageLoaded = "*\\samcli.dll" AND OriginalFileName = "SAMCLI.DLL") AND NOT (Image IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_gather_victim_identity_sam_info_filter`'
+search: |
+    `sysmon` EventCode=7 (ImageLoaded="*\\samlib.dll" OriginalFileName="samlib.dll") OR (ImageLoaded="*\\samcli.dll" OriginalFileName="SAMCLI.DLL" NOT (Image IN ("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*"))) | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_gather_victim_identity_sam_info_filter`
 how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
 known_false_positives: this module can be loaded by a third party application. Filter is needed.
 references:
diff --git a/detections/endpoint/windows_gdrive_binary_activity.yml b/detections/endpoint/windows_gdrive_binary_activity.yml
index 00f2ef3a4d8..5e41de929e7 100644
--- a/detections/endpoint/windows_gdrive_binary_activity.yml
+++ b/detections/endpoint/windows_gdrive_binary_activity.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="gdrive.exe"
-            OR
-            Processes.original_file_name="*gdrive.exe"
-        )
-        Processes.process IN  ("* download *", "* upload *", "* list*", "* update *", "* sync *", "* share *", "* account add*", "* drives *", "* files *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_gdrive_binary_activity_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*gdrive.exe" OR Processes.original_file_name="*gdrive.exe" Processes.process IN ("* download *", "* upload *", "* list*", "* update *", "* sync *", "* share *", "* account add*", "* drives *", "* files *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_gdrive_binary_activity_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
@@ -42,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $process_name$ was identified attempting to interact with Google Drive on endpoint $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml b/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml
index e3677216c05..926be5bfe18 100644
--- a/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml
+++ b/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the use of the Get-ADComputer cmdlet with parameters indicating a search for Windows endpoints with Kerberos Unconstrained Delegation. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this specific activity. This behavior is significant as it may indicate an attempt by adversaries or Red Teams to gain situational awareness and perform Active Directory discovery. If confirmed malicious, this activity could allow attackers to identify high-value targets for further exploitation, potentially leading to privilege escalation or lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText = "*Get-ADComputer*" AND ScriptBlockText = "*TrustedForDelegation*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_get_adcomputer_unconstrained_delegation_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-ADComputer*" Processes.process="*TrustedForDelegation*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_get_adcomputer_unconstrained_delegation_discovery_filter`
 how_to_implement: The following  analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators or power users may leverage PowerView for system management or troubleshooting.
 references:
@@ -37,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious PowerShell Get-ADComputer was identified on endpoint $dest$
     entity:
diff --git a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml
index 0b7b1511005..94444477b0c 100644
--- a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml
+++ b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Find-LocalAdminAccess` cmdlet using PowerShell Script Block Logging (EventCode=4104). This cmdlet is part of PowerView, a toolkit for Windows domain enumeration. Identifying the use of `Find-LocalAdminAccess` is crucial as adversaries may use it to find machines where the current user has local administrator access, facilitating lateral movement or privilege escalation. If confirmed malicious, this activity could allow attackers to target and compromise additional systems within the network, significantly increasing their control and access to sensitive information.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*Find-LocalAdminAccess*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_get_local_admin_with_findlocaladminaccess_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Find-LocalAdminAccess*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_get_local_admin_with_findlocaladminaccess_filter`
 how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators may leverage PowerSploit tools for legitimate reasons, filter as needed.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious PowerShell Find-LocalAdminAccess was identified on endpoint $dest$ by user $user_id$.
     entity:
diff --git a/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml b/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml
index 137faa5a6cb..48a2e51ff5c 100644
--- a/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml
+++ b/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml
@@ -6,34 +6,17 @@ modification_date: '2026-10-02'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    An attacker can obtain persistence by hijacking the PowerShell cmdlet 'Get-Variable' by placing Get-Variable.exe in the WindowsApps folder, which is part of the PowerShell path.
+description: 'An attacker can obtain persistence by hijacking the PowerShell cmdlet ''Get-Variable'' by placing Get-Variable.exe in the WindowsApps folder, which is part of the PowerShell path.
+
     Whenever a PowerShell window is opened via a scheduled task, the malicious Get-Variable.exe will be run.
-    This activity was first associated with the Colibri malware.
+
+    This activity was first associated with the Colibri malware.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_path="*\\AppData\\Local\\Microsoft\\WindowsApps\\Get-Variable.exe"
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_get_variable_exe_execution_from_windowsapps_folder_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path="*\\AppData\\Local\\Microsoft\\WindowsApps\\Get-Variable.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_get_variable_exe_execution_from_windowsapps_folder_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate administrative tools may use custom executables in the WindowsApps folder for persistence or automation. Verify the executable's origin before flagging to avoid false positives.
 references:
@@ -47,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_global_object_access_audit_list_cleared_via_auditpol.yml b/detections/endpoint/windows_global_object_access_audit_list_cleared_via_auditpol.yml
index cb87f3db7da..a69a667174c 100644
--- a/detections/endpoint/windows_global_object_access_audit_list_cleared_via_auditpol.yml
+++ b/detections/endpoint/windows_global_object_access_audit_list_cleared_via_auditpol.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_auditpol` Processes.process="*/resourceSACL*" Processes.process IN ("*/clear*", "*/remove*")
-        AND
-        NOT Processes.process="*/?*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_global_object_access_audit_list_cleared_via_auditpol_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*auditpol.exe" OR Processes.original_file_name="AUDITPOL.EXE" Processes.process="*/resourceSACL*" Processes.process IN ("*/clear*", "*/remove*") NOT Processes.process="*/**" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_global_object_access_audit_list_cleared_via_auditpol_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be rare to non existent. Any activity detected by this analytic should be investigated and approved or denied.
 references:
@@ -39,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to clear the global object access audit policy on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/windows_grimresource___mmc_process_accessing_apds_dll.yml b/detections/endpoint/windows_grimresource___mmc_process_accessing_apds_dll.yml
index 6fc4addd230..9ce0b0e2406 100644
--- a/detections/endpoint/windows_grimresource___mmc_process_accessing_apds_dll.yml
+++ b/detections/endpoint/windows_grimresource___mmc_process_accessing_apds_dll.yml
@@ -6,27 +6,15 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    GrimResource is a code execution technique discovered by Elastic Security in 2024 that abuses a stored XSS vulnerability in apds.dll to achieve arbitrary code execution inside mmc.exe, a signed, trusted Windows binary.
+description: 'GrimResource is a code execution technique discovered by Elastic Security in 2024 that abuses a stored XSS vulnerability in apds.dll to achieve arbitrary code execution inside mmc.exe, a signed, trusted Windows binary.
+
     The attack is delivered via a malicious .msc file (MMC Saved Console file).
-    When the victim opens the .msc file, MMC processes an embedded transformNode operation that triggers the XSS in apds.dll, which is then leveraged to execute attacker-controlled script within the MMC process context.
+
+    When the victim opens the .msc file, MMC processes an embedded transformNode operation that triggers the XSS in apds.dll, which is then leveraged to execute attacker-controlled script within the MMC process context.'
 data_source:
     - Windows Event Log Security 4663
-search: |-
-    `wineventlog_security`
-    AccessList="%%4416"
-    EventID="4663"
-    ObjectName="*:\\Windows\\System32\\apds.dll"
-    ProcessName="*:\\Windows\\System32\\mmc.exe"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer AccessList EventID ObjectName ProcessName
-
-    | rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_grimresource___mmc_process_accessing_apds_dll_filter`
+search: |
+    `wineventlog_security` EventCode=4663 AccessList="%%4416" ObjectName="*:\\Windows\\System32\\apds.dll" ProcessName="*:\\Windows\\System32\\mmc.exe" | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_grimresource___mmc_process_accessing_apds_dll_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate use of mmc.exe accessing apds.dll may occur during routine system management or troubleshooting. Verify with approved administrative activities to reduce false alerts.
 references:
@@ -40,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: mmc.exe accessed apds.dll on $dest$, consistent with GrimResource activity.
     entity:
diff --git a/detections/endpoint/windows_group_discovery_via_net.yml b/detections/endpoint/windows_group_discovery_via_net.yml
index 1e10212df4c..23adb8ee095 100644
--- a/detections/endpoint/windows_group_discovery_via_net.yml
+++ b/detections/endpoint/windows_group_discovery_via_net.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*group*" AND NOT (Processes.process="*/add" OR Processes.process="*/delete") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_group_discovery_via_net_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*net1.exe" OR Processes.original_file_name="net1.exe" Processes.process="*group*" NOT (Processes.process IN ("*/add", "*/delete")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_group_discovery_via_net_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/windows_group_policy_object_created.yml b/detections/endpoint/windows_group_policy_object_created.yml
index ea402912a89..d2b7a8971fc 100644
--- a/detections/endpoint/windows_group_policy_object_created.yml
+++ b/detections/endpoint/windows_group_policy_object_created.yml
@@ -10,14 +10,8 @@ description: The following analytic detects the creation of a new Group Policy O
 data_source:
     - Windows Event Log Security 5136
     - Windows Event Log Security 5137
-search: |-
-    `wineventlog_security` EventCode=5137 OR (EventCode=5136 AttributeValue!="New Group Policy Object" AND (AttributeLDAPDisplayName=displayName OR AttributeLDAPDisplayName=gPCFileSysPath) ) ObjectClass=groupPolicyContainer
-      | stats values(AttributeValue) as details values(SubjectUserSid) as User values(ObjectDN) as ObjectDN
-        BY ObjectGUID Computer dest
-      | eval GPO_Name = mvindex(details, 0)
-      | eval GPO_Path = mvindex(details, 1)
-      | fields - details
-      | `windows_group_policy_object_created_filter`
+search: |
+    `wineventlog_security` EventCode=5136 EventCode="5137" OR (NOT AttributeValue="New Group Policy Object" AttributeLDAPDisplayName IN ("displayName", "gPCFileSysPath") ObjectClass="groupPolicyContainer") | eval ObjectDN=ObjectDN, SubjectUserName=SubjectUserName, SubjectUserSid=SubjectUserSid, Computer=Computer, User=SubjectUserSid, user=SubjectUserName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_group_policy_object_created_filter`
 how_to_implement: To successfully implement this search, the Advanced Security Audit policy setting `Audit Directory Service Changes` within `DS Access` needs to be enabled. Furthermore, the appropriate system access control lists (SACL) need to be created as the used events are not logged by default. A good guide to accomplish this can be found here https://jgspiers.com/audit-group-policy-changes/.
 known_false_positives: Group Policy Objects are created as part of regular administrative operations, filter as needed.
 references:
@@ -35,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$User$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$User$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new group policy objected was created by $User$
     entity:
diff --git a/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml b/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml
index 3fabe37f10b..849f211b32b 100644
--- a/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml
+++ b/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml
@@ -6,36 +6,15 @@ modification_date: '2026-10-02'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    By default, the Windows guest account is heavily restricted, with limited permissions and access to system resources.
-    However, if the guest account is activated, it can potentially be used to perform malicious activities such as installing malware, deleting files, stealing data, or even taking control of the system.
+description: 'By default, the Windows guest account is heavily restricted, with limited permissions and access to system resources.
+
+    However, if the guest account is activated, it can potentially be used to perform malicious activities such as installing malware, deleting files, stealing data, or even taking control of the system.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    `process_net`
-    Processes.process="*user *"
-    Processes.process="*guest *"
-    Processes.process="*/active:yes*"
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_guest_account_enabled_via_net_exe_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*net1.exe" OR Processes.original_file_name="net1.exe" Processes.process="*user *" Processes.process="*guest *" Processes.process="*/active:yes*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_guest_account_enabled_via_net_exe_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: The Windows guest account may be activated by IT or support teams for temporary access or troubleshooting. Filter activations related to authorized maintenance activities to reduce false alerts.
 references:
@@ -48,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml b/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml
index 051bcd7b7bc..2a300873d38 100644
--- a/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml
+++ b/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml
@@ -6,52 +6,13 @@ modification_date: '2026-09-08'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects duplicate-handle access to known UAC-bypass binaries from a non-standard source path.
-    It leverages Sysmon EventCode 10, converts GrantedAccess from hexadecimal, and checks for PROCESS_DUP_HANDLE.
+description: 'The following analytic detects duplicate-handle access to known UAC-bypass binaries from a non-standard source path.
+
+    It leverages Sysmon EventCode 10, converts GrantedAccess from hexadecimal, and checks for PROCESS_DUP_HANDLE.'
 data_source:
     - Sysmon EventID 10
-search: |-
-    `sysmon`
-    EventCode=10
-    TargetImage IN(
-        "*\\colorcpl.exe",
-        "*\\ComputerDefaults.exe",
-        "*\\esentutl.exe",
-        "*\\eventvwr.exe",
-        "*\\fodhelper.exe",
-        "*\\mmc.exe",
-        "*\\sdclt.exe",
-        "*\\slui.exe",
-        "*\\wsreset.exe",
-        "*\\PkgMgr.exe"
-    )
-    NOT SourceImage IN (
-        "C:\\Windows\\System32\\*",
-        "C:\\Windows\\SysWOW64\\*",
-        "C:\\Program Files\\*",
-        "C:\\Program Files (x86)\\*",
-        "%SystemRoot%\\*"
-    )
-
-    | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16)
-    | eval PROCESS_DUP_HANDLE = 64
-    | eval dup_handle_set = bit_and (g_access_decimal, PROCESS_DUP_HANDLE)
-    | where dup_handle_set == PROCESS_DUP_HANDLE
-
-    | stats count min(_time) as firstTime
-                    max(_time) as lastTime
-        BY user_id dest
-           signature_id signature granted_access Opcode
-           SourceImage SourceProcessGUID SourceProcessId
-           TargetImage TargetProcessGUID TargetProcessId
-           CallTrace vendor_product
-
-    | eval CallTrace=split(CallTrace, "|")
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_handle_duplication_in_known_uac_bypass_binaries_filter`
+search: |
+    `sysmon` EventCode=10 TargetImage IN ("*\\colorcpl.exe", "*\\ComputerDefaults.exe", "*\\esentutl.exe", "*\\eventvwr.exe", "*\\fodhelper.exe", "*\\mmc.exe", "*\\sdclt.exe", "*\\slui.exe", "*\\wsreset.exe", "*\\PkgMgr.exe") NOT (SourceImage IN ("C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*", "C:\\Program Files\\*", "C:\\Program Files (x86)\\*", "%SystemRoot%\\*")) | eval granted_access=granted_access, parent_process_path=parent_process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest user_id process_name process_guid process_id signature SourceImage TargetImage GrantedAccess CallTrace | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_handle_duplication_in_known_uac_bypass_binaries_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: It is possible legitimate applications will request access to list of know abused Windows UAC binaries process, filter as needed.
 references:
@@ -64,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_hidden_schedule_task_settings.yml b/detections/endpoint/windows_hidden_schedule_task_settings.yml
index 192e56e867e..87c3700d4bf 100644
--- a/detections/endpoint/windows_hidden_schedule_task_settings.yml
+++ b/detections/endpoint/windows_hidden_schedule_task_settings.yml
@@ -10,14 +10,7 @@ description: The following analytic detects the creation of hidden scheduled tas
 data_source:
     - Windows Event Log Security 4698
 search: |
-    `wineventlog_security`
-    EventCode=4698
-    TaskContent = "*&lt;Hidden&gt;true&lt;/Hidden&gt;*"
-    | stats count min(_time) as firstTime max(_time) as lastTime
-      by TaskName TaskContent action signature status dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_hidden_schedule_task_settings_filter`
+    `wineventlog_security` EventCode=4698 TaskContent="*&lt;Hidden&gt;true&lt;/Hidden&gt;*" | eval TaskName=TaskName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hidden_schedule_task_settings_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -31,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A schedule task with hidden setting enable in host $dest$
     entity:
diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml
index 04d9abcb917..80d7027ec6f 100644
--- a/detections/endpoint/windows_hide_notification_features_through_registry.yml
+++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious registry modifications aimed at hiding common Windows notification features on a compromised host. It leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values. This activity is significant as it is often used by ransomware to obscure visual indicators, increasing the impact of the attack. If confirmed malicious, this could prevent users from noticing critical system alerts, thereby aiding the attacker in maintaining persistence and furthering their malicious activities undetected.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hide_notification_features_through_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("*HideClock", "*HideSCAHealth", "*HideSCANetwork", "*HideSCAPower", "*HideSCAVolume") Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hide_notification_features_through_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_high_file_deletion_frequency.yml b/detections/endpoint/windows_high_file_deletion_frequency.yml
index 51147246af9..4765f9adea7 100644
--- a/detections/endpoint/windows_high_file_deletion_frequency.yml
+++ b/detections/endpoint/windows_high_file_deletion_frequency.yml
@@ -10,7 +10,8 @@ description: The following analytic identifies a high frequency of file deletion
 data_source:
     - Sysmon EventID 23
     - Sysmon EventID 26
-search: '`sysmon` EventCode IN ("23","26") TargetFilename IN ("*.cmd", "*.ini","*.gif", "*.jpg", "*.jpeg", "*.db", "*.ps1", "*.doc", "*.docx", "*.xls", "*.xlsx", "*.ppt", "*.pptx", "*.bmp","*.zip", "*.rar", "*.7z", "*.chm", "*.png", "*.log", "*.vbs", "*.js", "*.vhd", "*.bak", "*.wbcat", "*.bkf" , "*.backup*", "*.dsk", "*.win") NOT TargetFilename IN ("*\\INetCache\\Content.Outlook\\*") | stats count min(_time) as firstTime, max(_time) as lastTime values(file_path) as file_path values(file_hash) as file_hash values(file_name) as file_name values(file_modify_time) as file_modify_time values(process_name) as process_name values(process_path) as process_path values(process_guid) as process_guid values(process_id) as process_id values(process_exec) as process_exec by action dest dvc signature signature_id user user_id vendor_product | where count >=100 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_high_file_deletion_frequency_filter`'
+search: |
+    `sysmon` EventCode=23 EventCode="26" TargetFilename IN ("*.cmd", "*.ini", "*.gif", "*.jpg", "*.jpeg", "*.db", "*.ps1", "*.doc", "*.docx", "*.xls", "*.xlsx", "*.ppt", "*.pptx", "*.bmp", "*.zip", "*.rar", "*.7z", "*.chm", "*.png", "*.log", "*.vbs", "*.js", "*.vhd", "*.bak", "*.wbcat", "*.bkf", "*.backup", "*.dsk", "*.win") NOT TargetFilename="*\\INetCache\\Content.Outlook\\*" | stats count min(_time) as firstTime max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_high_file_deletion_frequency_filter`
 how_to_implement: To successfully implement this search, you need to ingest logs that include the deleted target file name, process name, and process ID from your endpoints. If you are using Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed.
 known_false_positives: Users may delete a large number of pictures or files in a folder, which could trigger this detection. Additionally, heavy usage of PowerBI and Outlook may also result in false positives.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml
index 3864cf7a82f..cc35872baeb 100644
--- a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml
+++ b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects a process loading a version.dll file from a directory other than %windir%\system32 or %windir%\syswow64. This detection leverages Sysmon EventCode 7 to identify instances where an unsigned or improperly located version.dll is loaded. This activity is significant as it is a common technique used in ransomware and APT malware campaigns, including Brute Ratel C4, to execute malicious code via DLL side loading. If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, and potentially compromise the target host.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7 ImageLoaded = "*\\version.dll" AND (Signed = "false" OR NOT(ImageLoaded IN("*\\windows\\system32*",  "*\\windows\\syswow64\\*"))) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hijack_execution_flow_version_dll_side_load_filter`'
+search: |
+    `sysmon` EventCode=7 ImageLoaded="*\\version.dll" NOT (ImageLoaded IN ("*\\system32\\*", "*\\syswow64\\*")) OR Signed="false" | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hijack_execution_flow_version_dll_side_load_filter`
 how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_hosts_file_access.yml b/detections/endpoint/windows_hosts_file_access.yml
index accdd50bec1..344d9cdcf4e 100644
--- a/detections/endpoint/windows_hosts_file_access.yml
+++ b/detections/endpoint/windows_hosts_file_access.yml
@@ -6,10 +6,11 @@ modification_date: '2026-09-22'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    This Analytic detects the execution of a process attempting to access the hosts file.
+description: 'This Analytic detects the execution of a process attempting to access the hosts file.
+
     The hosts file is a critical file for network configuration and DNS resolution.
-    If an attacker gains access to it, they can redirect traffic to malicious websites, serve fake content or block legitimate security websites.
+
+    If an attacker gains access to it, they can redirect traffic to malicious websites, serve fake content or block legitimate security websites.'
 data_source:
     - Windows Event Log Security 4663
 search: |
@@ -35,8 +36,7 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_hosts_file_access_filter`
-how_to_implement: |
-    To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." This search may trigger on a browser application that is not included in the browser_app_list lookup file.
+how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." This search may trigger on a browser application that is not included in the browser_app_list lookup file.
 known_false_positives: Administrator may access this registry for product key recovery purposes.
 references:
     - https://cert.gov.ua/article/6284730
@@ -48,7 +48,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml
index 7c39c7ede9e..c3ad996afbd 100644
--- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml
+++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml
@@ -10,7 +10,7 @@ description: The following analytic detects MSIExec making network connections o
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 3
     - Cisco Network Visibility Module Flow Data
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count
 
@@ -67,7 +67,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml
index e0297ff3846..0b53ae70cdc 100644
--- a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml
+++ b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml
@@ -9,22 +9,8 @@ type: Hunting
 description: The following analytic identifies processes attempting to access Lsass.exe, which may indicate credential dumping or applications needing credential access. It leverages Sysmon EventCode 10 to detect such activities by analyzing fields like TargetImage, GrantedAccess, and SourceImage. This behavior is significant as unauthorized access to Lsass.exe can lead to credential theft, posing a severe security risk. If confirmed malicious, attackers could gain access to sensitive credentials, potentially leading to privilege escalation and further compromise of the environment.
 data_source:
     - Sysmon EventID 10
-search: |-
-    `sysmon` EventCode=10 TargetImage=*lsass.exe
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY CallTrace EventID GrantedAccess
-           Guid Opcode ProcessID
-           SecurityID SourceImage SourceProcessGUID
-           SourceProcessId TargetImage TargetProcessGUID
-           TargetProcessId UserID dest
-           granted_access parent_process_exec parent_process_guid
-           parent_process_id parent_process_name parent_process_path
-           process_exec process_guid process_id
-           process_name process_path signature
-           signature_id user_id vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_hunting_system_account_targeting_lsass_filter`
+search: |
+    `sysmon` EventCode=10 TargetImage="*lsass.exe" | eval granted_access=granted_access, parent_process_path=parent_process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest user_id process_name process_guid process_id signature SourceImage TargetImage GrantedAccess CallTrace | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hunting_system_account_targeting_lsass_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
 known_false_positives: False positives will occur based on GrantedAccess and SourceUser, filter based on source image as needed. Utilize this hunting analytic to tune out false positives in TTP or anomaly analytics.
 references:
diff --git a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
index 8c6585b0de0..a5863a9aab5 100644
--- a/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
+++ b/detections/endpoint/windows_identify_powershell_web_access_iis_pool.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: This analytic detects and analyzes PowerShell Web Access (PSWA) usage in Windows environments. It tracks both connection attempts (EventID 4648) and successful logons (EventID 4624) associated with PSWA, providing a comprehensive view of access patterns. The analytic identifies PSWA's operational status, host servers, processes, and connection metrics. It highlights unique target accounts, domains accessed, and verifies logon types. This information is crucial for detecting potential misuse, such as lateral movement, brute force attempts, or unusual access patterns. By offering insights into PSWA activity, it enables security teams to quickly assess and investigate potential security incidents involving this powerful administrative tool.
 data_source:
     - Windows Event Log Security 4648
-search: '`wineventlog_security` (EventCode=4648 OR EventCode=4624 OR EventCode=4625) SubjectUserName="pswa_pool" | fields EventCode, SubjectUserName, TargetUserName, Computer, TargetDomainName, ProcessName, LogonType | rename Computer as dest | stats count(eval(EventCode=4648)) as "Connection Attempts", count(eval(EventCode=4624)) as "Successful Logons", count(eval(EventCode=4625)) as "Unsuccessful Logons", dc(TargetUserName) as "Unique Target Accounts", values(dest) as "PSWA Host", dc(TargetDomainName) as "Unique Target Domains", values(ProcessName) as "PSWA Process", values(TargetUserName) as "Target Users List", values(TargetServerName) as "Target Servers List", values(LogonType) as "Logon Types" | eval PSWA_Running = "Yes", "PSWA Process" = mvindex(split(mvindex("PSWA Process", 0), "\\"), -1) | fields PSWA_Running, "PSWA Host", "PSWA Process", "Connection Attempts", "Successful Logons","Unsuccessful Logons", "Unique Target Accounts", "Unique Target Domains", "Target Users List","Target Servers List", "Logon Types" | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `windows_identify_powershell_web_access_iis_pool_filter`'
+search: |
+    `wineventlog_security` EventCode=4648 EventCode IN ("4624", "4625") SubjectUserName="pswa_pool" | stats count min(_time) as firstTime max(_time) as lastTime by dest src_ip user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_identify_powershell_web_access_iis_pool_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event logs, specifically Event ID 4648 (A logon was attempted using explicit credentials). Ensure that your Windows systems are configured to audit logon events and that these logs are being forwarded to your SIEM or log management solution. You may need to enable advanced audit policy settings in Windows to capture these events. Additionally, make sure that your environment is set up to capture the necessary fields such as SubjectUserName, TargetUserName, Computer, TargetServerName, and ProcessName from these events. If you're using Splunk, ensure that you have the appropriate Windows TA installed and configured to collect these security logs.
 known_false_positives: False positives may occur if legitimate PSWA processes are used for administrative tasks. Careful review of the logs is recommended to distinguish between legitimate and malicious activity.
 references:
@@ -30,6 +31,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/pswa/4648_4624_pswa_pool.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Security
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml
index fc2a6a88253..ccb4feba656 100644
--- a/detections/endpoint/windows_identify_protocol_handlers.yml
+++ b/detections/endpoint/windows_identify_protocol_handlers.yml
@@ -11,7 +11,7 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process FROM datamodel=Endpoint.Processes
       BY Processes.action Processes.dest Processes.original_file_name
          Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
diff --git a/detections/endpoint/windows_iis_components_add_new_module.yml b/detections/endpoint/windows_iis_components_add_new_module.yml
index 3fbc5d7fbcc..8e67a334301 100644
--- a/detections/endpoint/windows_iis_components_add_new_module.yml
+++ b/detections/endpoint/windows_iis_components_add_new_module.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE NOT (Processes.parent_process_name  IN ("msiexec.exe", "iissetup.exe")) Processes.process_name=appcmd.exe Processes.process IN ("*install *", "*module *")
-        AND
-        Processes.process="*image*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_iis_components_add_new_module_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT (Processes.parent_process_name IN ("*msiexec.exe", "*iissetup.exe")) Processes.process_name="*appcmd.exe" Processes.process IN ("*install *", "*module *") Processes.process="*image*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iis_components_add_new_module_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present until properly tuned. Filter as needed.
 references:
@@ -45,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml b/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml
index 8b50516dc49..61685950950 100644
--- a/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml
+++ b/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic identifies the execution of the PowerShell cmdlet Get-WebGlobalModule, which lists all IIS Modules installed on a system. It leverages PowerShell input data to detect this activity by capturing the module names and the image paths of the DLLs. This activity is significant for a SOC because it can indicate an attempt to enumerate installed IIS modules, which could be a precursor to exploiting vulnerabilities or misconfigurations. If confirmed malicious, this could allow an attacker to gain insights into the web server's configuration, potentially leading to further exploitation or privilege escalation.
 data_source:
     - Powershell Installed IIS Modules
-search: |-
+search: |
     `iis_get_webglobalmodule`
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY host name image
diff --git a/detections/endpoint/windows_iis_components_module_failed_to_load.yml b/detections/endpoint/windows_iis_components_module_failed_to_load.yml
index fc4a2d66698..0b43dbffcc9 100644
--- a/detections/endpoint/windows_iis_components_module_failed_to_load.yml
+++ b/detections/endpoint/windows_iis_components_module_failed_to_load.yml
@@ -9,14 +9,8 @@ type: Anomaly
 description: The following analytic detects when an IIS Module DLL fails to load due to a configuration problem, identified by EventCode 2282. This detection leverages Windows Application event logs to identify repeated failures in loading IIS modules. Such failures can indicate misconfigurations or potential tampering with IIS components. If confirmed malicious, this activity could lead to service disruptions or provide an attacker with opportunities to exploit vulnerabilities within the IIS environment. Immediate investigation is required to determine the legitimacy of the failing module and to mitigate any potential security risks.
 data_source:
     - Windows Event Log Application 2282
-search: |-
-    `wineventlog_application` EventCode=2282
-      | stats  count min(_time) as firstTime max(_time) as lastTime
-        BY EventCode dest Name
-           ModuleDll
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_iis_components_module_failed_to_load_filter`
+search: |
+    `wineventlog_application` EventCode="2282" | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iis_components_module_failed_to_load_filter`
 how_to_implement: IIS must be installed and Application event logs must be collected in order to utilize this analytic.
 known_false_positives: False positives will be present until all module failures are resolved or reviewed.
 references:
@@ -35,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_iis_components_new_module_added.yml b/detections/endpoint/windows_iis_components_new_module_added.yml
index e9e7758e4c2..a89b434e945 100644
--- a/detections/endpoint/windows_iis_components_new_module_added.yml
+++ b/detections/endpoint/windows_iis_components_new_module_added.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the addition of new IIS modules on a Windows IIS server. It leverages the Windows Event log - Microsoft-IIS-Configuration/Operational, specifically EventCode 29, to identify this activity. This behavior is significant because IIS modules are rarely added to production servers, and unauthorized modules could indicate malicious activity. If confirmed malicious, an attacker could use these modules to execute arbitrary code, escalate privileges, or maintain persistence within the environment, potentially compromising the server and sensitive data.
 data_source:
     - Windows IIS 29
-search: |-
+search: |
     `iis_operational_logs` EventCode=29
       | stats  count min(_time) as firstTime max(_time) as lastTime
         BY OpCode EventCode ComputerName
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A new IIS Module has been loaded and should be reviewed on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml b/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml
index 8164b336ac4..e878b3dfefb 100644
--- a/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml
+++ b/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml
@@ -11,26 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_powershell`
-        AND
-        Processes.process="*Import-Module Applocker*"
-        AND
-        Processes.process="*Set-AppLockerPolicy *"
-        AND
-        Processes.process="* -XMLPolicy *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_impair_defense_add_xml_applocker_rules_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") Processes.process="*Import-Module Applocker*" Processes.process="*Set-AppLockerPolicy *" Processes.process="* -XMLPolicy *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_add_xml_applocker_rules_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may execute this command that may cause some false positive.
 references:
diff --git a/detections/endpoint/windows_impair_defense_change_win_defender_health_check_intervals.yml b/detections/endpoint/windows_impair_defense_change_win_defender_health_check_intervals.yml
index b9642a7f5ab..50ec6684664 100644
--- a/detections/endpoint/windows_impair_defense_change_win_defender_health_check_intervals.yml
+++ b/detections/endpoint/windows_impair_defense_change_win_defender_health_check_intervals.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that change the health check interval of Windows Defender. It leverages data from the Endpoint datamodel, specifically monitoring changes to the "ServiceKeepAlive" registry path with a value of "0x00000001". This activity is significant because altering Windows Defender settings can impair its ability to perform timely health checks, potentially leaving the system vulnerable. If confirmed malicious, this could allow an attacker to disable or delay security scans, increasing the risk of undetected malware or other malicious activities.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\ServiceKeepAlive" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_change_win_defender_health_check_intervals_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\ServiceKeepAlive" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_change_win_defender_health_check_intervals_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: change in the health check interval of Windows Defender on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_change_win_defender_quick_scan_interval.yml b/detections/endpoint/windows_impair_defense_change_win_defender_quick_scan_interval.yml
index 81c46ac8121..106c494809a 100644
--- a/detections/endpoint/windows_impair_defense_change_win_defender_quick_scan_interval.yml
+++ b/detections/endpoint/windows_impair_defense_change_win_defender_quick_scan_interval.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that change the Windows Defender Quick Scan Interval. It leverages data from the Endpoint.Registry data model, focusing on changes to the "QuickScanInterval" registry path. This activity is significant because altering the scan interval can impair Windows Defender's ability to detect malware promptly, potentially allowing threats to persist undetected. If confirmed malicious, this modification could enable attackers to bypass security measures, maintain persistence, and execute further malicious activities without being detected by quick scans.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Scan\\QuickScanInterval" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_change_win_defender_quick_scan_interval_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\Scan\\QuickScanInterval" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_change_win_defender_quick_scan_interval_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender QuickScanInterval feature was modified on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_change_win_defender_throttle_rate.yml b/detections/endpoint/windows_impair_defense_change_win_defender_throttle_rate.yml
index 62a52f40509..c2e03962775 100644
--- a/detections/endpoint/windows_impair_defense_change_win_defender_throttle_rate.yml
+++ b/detections/endpoint/windows_impair_defense_change_win_defender_throttle_rate.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the ThrottleDetectionEventsRate registry setting in Windows Defender. It leverages data from the Endpoint.Registry datamodel to identify changes in the registry path related to Windows Defender's event logging rate. This activity is significant because altering the ThrottleDetectionEventsRate can reduce the frequency of logged detection events, potentially masking malicious activities. If confirmed malicious, this could allow an attacker to evade detection by decreasing the visibility of security events, thereby hindering incident response and forensic investigations.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\NIS\\Consumers\\IPS\\ThrottleDetectionEventsRate" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_change_win_defender_throttle_rate_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\NIS\\Consumers\\IPS\\ThrottleDetectionEventsRate" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_change_win_defender_throttle_rate_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender ThrottleDetectionEventsRate feature was modified on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_change_win_defender_tracing_level.yml b/detections/endpoint/windows_impair_defense_change_win_defender_tracing_level.yml
index d96924c4ca8..d378f6f1c02 100644
--- a/detections/endpoint/windows_impair_defense_change_win_defender_tracing_level.yml
+++ b/detections/endpoint/windows_impair_defense_change_win_defender_tracing_level.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry specifically targeting the "WppTracingLevel" setting within Windows Defender. This detection leverages data from the Endpoint.Registry data model to identify changes in the registry path associated with Windows Defender tracing levels. Such modifications are significant as they can impair the diagnostic capabilities of Windows Defender, potentially hiding malicious activities. If confirmed malicious, this activity could allow an attacker to evade detection and maintain persistence within the environment, leading to further compromise and data exfiltration.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Reporting\\WppTracingLevel" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_change_win_defender_tracing_level_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\Reporting\\WppTracingLevel" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_change_win_defender_tracing_level_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender WppTracingLevel registry was modified on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_configure_app_install_control.yml b/detections/endpoint/windows_impair_defense_configure_app_install_control.yml
index 66968d61b3e..4188f9e10a2 100644
--- a/detections/endpoint/windows_impair_defense_configure_app_install_control.yml
+++ b/detections/endpoint/windows_impair_defense_configure_app_install_control.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that disable the Windows Defender SmartScreen App Install Control feature. It leverages data from the Endpoint.Registry data model to identify changes to specific registry values. This activity is significant because disabling App Install Control can allow users to install potentially malicious web-based applications without restrictions, increasing the risk of security vulnerabilities. If confirmed malicious, this action could lead to the installation of harmful applications, potentially compromising the system and exposing sensitive information.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows Defender\\SmartScreen\\ConfigureAppInstallControl" Registry.registry_value_data= "Anywhere") OR (Registry.registry_path= "*\\Microsoft\\Windows Defender\\SmartScreen\\ConfigureAppInstallControlEnabled" Registry.registry_value_data= "0x00000000") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_configure_app_install_control_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows Defender\\SmartScreen\\ConfigureAppInstallControl" Registry.registry_value_data="Anywhere") OR (Registry.registry_path="*\\Microsoft\\Windows Defender\\SmartScreen\\ConfigureAppInstallControlEnabled" Registry.registry_value_data="0x00000000") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_configure_app_install_control_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Define Windows Defender App Install Control registry set to disable on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_define_win_defender_threat_action.yml b/detections/endpoint/windows_impair_defense_define_win_defender_threat_action.yml
index 97346fc8f63..c2349bc4ab5 100644
--- a/detections/endpoint/windows_impair_defense_define_win_defender_threat_action.yml
+++ b/detections/endpoint/windows_impair_defense_define_win_defender_threat_action.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows Defender ThreatSeverityDefaultAction registry setting. It leverages data from the Endpoint.Registry datamodel to identify changes in registry values that define how Windows Defender responds to threats. This activity is significant because altering these settings can impair the system's defense mechanisms, potentially allowing threats to go unaddressed. If confirmed malicious, this could enable attackers to bypass antivirus protections, leading to persistent threats and increased risk of data compromise or further system exploitation.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Threats\\ThreatSeverityDefaultAction*" Registry.registry_value_data IN ("0x00000001", "9") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_define_win_defender_threat_action_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\Threats\\ThreatSeverityDefaultAction*" Registry.registry_value_data IN ("0x00000001", "9") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_define_win_defender_threat_action_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Define Windows Defender threat action through registry on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml
index 40e272928c7..c0ddce445d8 100644
--- a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml
+++ b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects the deletion of the Windows Defender context menu entry from the registry. It leverages data from the Endpoint datamodel, specifically monitoring registry actions where the path includes "*\\shellex\\ContextMenuHandlers\\EPP" and the action is 'deleted'. This activity is significant as it is commonly associated with Remote Access Trojan (RAT) malware attempting to disable security features. If confirmed malicious, this could allow an attacker to impair defenses, facilitating further malicious activities such as unauthorized access, persistence, and data exfiltration.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\shellex\\ContextMenuHandlers\\EPP" Registry.action = deleted by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_context_menu_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\shellex\\ContextMenuHandlers\\EPP" Registry.action="deleted" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_context_menu_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml
index ef19e2b7b43..75477b2dcab 100644
--- a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml
+++ b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the deletion of the Windows Defender main profile registry key. It leverages data from the Endpoint.Registry datamodel, specifically monitoring for deleted actions within the Windows Defender registry path. This activity is significant as it indicates potential tampering with security defenses, often associated with Remote Access Trojans (RATs) and other malware. If confirmed malicious, this action could allow an attacker to disable Windows Defender, reducing the system's ability to detect and respond to further malicious activities, thereby compromising endpoint security.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_profile_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Policies\\Microsoft\\Windows Defender" Registry.action="deleted" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_profile_registry_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml b/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml
index 77d8425ba96..7da2f1ba3d0 100644
--- a/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml
+++ b/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications in the Windows registry by the Applocker utility that deny the execution of various security products. This detection leverages data from the Endpoint.Registry datamodel, focusing on specific registry paths and values indicating a "Deny" action against known antivirus and security software. This activity is significant as it may indicate an attempt to disable security defenses, a tactic observed in malware like Azorult. If confirmed malicious, this could allow attackers to bypass security measures, facilitating further malicious activities and persistence within the environment.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy Objects\\*" AND Registry.registry_path= "*}Machine\\Software\\Policies\\Microsoft\\Windows\\SrpV2*") OR Registry.registry_path="*\\Software\\Policies\\Microsoft\\Windows\\SrpV2*" AND Registry.registry_value_data = "*Action\=\"Deny\"*" AND Registry.registry_value_data IN("*O=SYMANTEC*","*O=MCAFEE*","*O=KASPERSKY*","*O=BLEEPING COMPUTER*", "*O=PANDA SECURITY*","*O=SYSTWEAK SOFTWARE*", "*O=TREND MICRO*", "*O=AVAST*", "*O=GRIDINSOFT*", "*O=MICROSOFT*", "*O=NANO SECURITY*", "*O=SUPERANTISPYWARE.COM*", "*O=DOCTOR WEB*", "*O=MALWAREBYTES*", "*O=ESET*", "*O=AVIRA*", "*O=WEBROOT*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_deny_security_software_with_applocker_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy Objects\\*" Registry.registry_path="*}Machine\\Software\\Policies\\Microsoft\\Windows\\SrpV2*") OR (Registry.registry_path="*\\Software\\Policies\\Microsoft\\Windows\\SrpV2*" Registry.registry_value_data="*Action=\"Deny\"*" Registry.registry_value_data IN ("*O=SYMANTEC*", "*O=MCAFEE*", "*O=KASPERSKY*", "*O=BLEEPING COMPUTER*", "*O=PANDA SECURITY*", "*O=SYSTWEAK SOFTWARE*", "*O=TREND MICRO*", "*O=AVAST*", "*O=GRIDINSOFT*", "*O=MICROSOFT*", "*O=NANO SECURITY*", "*O=SUPERANTISPYWARE.COM*", "*O=DOCTOR WEB*", "*O=MALWAREBYTES*", "*O=ESET*", "*O=AVIRA*", "*O=WEBROOT*")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_deny_security_software_with_applocker_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: False positives may be present based on organization use of Applocker. Filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Applocker registry modification to deny the action of several AV products on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_disable_controlled_folder_access.yml b/detections/endpoint/windows_impair_defense_disable_controlled_folder_access.yml
index e6c753444da..ba888896276 100644
--- a/detections/endpoint/windows_impair_defense_disable_controlled_folder_access.yml
+++ b/detections/endpoint/windows_impair_defense_disable_controlled_folder_access.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a modification in the Windows registry that disables the Windows Defender Controlled Folder Access feature. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the EnableControlledFolderAccess registry setting. This activity is significant because Controlled Folder Access is designed to protect critical folders from unauthorized access, including ransomware attacks. If this activity is confirmed malicious, it could allow attackers to bypass a key security feature, potentially leading to unauthorized access or modification of sensitive files.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Windows Defender Exploit Guard\\Controlled Folder Access\\EnableControlledFolderAccess" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_controlled_folder_access_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\Windows Defender Exploit Guard\\Controlled Folder Access\\EnableControlledFolderAccess" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_controlled_folder_access_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender ControlledFolderAccess feature set to disable on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_disable_defender_firewall_and_network.yml b/detections/endpoint/windows_impair_defense_disable_defender_firewall_and_network.yml
index 23647b05c52..014479a72c4 100644
--- a/detections/endpoint/windows_impair_defense_disable_defender_firewall_and_network.yml
+++ b/detections/endpoint/windows_impair_defense_disable_defender_firewall_and_network.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications in the Windows registry to disable firewall and network protection settings within Windows Defender Security Center. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the UILockdown registry value. This activity is significant as it may indicate an attempt to impair system defenses, potentially restricting users from modifying firewall or network protection settings. If confirmed malicious, this could allow an attacker to weaken the system's security posture, making it more vulnerable to further attacks and unauthorized access.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender Security Center\\Firewall and network protection\\UILockdown" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_defender_firewall_and_network_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender Security Center\\Firewall and network protection\\UILockdown" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_defender_firewall_and_network_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender firewall and network protection section feature set to disable on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_disable_defender_protocol_recognition.yml b/detections/endpoint/windows_impair_defense_disable_defender_protocol_recognition.yml
index 2394bc60548..4d332f20853 100644
--- a/detections/endpoint/windows_impair_defense_disable_defender_protocol_recognition.yml
+++ b/detections/endpoint/windows_impair_defense_disable_defender_protocol_recognition.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that disable the Windows Defender protocol recognition feature. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the "DisableProtocolRecognition" setting. This activity is significant because disabling protocol recognition can hinder Windows Defender's ability to detect and respond to malware or suspicious software. If confirmed malicious, this action could allow an attacker to bypass antivirus defenses, facilitating further malicious activities such as data exfiltration or system compromise.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\NIS\\DisableProtocolRecognition" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_defender_protocol_recognition_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\NIS\\DisableProtocolRecognition" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_defender_protocol_recognition_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender Protocol Recognition set to disable on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_disable_pua_protection.yml b/detections/endpoint/windows_impair_defense_disable_pua_protection.yml
index 9371b52d8fb..52801af904a 100644
--- a/detections/endpoint/windows_impair_defense_disable_pua_protection.yml
+++ b/detections/endpoint/windows_impair_defense_disable_pua_protection.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a modification in the Windows registry to disable Windows Defender PUA protection by setting PUAProtection to 0. This detection leverages data from the Endpoint.Registry datamodel, focusing on registry path changes related to Windows Defender. Disabling PUA protection is significant as it reduces defenses against Potentially Unwanted Applications (PUAs), which, while not always malicious, can negatively impact user experience and security. If confirmed malicious, this activity could allow an attacker to introduce adware, browser toolbars, or other unwanted software, potentially compromising system integrity and user productivity.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\PUAProtection" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_pua_protection_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\PUAProtection" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_pua_protection_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender PUA protection set to disable on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml b/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml
index 154eaa595a9..22a4cc58307 100644
--- a/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml
+++ b/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that disable the Windows Defender real-time signature delivery feature. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path associated with Windows Defender signature updates. This activity is significant because disabling real-time signature delivery can prevent Windows Defender from receiving timely malware definitions, reducing its effectiveness. If confirmed malicious, this action could allow attackers to bypass malware detection, leading to potential system compromise and persistent threats.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Signature Updates\\RealtimeSignatureDelivery" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_realtime_signature_delivery_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\Signature Updates\\RealtimeSignatureDelivery" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_realtime_signature_delivery_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender File realtime signature delivery set to disable on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml b/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml
index 2401d085206..b3c4d07c81d 100644
--- a/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml
+++ b/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml
@@ -10,16 +10,7 @@ description: The following analytic detects modifications to the Windows registr
 data_source:
     - Sysmon EventID 13
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
-    WHERE (
-           Registry.registry_path= "*\\Windows\\CurrentVersion\\AppHost\\EnableWebContentEvaluation"  AND
-           Registry.registry_value_data IN (0, "0x00000000")
-           )
-           by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
-           | `drop_dm_object_name(Registry)`
-           | `security_content_ctime(firstTime)`
-           | `security_content_ctime(lastTime)`
-           | `windows_impair_defense_disable_web_evaluation_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows\\CurrentVersion\\AppHost\\EnableWebContentEvaluation" Registry.registry_value_data IN ("0", "0x00000000") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_web_evaluation_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -33,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender web content evaluation feature set to disable on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml
index ab5b4236a43..0411cbc86d5 100644
--- a/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml
+++ b/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that disable Windows Defender Application Guard auditing. It leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values. This activity is significant because disabling auditing can hinder security monitoring and threat detection within the isolated environment, making it easier for malicious activities to go unnoticed. If confirmed malicious, this action could allow attackers to bypass Windows Defender protections, potentially leading to unauthorized access, data exfiltration, or further system compromise.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Policies\\Microsoft\\AppHVSI\\AuditApplicationGuard" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_app_guard_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Policies\\Microsoft\\AppHVSI\\AuditApplicationGuard" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_app_guard_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender AuditApplicationGuard feature set to disable on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml
index 3cdb986f38c..f7e2e6481ae 100644
--- a/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml
+++ b/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that disable Windows Defender's file hash computation by setting the EnableFileHashComputation value to 0. This detection leverages data from the Endpoint.Registry data model, focusing on changes to the specific registry path associated with Windows Defender. Disabling file hash computation can significantly impair Windows Defender's ability to detect and scan for malware, making it a critical behavior to monitor. If confirmed malicious, this activity could allow attackers to bypass Windows Defender, facilitating undetected malware execution and persistence in the environment.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\MpEngine\\EnableFileHashComputation" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_compute_file_hashes_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\MpEngine\\EnableFileHashComputation" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_compute_file_hashes_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender File hashes computation set to disable on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml
index fd585f607e0..8989f802664 100644
--- a/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml
+++ b/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications in the Windows registry to disable Windows Defender generic reports. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the "DisableGenericRePorts" registry value. This activity is significant as it can prevent the transmission of error reports to Microsoft's Windows Error Reporting service, potentially hiding malicious activities. If confirmed malicious, this action could allow attackers to bypass Windows Defender detections, reducing the visibility of their activities and increasing the risk of undetected system compromise.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Reporting\\DisableGenericRePorts" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_gen_reports_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\Reporting\\DisableGenericRePorts" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_gen_reports_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender DisableGenericRePorts registry is set to enable on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml
index 5264415b542..b7c2a27fa24 100644
--- a/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml
+++ b/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that disable Windows Defender Network Protection. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the EnableNetworkProtection registry entry. This activity is significant because disabling Network Protection can leave the system vulnerable to network-based threats by preventing Windows Defender from analyzing and blocking malicious network activity. If confirmed malicious, this action could allow attackers to bypass security measures, potentially leading to unauthorized access, data exfiltration, or further compromise of the network.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Windows Defender Exploit Guard\\Network Protection\\EnableNetworkProtection" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_network_protection_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\Windows Defender Exploit Guard\\Network Protection\\EnableNetworkProtection" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_network_protection_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender Exploit Guard network protection set to disable on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_report_infection.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_report_infection.yml
index c8070205d1b..14570ec764a 100644
--- a/detections/endpoint/windows_impair_defense_disable_win_defender_report_infection.yml
+++ b/detections/endpoint/windows_impair_defense_disable_win_defender_report_infection.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that disable Windows Defender's infection reporting. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the "DontReportInfectionInformation" registry key. This activity is significant because it can prevent Windows Defender from reporting detailed threat information to Microsoft, potentially allowing malware to evade detection. If confirmed malicious, this action could enable attackers to bypass security measures, maintain persistence, and avoid detection, leading to prolonged unauthorized access and potential data breaches.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\MRT\\DontReportInfectionInformation" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_report_infection_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\MRT\\DontReportInfectionInformation" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_report_infection_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender DontReportInfectionInformation registry is enabled on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_scan_on_update.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_scan_on_update.yml
index 2cb13d1779b..951aa72a91b 100644
--- a/detections/endpoint/windows_impair_defense_disable_win_defender_scan_on_update.yml
+++ b/detections/endpoint/windows_impair_defense_disable_win_defender_scan_on_update.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that disable the Windows Defender Scan On Update feature. It leverages data from the Endpoint.Registry datamodel, specifically looking for changes to the "DisableScanOnUpdate" registry setting with a value of "0x00000001". This activity is significant because disabling automatic scans can leave systems vulnerable to malware and other threats. If confirmed malicious, this action could allow attackers to bypass Windows Defender, facilitating further compromise and persistence within the environment.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Signature Updates\\DisableScanOnUpdate" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_scan_on_update_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\Signature Updates\\DisableScanOnUpdate" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_scan_on_update_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender DisableScanOnUpdate feature set to enable on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_signature_retirement.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_signature_retirement.yml
index 5e00deec80f..0eac95d4b9a 100644
--- a/detections/endpoint/windows_impair_defense_disable_win_defender_signature_retirement.yml
+++ b/detections/endpoint/windows_impair_defense_disable_win_defender_signature_retirement.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that disable Windows Defender Signature Retirement. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the DisableSignatureRetirement registry setting. This activity is significant because disabling signature retirement can prevent Windows Defender from removing outdated antivirus signatures, potentially reducing its effectiveness in detecting threats. If confirmed malicious, this action could allow an attacker to evade detection by using older, less relevant signatures, thereby compromising the system's security posture.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\NIS\\Consumers\\IPS\\DisableSignatureRetirement" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_signature_retirement_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\NIS\\Consumers\\IPS\\DisableSignatureRetirement" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_signature_retirement_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender DisableSignatureRetirement registry is set to enable on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_overide_win_defender_phishing_filter.yml b/detections/endpoint/windows_impair_defense_overide_win_defender_phishing_filter.yml
index f1c501eb10c..6178a0cbc5c 100644
--- a/detections/endpoint/windows_impair_defense_overide_win_defender_phishing_filter.yml
+++ b/detections/endpoint/windows_impair_defense_overide_win_defender_phishing_filter.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that disable the Windows Defender phishing filter. It leverages data from the Endpoint.Registry data model, focusing on changes to specific registry values related to Microsoft Edge's phishing filter settings. This activity is significant because disabling the phishing filter can allow attackers to deceive users into visiting malicious websites without triggering browser warnings. If confirmed malicious, this could lead to users unknowingly accessing harmful sites, resulting in potential security incidents or data compromises.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path = "*\\MicrosoftEdge\\PhishingFilter*" Registry.registry_value_name IN ("EnabledV9", "PreventOverride") Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_overide_win_defender_phishing_filter_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\MicrosoftEdge\\PhishingFilter*" Registry.registry_value_name IN ("*EnabledV9", "*PreventOverride") Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_overide_win_defender_phishing_filter_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender Phishing Filter registry was modified on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_override_smartscreen_prompt.yml b/detections/endpoint/windows_impair_defense_override_smartscreen_prompt.yml
index ee661de4421..9991cb191ae 100644
--- a/detections/endpoint/windows_impair_defense_override_smartscreen_prompt.yml
+++ b/detections/endpoint/windows_impair_defense_override_smartscreen_prompt.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that override the Windows Defender SmartScreen prompt. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the "PreventSmartScreenPromptOverride" registry setting. This activity is significant because it indicates an attempt to disable the prevention of user overrides for SmartScreen prompts, potentially allowing users to bypass security warnings. If confirmed malicious, this could lead to users inadvertently executing or accessing harmful content, increasing the risk of security incidents or system compromises.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\Microsoft\\Edge\\PreventSmartScreenPromptOverride" Registry.registry_value_data= "0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_override_smartscreen_prompt_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Edge\\PreventSmartScreenPromptOverride" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_override_smartscreen_prompt_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender SmartScreen prompt was override on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml b/detections/endpoint/windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml
index 76e059e535f..6e5b4094923 100644
--- a/detections/endpoint/windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml
+++ b/detections/endpoint/windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that set the Windows Defender SmartScreen level to "warn." This detection leverages data from the Endpoint.Registry data model, specifically monitoring changes to the ShellSmartScreenLevel registry value. This activity is significant because altering SmartScreen settings to "warn" can reduce immediate suspicion from users, allowing potentially malicious executables to run with just a warning prompt. If confirmed malicious, this could enable attackers to execute harmful files, increasing the risk of successful malware deployment and subsequent system compromise.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\System\\ShellSmartScreenLevel" Registry.registry_value_data="Warn" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_set_win_defender_smart_screen_level_to_warn_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows\\System\\ShellSmartScreenLevel" Registry.registry_value_data="Warn" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_set_win_defender_smart_screen_level_to_warn_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Defender SmartScreen Level to Warn on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml b/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml
index bfc8e823e9e..a2e11583abf 100644
--- a/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml
+++ b/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the disabling of an AutoLogger session or one of its providers, by identifying changes to the Registry values "Start" and "Enabled" part of the "\WMI\Autologger\" key path. It leverages data from the Endpoint.Registry datamodel to monitor specific registry paths and values. This activity is significant as attackers and adversaries can leverage this in order to evade defense and blind EDRs and log ingest tooling. If confirmed malicious, this action could allow an attacker to conceal their activities, making it harder to detect further malicious actions and maintain persistence on the compromised endpoint.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\WMI\\Autologger\\*" (Registry.registry_value_name="Start" OR Registry.registry_value_name="Enabled") Registry.registry_value_data ="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_auto_logger_session_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\WMI\\Autologger\\*" Registry.registry_value_name IN ("*Start", "*Enabled") Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_auto_logger_session_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml b/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml
index 806721d5a62..2dc08fbeff6 100644
--- a/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml
+++ b/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the registry related to the disabling of autostart functionality for certain antivirus products, such as Kingsoft and Tencent. Malware like ValleyRAT may alter specific registry keys to prevent these security tools from launching automatically at startup, thereby weakening system defenses. By monitoring changes in the registry entries associated with antivirus autostart settings, this detection enables security analysts to identify attempts to disable protective software. Detecting these modifications early is critical for maintaining system integrity and preventing further compromise by malicious actors.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path IN("*\\kingsoft\\antivirus\\KAVReport\\*" , "*\\kingsoft\\antivirus\\KSetting\\*", "*\\kingsoft\\antivirus\\Windhunter\\*" ,"*\\Tencent\\QQPCMgr\\*") AND ((Registry.registry_value_name IN("autostart","kxesc", "WindhunterSwitch") AND Registry.registry_value_data = "0x00000000") OR (Registry.registry_value_name = "WindhunterLevel" AND Registry.registry_value_data = "0x00000004")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_av_autostart_via_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\kingsoft\\antivirus\\KAVReport\\*", "*\\kingsoft\\antivirus\\KSetting\\*", "*\\kingsoft\\antivirus\\Windhunter\\*", "*\\Tencent\\QQPCMgr\\*") (Registry.registry_value_name IN ("*autostart", "*kxesc", "*WindhunterSwitch") Registry.registry_value_data="0x00000000") OR (Registry.registry_value_name="*WindhunterLevel" Registry.registry_value_data="0x00000004") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_av_autostart_via_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: disable anti-virus autostart via registry on [$dest$].
     entity:
diff --git a/detections/endpoint/windows_impair_defenses_disable_hvci.yml b/detections/endpoint/windows_impair_defenses_disable_hvci.yml
index 9e676c6e08c..f0214ab7e07 100644
--- a/detections/endpoint/windows_impair_defenses_disable_hvci.yml
+++ b/detections/endpoint/windows_impair_defenses_disable_hvci.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the disabling of Hypervisor-protected Code Integrity (HVCI) by monitoring changes in the Windows registry. It leverages data from the Endpoint datamodel, specifically focusing on registry paths and values related to HVCI settings. This activity is significant because HVCI helps protect the kernel and system processes from tampering by malicious code. If confirmed malicious, disabling HVCI could allow attackers to execute unsigned kernel-mode code, potentially leading to kernel-level rootkits or other severe security breaches.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\\Enabled" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_hvci_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\\Enabled" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_hvci_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives will be limited to administrative scripts disabling HVCI. Filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: HVCI has been disabled on $dest$.
     entity:
diff --git a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml
index 028d7148461..3ecdf985af2 100644
--- a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml
+++ b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the disabling of Windows Defender logging by identifying changes to the Registry keys DefenderApiLogger or DefenderAuditLogger set to disable. It leverages data from the Endpoint.Registry datamodel to monitor specific registry paths and values. This activity is significant as it is commonly associated with Remote Access Trojan (RAT) malware attempting to evade detection. If confirmed malicious, this action could allow an attacker to conceal their activities, making it harder to detect further malicious actions and maintain persistence on the compromised endpoint.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start")  Registry.registry_value_data ="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_win_defender_auto_logging_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*WMI\\Autologger\\DefenderApiLogger\\Start", "*WMI\\Autologger\\DefenderAuditLogger\\Start") Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_win_defender_auto_logging_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_important_audit_policy_disabled.yml b/detections/endpoint/windows_important_audit_policy_disabled.yml
index ad0f602c9e0..c91a6b78f6c 100644
--- a/detections/endpoint/windows_important_audit_policy_disabled.yml
+++ b/detections/endpoint/windows_important_audit_policy_disabled.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the disabling of important audit policies. It leverages EventCode 4719 from Windows Security Event Logs to identify changes where success or failure auditing is removed. This activity is significant as it suggests an attacker may have gained access to the domain controller and is attempting to evade detection by tampering with audit policies. If confirmed malicious, this could lead to severe consequences, including data theft, privilege escalation, and full network compromise. Immediate investigation is required to determine the source and intent of the change.
 data_source:
     - Windows Event Log Security 4719
-search: |-
+search: |
     `wineventlog_security` EventCode=4719 (AuditPolicyChanges IN ("%%8448","%%8450","%%8448, %%8450") OR Changes IN ("Failure removed","Success removed","Success removed, Failure removed")) `important_audit_policy_subcategory_guids`
       | replace "%%8448" with "Success removed", "%%8450" with "Failure removed", "%%8448, %%8450" with "Success removed, Failure removed" in AuditPolicyChanges
       | eval AuditPolicyChanges=coalesce(AuditPolicyChanges,Changes), SubcategoryGuid=coalesce(SubcategoryGuid,Subcategory_GUID)
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Important audit policy "$SubCategory$" of category "$Category$" was disabled on $dest$
     entity:
diff --git a/detections/endpoint/windows_increase_in_group_or_object_modification_activity.yml b/detections/endpoint/windows_increase_in_group_or_object_modification_activity.yml
index 195b3ccf27b..1f78a969aca 100644
--- a/detections/endpoint/windows_increase_in_group_or_object_modification_activity.yml
+++ b/detections/endpoint/windows_increase_in_group_or_object_modification_activity.yml
@@ -9,7 +9,7 @@ type: TTP
 description: This analytic detects an increase in modifications to AD groups or objects. Frequent changes to AD groups or objects can indicate potential security risks, such as unauthorized access attempts, impairing defences or establishing persistence. By monitoring AD logs for unusual modification patterns, this detection helps identify suspicious behavior that could compromise the integrity and security of the AD environment.
 data_source:
     - Windows Event Log Security 4663
-search: |-
+search: |
     `wineventlog_security` EventCode IN (4670,4727,4731,4734,4735,4764)
       | bucket span=5m _time
       | stats values(object) as object, dc(object) as objectCount, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Spike in Group or Object Modifications performed by $src_user$
     entity:
diff --git a/detections/endpoint/windows_increase_in_user_modification_activity.yml b/detections/endpoint/windows_increase_in_user_modification_activity.yml
index 05f58375b38..beb65e2c88c 100644
--- a/detections/endpoint/windows_increase_in_user_modification_activity.yml
+++ b/detections/endpoint/windows_increase_in_user_modification_activity.yml
@@ -9,7 +9,7 @@ type: TTP
 description: This analytic detects an increase in modifications to AD user objects. A large volume of changes to user objects can indicate potential security risks, such as unauthorized access attempts, impairing defences or establishing persistence. By monitoring AD logs for unusual modification patterns, this detection helps identify suspicious behavior that could compromise the integrity and security of the AD environment.
 data_source:
     - Windows Event Log Security 4720
-search: |-
+search: |
     `wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780)
       | bucket span=5m _time
       | stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Spike in User Modification actions performed by $src_user$
     entity:
diff --git a/detections/endpoint/windows_indicator_removal_via_rmdir.yml b/detections/endpoint/windows_indicator_removal_via_rmdir.yml
index e86c4aa3507..66b3eb7497f 100644
--- a/detections/endpoint/windows_indicator_removal_via_rmdir.yml
+++ b/detections/endpoint/windows_indicator_removal_via_rmdir.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*rmdir*" Processes.process = "* /s *" Processes.process = "* /q *" NOT Processes.parent_process_name IN ("explorer.exe", "*HPDock*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_indicator_removal_via_rmdir_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*rmdir*" Processes.process="* /s *" Processes.process="* /q *" NOT (Processes.parent_process_name IN ("*explorer.exe", "*HPDock")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_indicator_removal_via_rmdir_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: user and network administrator can execute this command.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
index 3ba7218fe85..b1dc1407282 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
@@ -9,20 +9,8 @@ type: TTP
 description: The following analytic detects the execution of programs initiated by forfiles.exe. This command is typically used to run commands on multiple files, often within batch scripts. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where forfiles.exe is the parent process. This activity is significant because forfiles.exe can be exploited to bypass command line execution protections, making it a potential vector for malicious activity. If confirmed malicious, this could allow attackers to execute arbitrary commands, potentially leading to unauthorized access or further system compromise.
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process="*forfiles* /c *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_indirect_command_execution_via_forfiles_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* /c *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_forfiles_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legacy applications may be run using pcalua.exe. Similarly, forfiles.exe may be used in legitimate batch scripts.  Filter these results as needed.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The forfiles command (forfiles.exe) launched the process name -  $process_name$
     entity:
diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
index 3cbdbe4f1c9..acd63614113 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
@@ -9,20 +9,8 @@ type: TTP
 description: The following analytic detects programs initiated by pcalua.exe, the Microsoft Windows Program Compatibility Assistant. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process information. While pcalua.exe can start legitimate programs, it is significant because attackers may use it to bypass command line execution protections. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, potentially leading to unauthorized actions, privilege escalation, or persistence within the environment.
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process="*pcalua* -a*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_indirect_command_execution_via_pcalua_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process="*pcalua* -a*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_pcalua_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legacy applications may be run using pcalua.exe.  Filter these results as needed.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$
     entity:
diff --git a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml
index c514963b3ea..62cdf69a547 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml
@@ -11,18 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_name) as process_name values(Processes.process_path) as process_path values(Processes.user) as user  values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "forfiles.exe"
-        OR
-        Processes.original_file_name = "forfiles.exe"
-      BY Processes.parent_process_name Processes.parent_process Processes.dest
-         Processes.user _time span=1m
-    | where count >=20
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_indirect_command_execution_via_series_of_forfiles_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*forfiles.exe" OR Processes.original_file_name="forfiles.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_series_of_forfiles_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -38,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_information_discovery_fsutil.yml b/detections/endpoint/windows_information_discovery_fsutil.yml
index a6ef520a6a6..15f4c7addd4 100644
--- a/detections/endpoint/windows_information_discovery_fsutil.yml
+++ b/detections/endpoint/windows_information_discovery_fsutil.yml
@@ -6,44 +6,19 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic identifies the execution of the Windows built-in tool FSUTIL with the "FSINFO" or "Volume" parameters, in order to discover file system and disk information.
+description: 'The following analytic identifies the execution of the Windows built-in tool FSUTIL with the "FSINFO" or "Volume" parameters, in order to discover file system and disk information.
+
     This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details.
+
     Monitoring this activity is significant because FSUTIL can be abused by adversaries to gather detailed information about the file system, aiding in further exploitation.
-    If confirmed malicious, this activity could enable attackers to map the file system, identify valuable data, and plan subsequent actions such as privilege escalation or persistence.
+
+    If confirmed malicious, this activity could enable attackers to map the file system, identify valuable data, and plan subsequent actions such as privilege escalation or persistence.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    from datamodel=Endpoint.Processes where
-
-    (
-      Processes.process_name="fsutil.exe"
-      OR
-      Processes.original_file_name = "fsutil.exe"
-    )
-    (
-      Processes.process = "*fsinfo*"
-      OR
-      (
-        Processes.process = "*volume*"
-        AND
-        Processes.process IN ("*diskfree*", "*list*")
-      )
-    )
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_information_discovery_fsutil_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*fsutil.exe" OR Processes.original_file_name="fsutil.exe" Processes.process="*volume*" Processes.process IN ("*fsinfo*", "*diskfree*", "*list*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_information_discovery_fsutil_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -60,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
index 49abc5fa4f0..96207ced450 100644
--- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
+++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
@@ -12,18 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    (Processes.process_name = explorer.exe OR Processes.original_file_name = explorer.exe)
-    AND NOT (Processes.parent_process_name IN("userinit.exe", "svchost.exe"))
-    Processes.process IN ("* http://*", "* https://*")
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-    | `windows_ingress_tool_transfer_using_explorer_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*explorer.exe" OR Processes.original_file_name="explorer.exe" NOT (Processes.parent_process_name IN ("*userinit.exe", "*svchost.exe")) Processes.process IN ("* http://*", "* https://*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ingress_tool_transfer_using_explorer_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present based on legitimate applications or third party utilities. Filter out any additional parent process names.
 references:
@@ -36,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_inprocserver32_new_outlook_form.yml b/detections/endpoint/windows_inprocserver32_new_outlook_form.yml
index af85b7ea101..662d872e85a 100644
--- a/detections/endpoint/windows_inprocserver32_new_outlook_form.yml
+++ b/detections/endpoint/windows_inprocserver32_new_outlook_form.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation or modification of registry keys associated with new Outlook form installations, potentially indicating exploitation of CVE-2024-21378. It leverages data from the Endpoint.Registry datamodel, focusing on registry paths involving InProcServer32 keys linked to Outlook forms. This activity is significant as it may signify an attempt to achieve authenticated remote code execution via malicious form objects. If confirmed malicious, this could allow an attacker to create arbitrary files and registry keys, leading to remote code execution and potential full system compromise.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\InProcServer32\\*" Registry.registry_value_data=*\\FORMS\\* by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_inprocserver32_new_outlook_form_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\InProcServer32\\*" Registry.registry_value_data="*\\FORMS\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_inprocserver32_new_outlook_form_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: False positives are possible if the organization adds new forms to Outlook via an automated method. Filter by name or path to reduce false positives.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml
index 8353103cd7c..3cc884c6552 100644
--- a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml
+++ b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects a process loading the credui.dll or wincredui.dll module. This detection leverages Sysmon EventCode 7 to identify instances where these DLLs are loaded by processes outside typical system directories. This activity is significant because adversaries often abuse these modules to create fake credential prompts or dump credentials, posing a risk of credential theft. If confirmed malicious, this activity could allow attackers to harvest user credentials, leading to unauthorized access and potential lateral movement within the network.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7  (ImageLoaded = "*\\credui.dll" AND OriginalFileName = "credui.dll") OR (ImageLoaded = "*\\wincredui.dll" AND OriginalFileName = "wincredui.dll") AND NOT(Image IN("*\\windows\\explorer.exe", "*\\windows\\system32\\*", "*\\windows\\sysWow64\\*", "*:\\program files*")) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_input_capture_using_credential_ui_dll_filter`'
+search: |
+    `sysmon` EventCode=7 (ImageLoaded="*\\credui.dll" OriginalFileName="credui.dll") OR (ImageLoaded="*\\wincredui.dll" OriginalFileName="wincredui.dll" NOT (Image IN ("*\\windows\\explorer.exe", "*\\system32\\", "*\\syswow64\\", "*:\\program files"))) | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_input_capture_using_credential_ui_dll_filter`
 how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
 known_false_positives: this module can be loaded by a third party application. Filter is needed.
 references:
diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml
index d99c52760cd..998e2fa2f9b 100644
--- a/detections/endpoint/windows_installutil_credential_theft.yml
+++ b/detections/endpoint/windows_installutil_credential_theft.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects instances where the Windows InstallUtil.exe binary loads `vaultcli.dll` and `Samlib.dll`. This detection leverages Sysmon EventCode 7 to identify these specific DLL loads. This activity is significant because it can indicate an attempt to execute code that bypasses application control and captures credentials using tools like Mimikatz. If confirmed malicious, this behavior could allow an attacker to steal credentials, potentially leading to unauthorized access and further compromise of the system.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7 process_name=installutil.exe loaded_file_path IN ("*\\samlib.dll", "*\\vaultcli.dll") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`'
+search: |
+    `sysmon` EventCode=7 process_name="installutil.exe" loaded_file_path IN ("*\\samlib.dll", "*\\vaultcli.dll") | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and module loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: Typically, this will not trigger because, by its very nature, InstallUtil does not require credentials. Filter as needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of process name [$process_name$] loading a file [$loaded_file$] was identified on endpoint- [$dest$] to potentially capture credentials in memory.
     entity:
diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml
index 76c22050810..85e3d277985 100644
--- a/detections/endpoint/windows_installutil_in_non_standard_path.yml
+++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where `process_installutil` NOT (Processes.process_path IN ("*\\Windows\\ADWS\\*","*\\Windows\\SysWOW64*", "*\\Windows\\system32*", "*\\Windows\\NetworkController\\*", "*\\Windows\\SystemApps\\*", "*\\WinSxS\\*", "*\\Windows\\Microsoft.NET\\*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_in_non_standard_path_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*installutil.exe" OR Processes.original_file_name="InstallUtil.exe" NOT (Processes.process_path IN ("*\\Windows\\ADWS\\*", "*\\syswow64\\*", "*\\system32\\*", "*\\Windows\\NetworkController\\*", "*\\Windows\\SystemApps\\*", "*\\WinSxS\\*", "*\\Windows\\Microsoft.NET\\*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_in_non_standard_path_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use.
 references:
@@ -28,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml
index 3b37e24b845..b922de8ca0c 100644
--- a/detections/endpoint/windows_installutil_remote_network_connection.yml
+++ b/detections/endpoint/windows_installutil_remote_network_connection.yml
@@ -55,7 +55,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml
index 52534c68fd3..3b12431144f 100644
--- a/detections/endpoint/windows_installutil_uninstall_option.yml
+++ b/detections/endpoint/windows_installutil_uninstall_option.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") NOT (Processes.process IN ("*C:\\WINDOWS\\CCM\\*")) NOT (Processes.parent_process_name IN ("Microsoft.SharePoint.Migration.ClientInstaller.exe")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_installutil_uninstall_option_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*installutil.exe" OR Processes.original_file_name="InstallUtil.exe" Processes.process IN ("*/u*", "*uninstall*") NOT Processes.process="*C:\\WINDOWS\\CCM\\*" NOT Processes.parent_process_name="*Microsoft.SharePoint.Migration.ClientInstaller.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_uninstall_option_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives should be present. Filter as needed by parent process or application.
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall.
     entity:
diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml
index 144f09ad86e..168e1a260f0 100644
--- a/detections/endpoint/windows_installutil_url_in_command_line.yml
+++ b/detections/endpoint/windows_installutil_url_in_command_line.yml
@@ -13,19 +13,7 @@ data_source:
     - CrowdStrike ProcessRollup2
     - Cisco Network Visibility Module Flow Data
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    `process_installutil`
-    Processes.process IN ("*http://*","*https://*")
-    by Processes.action Processes.dest Processes.original_file_name
-    Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-    Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-    Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
-    Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
-    Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_installutil_url_in_command_line_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*installutil.exe" OR Processes.original_file_name="InstallUtil.exe" Processes.process IN ("*http://*", "*https://*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_url_in_command_line_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ passing a URL on the command-line.
     entity:
diff --git a/detections/endpoint/windows_iobit_unlocker_extension_dll_registration_via_regsvr32.yml b/detections/endpoint/windows_iobit_unlocker_extension_dll_registration_via_regsvr32.yml
index cc349c28edb..ee542d52952 100644
--- a/detections/endpoint/windows_iobit_unlocker_extension_dll_registration_via_regsvr32.yml
+++ b/detections/endpoint/windows_iobit_unlocker_extension_dll_registration_via_regsvr32.yml
@@ -6,36 +6,19 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects the IOBit Unlocker Extension being registered.
+description: 'Detects the IOBit Unlocker Extension being registered.
+
     IObit Unlocker is a utility designed to resolve issues involving files or folders that cannot be deleted, moved, or renamed due to being locked by other processes or applications in Windows.
-    It's a powerful tool that can "unlock" these files or folders, terminating any processes that are using them.
-    This allows users to manipulate these previously inaccessible files or folders as needed.
+
+    It''s a powerful tool that can "unlock" these files or folders, terminating any processes that are using them.
+
+    This allows users to manipulate these previously inaccessible files or folders as needed.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process="*IObitUnlockerExtension.dll*"
-    Processes.process_name="regsvr32.exe"
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_iobit_unlocker_extension_dll_registration_via_regsvr32_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*IObitUnlockerExtension.dll*" Processes.process_name="*regsvr32.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iobit_unlocker_extension_dll_registration_via_regsvr32_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate users may run IObit Unlocker to manage locked files for maintenance or troubleshooting. Filter detections for approved use to reduce false alerts.
 references:
@@ -48,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential IOBit Unlocker Extension DLL activity observed on $dest$ via $process$.
     entity:
diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml
index d923ad84d0c..38e3a1a9761 100644
--- a/detections/endpoint/windows_iso_lnk_file_creation.yml
+++ b/detections/endpoint/windows_iso_lnk_file_creation.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects the creation of .iso.lnk files in the %USER%\AppData\Local\Temp\<random folder name>\ path, indicating that an ISO file has been mounted and accessed. This detection leverages the Endpoint.Filesystem data model, specifically monitoring file creation events in the Windows Recent folder. This activity is significant as it may indicate the delivery and execution of potentially malicious payloads via ISO files. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further system compromise.
 data_source:
     - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\Microsoft\\Windows\\Recent\\*") Filesystem.file_name IN ("*.iso.lnk", "*.img.lnk", "*.vhd.lnk", "*vhdx.lnk") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iso_lnk_file_creation_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\Microsoft\\Windows\\Recent\\*" Filesystem.file_name IN ("*.iso.lnk", "*.img.lnk", "*.vhd.lnk", "*vhdx.lnk") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iso_lnk_file_creation_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives may be high depending on the environment and consistent use of ISOs mounting. Restrict to servers, or filter out based on commonly used ISO names. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_kerberos_coercion_via_dns.yml b/detections/endpoint/windows_kerberos_coercion_via_dns.yml
index 371a915ba20..de234ec901b 100644
--- a/detections/endpoint/windows_kerberos_coercion_via_dns.yml
+++ b/detections/endpoint/windows_kerberos_coercion_via_dns.yml
@@ -11,15 +11,8 @@ data_source:
     - Windows Event Log Security 4662
     - Windows Event Log Security 5136
     - Windows Event Log Security 5137
-search: |-
-    `wineventlog_security`  (((EventCode="5136" OR EventCode="5137") ObjectClass="dnsNode" ObjectDN="*1UWhRCA*" ObjectDN="*AAAAA*" ObjectDN="*YBAAAA*") OR (EventCode="4662" AdditionalInfo="*1UWhRCA*" AdditionalInfo="*AAAAA*" AdditionalInfo="*YBAAAA*"))
-      | eval Object=coalesce(lower(ObjectGUID), trim(AdditionalInfo2, "%{}"))
-      | eval user=coalesce(SubjectUserName, Caller_User_Name)
-      | stats min(_time) as firstTime, max(_time) as lastTime values(EventCode) as event_codes values(ObjectDN) as dns_record values(user) as user values(Computer) as dest
-        BY Object
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_kerberos_coercion_via_dns_filter`
+search: |
+    `wineventlog_security` EventCode=4662 (EventCode IN ("5136", "5137") ObjectClass="dnsNode" ObjectDN="*1UWhRCA*" ObjectDN="*AAAAA*" ObjectDN="*YBAAAA*") OR (AdditionalInfo="*1UWhRCA*" AdditionalInfo="*AAAAA*" AdditionalInfo="*YBAAAA*") | eval user=user, ObjectDN=ObjectDN, SubjectUserName=SubjectUserName, SubjectUserSid=SubjectUserSid, Computer=Computer, User=SubjectUserSid | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_kerberos_coercion_via_dns_filter`
 how_to_implement: To successfully implement this search, you ned to be ingesting Event codes `4662`, `5136`, `5137`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. For these event codes to be generated, specific SACLs are required.
 known_false_positives: Creating a DNS entry matching this pattern is very unusual in a production environment. Filter as needed.
 references:
@@ -34,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A possible Kerberos coercion DNS object was created $dest$
     entity:
diff --git a/detections/endpoint/windows_kerberos_local_successful_logon.yml b/detections/endpoint/windows_kerberos_local_successful_logon.yml
index af3fb835060..14455b9ccee 100644
--- a/detections/endpoint/windows_kerberos_local_successful_logon.yml
+++ b/detections/endpoint/windows_kerberos_local_successful_logon.yml
@@ -6,14 +6,16 @@ modification_date: '2026-09-22'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package.
+description: 'The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package.
+
     It detects EventCode 4624 with LogonType 3 and source address 127.0.0.1, indicating a login to the built-in local Administrator account.
+
     This activity is significant as it may suggest a Kerberos relay attack, a method attackers use to escalate privileges.
-    If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive systems, execute arbitrary code, or create new accounts in Active Directory, leading to potential system compromise.
+
+    If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive systems, execute arbitrary code, or create new accounts in Active Directory, leading to potential system compromise.'
 data_source:
     - Windows Event Log Security 4624
-search: |-
+search: |
     `wineventlog_security`
     EventCode=4624
     LogonType=3
@@ -38,12 +40,12 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_kerberos_local_successful_logon_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4624 EventCode enabled. The Windows TA is also required.
-    Populate the `domain_controllers` lookup with the hostnames that appear in the `dest` field for domain controllers in your environment.
-known_false_positives: |-
-    False positives are possible, particularly from domain controllers that use Kerberos SSP and loopback authentication.
-    Add known domain controllers to the `domain_controllers` lookup to suppress those results. Filter as needed.
+how_to_implement: 'To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4624 EventCode enabled. The Windows TA is also required.
+
+    Populate the `domain_controllers` lookup with the hostnames that appear in the `dest` field for domain controllers in your environment.'
+known_false_positives: 'False positives are possible, particularly from domain controllers that use Kerberos SSP and loopback authentication.
+
+    Add known domain controllers to the `domain_controllers` lookup to suppress those results. Filter as needed.'
 references:
     - https://github.com/Dec0ne/KrbRelayUp
 drilldown_searches:
@@ -54,7 +56,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A successful localhost Kerberos authentication event occurred on $dest$, possibly indicative of Kerberos relay attack.
     entity:
diff --git a/detections/endpoint/windows_known_abused_dll_created.yml b/detections/endpoint/windows_known_abused_dll_created.yml
index e480094ba54..cafa98d834d 100644
--- a/detections/endpoint/windows_known_abused_dll_created.yml
+++ b/detections/endpoint/windows_known_abused_dll_created.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic identifies the creation of Dynamic Link Libraries (DLLs) with a known history of exploitation in atypical locations. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and filesystem events. This activity is significant as it may indicate DLL search order hijacking or sideloading, techniques used by attackers to execute arbitrary code, maintain persistence, or escalate privileges. If confirmed malicious, this activity could allow attackers to blend in with legitimate operations, posing a severe threat to system integrity and security.
 data_source:
     - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\users\\*","*\\Windows\Temp\\*","*\\programdata\\*") Filesystem.file_name="*.dll" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | lookup local=t hijacklibs_loaded library AS file_name OUTPUT islibrary, ttp, comment as desc | lookup local=t hijacklibs_loaded library AS file_name excludes as file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded != TRUE | where isnotnull(file_name) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |  `windows_known_abused_dll_created_filter`'
+search: |
+    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\users\\*","*\\Windows\Temp\\*","*\\programdata\\*") Filesystem.file_name="*.dll" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | lookup local=t hijacklibs_loaded library AS file_name OUTPUT islibrary, ttp, comment as desc | lookup local=t hijacklibs_loaded library AS file_name excludes as file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded != TRUE | where isnotnull(file_name) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |  `windows_known_abused_dll_created_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` and `Filesystem` nodes of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: This analytic may flag instances where DLLs are loaded by user mode programs for entirely legitimate and benign purposes. It is important for users to be aware that false positives are not only possible but likely, and that careful tuning of this analytic is necessary to distinguish between malicious activity and normal, everyday operations of applications. This may involve adjusting thresholds, whitelisting known good software, or incorporating additional context from other security tools and logs to reduce the rate of false positives.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml
index cdede1c4363..692f0866f2b 100644
--- a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml
+++ b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml
@@ -6,13 +6,14 @@ modification_date: '2026-09-22'
 author: Steven Dick
 status: production
 type: TTP
-description: |-
-    The following analytic detects when DLLs with known abuse history are loaded from an unusual location.
+description: 'The following analytic detects when DLLs with known abuse history are loaded from an unusual location.
+
     This activity may represent an attacker performing a DLL search order or sideload hijacking technique.
-    These techniques are used to gain persistence as well as elevate privileges on the target system.
+
+    These techniques are used to gain persistence as well as elevate privileges on the target system.'
 data_source:
     - Sysmon EventID 7
-search: |-
+search: |
     `sysmon`
     ImageLoaded
     EventCode=7
@@ -119,10 +120,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_known_abused_dll_loaded_suspiciously_filter`
-how_to_implement: |-
-    The following analytic requires Sysmon operational logs to be ingested, with EventID 7 being mapped to the process_name field. Modify the sysmon macro as needed to match the sourcetype or add index.
-known_false_positives: |-
-    False positives are expected from third party applications and other legitimate system processes located in Program Files and other similar locations. Filter as needed.
+how_to_implement: The following analytic requires Sysmon operational logs to be ingested, with EventID 7 being mapped to the process_name field. Modify the sysmon macro as needed to match the sourcetype or add index.
+known_false_positives: False positives are expected from third party applications and other legitimate system processes located in Program Files and other similar locations. Filter as needed.
 references:
     - https://attack.mitre.org/techniques/T1574/002/
     - https://hijacklibs.net/api/
@@ -136,7 +135,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The module [$loaded_file$] was loaded from an unusual location [$loaded_file_path$] on [$dest$]. Which may indicate a DLL search order or sideload hijacking technique.
     entity:
diff --git a/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml b/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml
index 9252135cca1..eaa65efef69 100644
--- a/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml
+++ b/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the loading of DLL modules associated with the GraphicalProton backdoor implant, commonly used by SVR in targeted attacks. It leverages Sysmon EventCode 7 to identify specific DLLs loaded by processes. This activity is significant as it may indicate the presence of a sophisticated backdoor, warranting immediate investigation. If confirmed malicious, the attacker could gain persistent access to the compromised host, potentially leading to further exploitation and data exfiltration.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\AclNumsInvertHost.dll", "*\\ModeBitmapNumericAnimate.dll", "*\\UnregisterAncestorAppendAuto.dll", "*\\DeregisterSeekUsers.dll", "*\\ScrollbarHandleGet.dll", "*\\PerformanceCaptionApi.dll", "*\\WowIcmpRemoveReg.dll", "*\\BlendMonitorStringBuild.dll", "*\\HandleFrequencyAll.dll", "*\\HardSwapColor.dll", "*\\LengthInMemoryActivate.dll", "*\\ParametersNamesPopup.dll", "*\\ModeFolderSignMove.dll", "*\\ChildPaletteConnected.dll", "*\\AddressResourcesSpec.dll") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_graphicalproton_loaded_modules_filter`'
+search: |
+    `sysmon` EventCode=7 ImageLoaded IN ("*\\AclNumsInvertHost.dll", "*\\ModeBitmapNumericAnimate.dll", "*\\UnregisterAncestorAppendAuto.dll", "*\\DeregisterSeekUsers.dll", "*\\ScrollbarHandleGet.dll", "*\\PerformanceCaptionApi.dll", "*\\WowIcmpRemoveReg.dll", "*\\BlendMonitorStringBuild.dll", "*\\HandleFrequencyAll.dll", "*\\HardSwapColor.dll", "*\\LengthInMemoryActivate.dll", "*\\ParametersNamesPopup.dll", "*\\ModeFolderSignMove.dll", "*\\ChildPaletteConnected.dll", "*\\AddressResourcesSpec.dll") | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_graphicalproton_loaded_modules_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_krbrelayup_service_creation.yml b/detections/endpoint/windows_krbrelayup_service_creation.yml
index 7b9c4dc6a65..bacc5bb9e98 100644
--- a/detections/endpoint/windows_krbrelayup_service_creation.yml
+++ b/detections/endpoint/windows_krbrelayup_service_creation.yml
@@ -9,14 +9,8 @@ type: TTP
 description: The following analytic detects the creation of a service with the default name "KrbSCM" associated with the KrbRelayUp tool. It leverages Windows System Event Logs, specifically EventCode 7045, to identify this activity. This behavior is significant as KrbRelayUp is a known tool used for privilege escalation attacks. If confirmed malicious, this activity could allow an attacker to escalate privileges, potentially gaining unauthorized access to sensitive systems and data.
 data_source:
     - Windows Event Log System 7045
-search: |-
-    `wineventlog_system` EventCode=7045 ServiceName IN ("KrbSCM")
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest EventCode ImagePath
-           ServiceName StartType ServiceType
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_krbrelayup_service_creation_filter`
+search: |
+    `wineventlog_system` EventCode=7045 ServiceName="KrbSCM" | eval ServiceName=ServiceName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_krbrelayup_service_creation_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Windows System Event Logs with 7045 EventCode enabled. The Windows TA is also required.
 known_false_positives: False positives should be limited as this is specific to KrbRelayUp based attack. Filter as needed.
 references:
@@ -29,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A service was created on $dest$, related to KrbRelayUp.
     entity:
diff --git a/detections/endpoint/windows_laps_password_gathering_via_powershell_script.yml b/detections/endpoint/windows_laps_password_gathering_via_powershell_script.yml
index 94faaf990f3..9f6eea6535a 100644
--- a/detections/endpoint/windows_laps_password_gathering_via_powershell_script.yml
+++ b/detections/endpoint/windows_laps_password_gathering_via_powershell_script.yml
@@ -6,32 +6,24 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects attempts to gather LAPS passwords via PowerShell and the ms-Mcs-AdmPwd property.
+description: 'Detects attempts to gather LAPS passwords via PowerShell and the ms-Mcs-AdmPwd property.
+
     Microsoft LAPS (Local Administrator Password Solution) is a Windows native tool used to manage local Administrator accounts within an AD domain.
+
     To keep things simple, instead of requiring an administrator to manually set, rotate, and store the local Administrator passwords, LAPS will do this automatically while providing an easy interface for authorized users to access passwords for recovery and/or other admin-related tasks.
+
     The benefits to an organization here are obvious: automate and protect a well-known critical security challenge and free up IT resources on your team.
+
     However, the fact that LAPS has so much information means that it provides a potential avenue of attack for malicious actors looking to further compromise an environment.
-    If LAPS isn't properly locked down, an organization can inadvertently allow anybody to grab local Admin powers on a given machine.
+
+    If LAPS isn''t properly locked down, an organization can inadvertently allow anybody to grab local Admin powers on a given machine.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventID="4104"
-    ScriptBlockText="*Get-AdComputer*"
-    ScriptBlockText="*ms-Mcs-AdmPwd*"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer EventID ScriptBlockText signature signature_id user_id vendor_product Guid
-         Opcode Name Path ProcessID ScriptBlockId
-
-    | rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_laps_password_gathering_via_powershell_script_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-AdComputer*" Processes.process="*ms-Mcs-AdmPwd*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_laps_password_gathering_via_powershell_script_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate administrative tasks and authorized tools use PowerShell to access LAPS passwords for maintenance and recovery. Filter alerts to exclude approved administrative activities.
+references: []
 drilldown_searches:
     - earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
@@ -40,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml
index a8fed6397c9..d83e3857cb6 100644
--- a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml
+++ b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml
@@ -6,13 +6,14 @@ modification_date: '2026-07-05'
 author: Mauricio Velazco, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects a high volume of Kerberos service ticket requests, specifically more than 30, from a single source within a 5-minute window.
+description: 'The following analytic detects a high volume of Kerberos service ticket requests, specifically more than 30, from a single source within a 5-minute window.
+
     It leverages Event ID 4769, which logs when a Kerberos service ticket is requested, focusing on requests with computer names as the Service Name. This behavior is significant as it may indicate malicious activities such as lateral movement, malware staging, or reconnaissance.
-    If confirmed malicious, an attacker could gain unauthorized access to multiple endpoints, potentially compromising the entire network.
+
+    If confirmed malicious, an attacker could gain unauthorized access to multiple endpoints, potentially compromising the entire network.'
 data_source:
     - Windows Event Log Security 4769
-search: |-
+search: |
     `wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$"
     | eval TargetUserName = mvindex(split(TargetUserName, "@"), 0)
     | search NOT TargetUserName="*$"
@@ -37,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$IpAddress$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$IpAddress$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: IpAddress
diff --git a/detections/endpoint/windows_ldifde_directory_object_behavior.yml b/detections/endpoint/windows_ldifde_directory_object_behavior.yml
index 03d828f6386..327438daec4 100644
--- a/detections/endpoint/windows_ldifde_directory_object_behavior.yml
+++ b/detections/endpoint/windows_ldifde_directory_object_behavior.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=ldifde.exe Processes.process IN ("*-i *", "*-f *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_ldifde_directory_object_behavior_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*ldifde.exe" Processes.process IN ("*-i *", "*-f *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ldifde_directory_object_behavior_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -41,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing ldifde on a domain controller.
     entity:
diff --git a/detections/endpoint/windows_level_rmm_powershell_script_installer.yml b/detections/endpoint/windows_level_rmm_powershell_script_installer.yml
index 2b2c2781cfe..b5bf960f45f 100644
--- a/detections/endpoint/windows_level_rmm_powershell_script_installer.yml
+++ b/detections/endpoint/windows_level_rmm_powershell_script_installer.yml
@@ -6,31 +6,19 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects the PowerShell installer for the Level tool.
+description: 'Detects the PowerShell installer for the Level tool.
+
     Level is a commercial remote management tool from Level.io.
+
     Remote management tools, when used for legitimate purposes, can help IT professionals and system administrators remotely access and manage computer systems.
+
     However, threat actors may exploit these tools for malicious purposes.
-    It can be used to maintain persistence and execution on a host by a malicious actor.
+
+    It can be used to maintain persistence and execution on a host by a malicious actor.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventID="4104"
-    ScriptBlockText IN (
-        "*$env:LEVEL_API_KEY *",
-        "*https://downloads.level.io/install_windows.ps1*"
-    )
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer EventID ScriptBlockText signature signature_id user_id vendor_product Guid
-         Opcode Name Path ProcessID ScriptBlockId
-
-    | rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_level_rmm_powershell_script_installer_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*$env:LEVEL_API_KEY *", "*https://downloads.level.io/install_windows.ps1*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_level_rmm_powershell_script_installer_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate IT and system administrators may use the Level PowerShell installer for remote management and maintenance. Filter alerts for authorized use within managed environments.
 references:
@@ -43,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_level_rmm_watchdog_task_created.yml b/detections/endpoint/windows_level_rmm_watchdog_task_created.yml
index bea23e092b6..e5ed87cee28 100644
--- a/detections/endpoint/windows_level_rmm_watchdog_task_created.yml
+++ b/detections/endpoint/windows_level_rmm_watchdog_task_created.yml
@@ -6,27 +6,19 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects the watchdog task created when Level is installed.
+description: 'Detects the watchdog task created when Level is installed.
+
     Level is a commercial remote management tool from Level.io.
+
     Remote management tools, when used for legitimate purposes, can help IT professionals and system administrators remotely access and manage computer systems.
+
     However, threat actors may exploit these tools for malicious purposes.
-    It can be used to maintain persistence and execution on a host by a malicious actor.
+
+    It can be used to maintain persistence and execution on a host by a malicious actor.'
 data_source:
     - Windows Event Log Security 4698
-search: |-
-    `wineventlog_security`
-    EventID="4698"
-    TaskName="\\Level\\Level Watchdog"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by EventID TaskName Computer
-
-    | rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_level_rmm_watchdog_task_created_filter`
+search: |
+    `wineventlog_security` EventCode=4698 TaskName="\\Level\\Level Watchdog" | eval TaskName=TaskName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_level_rmm_watchdog_task_created_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate IT professionals and system administrators may use Level remote management tools for authorized access and maintenance. Filter alerts for approved remote management software to reduce false positives.
 references:
@@ -39,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml
index 87f0252f6b7..3c86fc2abf5 100644
--- a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml
+++ b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell Script Block Logging (EventCode=4104) to query Active Directory for domain organizational units. This detection leverages PowerShell operational logs to identify script blocks containing `[adsisearcher]`, `objectcategory=organizationalunit`, and `findAll()`. This activity is significant as it indicates potential reconnaissance efforts by adversaries to gain situational awareness of the domain structure. If confirmed malicious, this could lead to further exploitation, such as privilege escalation or lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=organizationalunit*" ScriptBlockText = "*findAll()*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_linked_policies_in_adsi_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*[adsisearcher]*" Processes.process="*objectcategory=organizationalunit*" Processes.process="*findAll()*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_linked_policies_in_adsi_discovery_filter`
 how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml
index cf6856599d1..bdbb22b6d99 100644
--- a/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml
+++ b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml
@@ -11,7 +11,7 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
       WHERE Processes.process_name="cmd.exe" Processes.process IN ("*/c set", "*/c \"set")
         AND
@@ -39,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_local_administrator_credential_stuffing.yml b/detections/endpoint/windows_local_administrator_credential_stuffing.yml
index 0945e07d381..3c87b03e2a5 100644
--- a/detections/endpoint/windows_local_administrator_credential_stuffing.yml
+++ b/detections/endpoint/windows_local_administrator_credential_stuffing.yml
@@ -10,7 +10,7 @@ description: The following analytic detects attempts to authenticate using the b
 data_source:
     - Windows Event Log Security 4624
     - Windows Event Log Security 4625
-search: |-
+search: |
     `wineventlog_security` EventCode=4625 OR EventCode=4624 Logon_Type=3 TargetUserName=Administrator
       | bucket span=5m _time
       | stats dc(Computer) AS unique_targets values(Computer) as host_targets values(dest) as dest values(src) as src values(user) as user
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$host_targets$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host_targets$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Local Administrator credential stuffing attack coming from $IpAddress$
     entity:
diff --git a/detections/endpoint/windows_local_llm_framework_execution.yml b/detections/endpoint/windows_local_llm_framework_execution.yml
index 3eb169770d2..042ade40cd9 100644
--- a/detections/endpoint/windows_local_llm_framework_execution.yml
+++ b/detections/endpoint/windows_local_llm_framework_execution.yml
@@ -6,126 +6,36 @@ modification_date: '2026-07-15'
 author: Rod Soto, Nasreddine Bencherchali, Splunk
 status: production
 type: Hunting
-description: |
-    The following analytic detects execution of unauthorized local LLM frameworks (Ollama, LM Studio, GPT4All, Jan, llama.cpp, KoboldCPP, Oobabooga, NutStudio) and Python-based AI/ML libraries (HuggingFace Transformers, LangChain) on Windows endpoints by leveraging process creation events.
+description: 'The following analytic detects execution of unauthorized local LLM frameworks (Ollama, LM Studio, GPT4All, Jan, llama.cpp, KoboldCPP, Oobabooga, NutStudio) and Python-based AI/ML libraries (HuggingFace Transformers, LangChain) on Windows endpoints by leveraging process creation events.
+
     It identifies cases where known LLM framework executables are launched or command-line arguments reference AI/ML libraries.
+
     This activity is significant as it may indicate shadow AI deployments, unauthorized model inference operations, or potential data exfiltration through local AI systems.
-    If confirmed malicious, this could lead to unauthorized access to sensitive data, intellectual property theft, or circumvention of organizational AI governance policies.
+
+    If confirmed malicious, this could lead to unauthorized access to sensitive data, intellectual property theft, or circumvention of organizational AI governance policies.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count
-        min(_time) as firstTime
-        max(_time) as lastTime
-    from datamodel=Endpoint.Processes
-    where
-        (
-          Processes.process_name IN (
-              "gpt4all.exe",
-              "jan.exe",
-              "kobold.exe",
-              "koboldcpp.exe",
-              "llama-run.exe",
-              "llama.cpp.exe",
-              "lmstudio.exe",
-              "nutstudio.exe",
-              "ollama.exe",
-              "oobabooga.exe",
-              "text-generation-webui.exe"
-          )
-          OR
-          Processes.original_file_name IN (
-              "gpt4all.exe",
-              "jan.exe",
-              "koboldcpp.exe",
-              "llama-run.exe",
-              "lmstudio.exe",
-              "nutstudio.exe",
-              "ollama.exe"
-          )
-          OR
-          Processes.process IN (
-              "*\\gpt4all\\*",
-              "*\\jan\\*",
-              "*\\koboldcpp\\*",
-              "*\\llama.cpp\\*",
-              "*\\lmstudio\\*",
-              "*\\nutstudio\\*",
-              "*\\ollama\\*",
-              "*\\oobabooga\\*",
-              "*huggingface*",
-              "*langchain*",
-              "*llama-run*",
-              "*transformers*"
-          )
-          OR
-          Processes.parent_process_name IN (
-              "gpt4all.exe",
-              "jan.exe",
-              "kobold.exe",
-              "koboldcpp.exe",
-              "llama-run.exe",
-              "llama.cpp.exe",
-              "lmstudio.exe",
-              "nutstudio.exe",
-              "ollama.exe",
-              "oobabooga.exe",
-              "text-generation-webui.exe"
-          )
-        )
-        NOT Processes.process_name IN (
-            "360se.exe", "Acrobat.exe", "arc.exe", "atlas.exe", "avastbrowser.exe",
-            "avgbrowser.exe", "blpbrowser.exe", "brave.exe", "braveupdate.exe",
-            "chrome.exe", "chromium.exe", "coccoc.exe", "comet.exe", "conhost.exe",
-            "dragon.exe", "duckduckgo.exe", "epic.exe", "EXCEL.EXE", "firefox.exe",
-            "FoxitPDFReader.exe", "ghost.exe", "iexplore.exe", "iridium.exe", "iron.exe",
-            "maxthon.exe", "microsoftedge.exe", "microsoftedgeupdate.exe", "msedge.exe",
-            "msedgewebview2.exe", "mspaint.exe", "NewformaOCR.exe", "notepad.exe",
-            "opera_autoupdate.exe", "opera.exe", "OUTLOOK.EXE", "perplexity.exe",
-            "Photos.exe", "POWERPNT.EXE", "rave.exe", "Revu.exe", "safari.exe",
-            "shift.exe", "sidekick.exe", "Stapler.exe", "thorium.exe", "torch.exe",
-            "vivaldi.exe", "wavebrowser.exe", "whale.exe", "WINWORD.EXE", "zen.exe"
-        )
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*gpt4all.exe", "*jan.exe", "*kobold.exe", "*koboldcpp.exe", "*llama-run.exe", "*llama.cpp.exe", "*lmstudio.exe", "*nutstudio.exe", "*ollama.exe", "*oobabooga.exe", "*text-generation-webui.exe") OR Processes.original_file_name IN ("gpt4all.exe", "jan.exe", "koboldcpp.exe", "llama-run.exe", "lmstudio.exe", "nutstudio.exe", "ollama.exe") OR Processes.process IN ("*\\gpt4all\\*", "*\\jan\\*", "*\\koboldcpp\\*", "*\\llama.cpp\\*", "*\\lmstudio\\*", "*\\nutstudio\\*", "*\\ollama\\*", "*\\oobabooga\\*", "*huggingface*", "*langchain*", "*llama-run*", "*transformers*") OR Processes.parent_process_name IN ("*gpt4all.exe", "*jan.exe", "*kobold.exe", "*koboldcpp.exe", "*llama-run.exe", "*llama.cpp.exe", "*lmstudio.exe", "*nutstudio.exe", "*ollama.exe", "*oobabooga.exe", "*text-generation-webui.exe") NOT (Processes.process_name IN ("*360se.exe", "*Acrobat.exe", "*arc.exe", "*atlas.exe", "*avastbrowser.exe", "*avgbrowser.exe", "*blpbrowser.exe", "*brave.exe", "*braveupdate.exe", "*chrome.exe", "*chromium.exe", "*coccoc.exe", "*comet.exe", "*conhost.exe", "*dragon.exe", "*duckduckgo.exe", "*epic.exe", "*EXCEL.EXE", "*firefox.exe", "*FoxitPDFReader.exe", "*ghost.exe", "*iexplore.exe", "*iridium.exe", "*iron.exe", "*maxthon.exe", "*microsoftedge.exe", "*microsoftedgeupdate.exe", "*msedge.exe", "*msedgewebview2.exe", "*mspaint.exe", "*NewformaOCR.exe", "*notepad.exe", "*opera_autoupdate.exe", "*opera.exe", "*OUTLOOK.EXE", "*perplexity.exe", "*Photos.exe", "*POWERPNT.EXE", "*rave.exe", "*Revu.exe", "*safari.exe", "*shift.exe", "*sidekick.exe", "*Stapler.exe", "*thorium.exe", "*torch.exe", "*vivaldi.exe", "*wavebrowser.exe", "*whale.exe", "*WINWORD.EXE", "*zen.exe")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_local_llm_framework_execution_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process
-       Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | eval Framework=case(
-        match(process_name, "(?i)ollama") OR match(process, "(?i)ollama"), "Ollama",
-        match(process_name, "(?i)lmstudio") OR match(process, "(?i)lmstudio") OR match(process, "(?i)lm-studio"), "LM Studio",
-        match(process_name, "(?i)gpt4all") OR match(process, "(?i)gpt4all"), "GPT4All",
-        match(process_name, "(?i)kobold") OR match(process, "(?i)kobold"), "KoboldCPP",
-        match(process_name, "(?i)jan") OR match(process, "(?i)jan"), "Jan AI",
-        match(process_name, "(?i)nutstudio") OR match(process, "(?i)nutstudio"), "NutStudio",
-        match(process_name, "(?i)llama") OR match(process, "(?i)llama"), "llama.cpp",
-        match(process_name, "(?i)oobabooga") OR match(process, "(?i)oobabooga") OR match(process, "(?i)text-generation-webui"), "Oobabooga",
-        match(process, "(?i)transformers") OR match(process, "(?i)huggingface"), "HuggingFace/Transformers",
-        match(process, "(?i)langchain"), "LangChain",
-        1=1, "Other"
-    )
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table action dest Framework original_file_name parent_process parent_process_exec
-            parent_process_guid parent_process_id parent_process_name parent_process_path
-            process process_exec process_guid process_hash process_id process_integrity_level
-            process_name process_path user user_id vendor_product
-    | `windows_local_llm_framework_execution_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
+
+    names and speed up the data modeling process.'
 known_false_positives: Legitimate development, data science, and AI/ML workflows where authorized developers, researchers, or engineers intentionally execute local LLM frameworks (Ollama, LM Studio, GPT4All, Jan, NutStudio) for model experimentation, fine-tuning, or prototyping. Python developers using HuggingFace Transformers or LangChain for legitimate AI/ML projects. Approved sandbox and lab environments where framework testing is authorized. Open-source contributors and hobbyists running frameworks for educational purposes. Third-party applications that bundle or invoke LLM frameworks as dependencies (e.g., IDE plugins, analytics tools, chatbot integrations). System administrators deploying frameworks as part of containerized services or orchestrated ML workloads. Process name keyword overlap with unrelated utilities (e.g., "llama-backup", "janimation"). Recommended tuning — baseline approved frameworks and users by role/department, exclude sanctioned dev/lab systems via the filter macro, correlate with user identity and peer group anomalies before escalating to incident response.
 references:
     - https://splunkbase.splunk.com/app/8024
diff --git a/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml b/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml
index 24259e1e79e..8f19afa5686 100644
--- a/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml
+++ b/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml
@@ -6,10 +6,11 @@ modification_date: '2026-09-22'
 author: Steven Dick
 status: production
 type: Anomaly
-description: |
-    The following analytic identifies a LOLBAS process being executed outside of it's expected location.
+description: 'The following analytic identifies a LOLBAS process being executed outside of it''s expected location.
+
     Processes being executed outside of expected locations may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
-    The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code.
+
+    The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
@@ -43,9 +44,9 @@ search: |
     | `security_content_ctime(lastTime)`
     | `windows_lolbas_executed_outside_expected_path_filter`
 how_to_implement: To implement this search, you must ingest logs that contain the process name and process path, such as with Sysmon EID 1.
-known_false_positives: |
-    Vendors, third party software or update processes may use versions of the binaries listed in the lookup table from non-standard paths.
-    It is recommended to tune this analytic to exclude any known legitimate software or paths in your environment
+known_false_positives: 'Vendors, third party software or update processes may use versions of the binaries listed in the lookup table from non-standard paths.
+
+    It is recommended to tune this analytic to exclude any known legitimate software or paths in your environment'
 references:
     - https://attack.mitre.org/techniques/T1036/
     - https://attack.mitre.org/techniques/T1036/005/
@@ -57,7 +58,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_lsa_secrets_nolmhash_registry.yml b/detections/endpoint/windows_lsa_secrets_nolmhash_registry.yml
index 06650ae9b33..39a5fe6a2dd 100644
--- a/detections/endpoint/windows_lsa_secrets_nolmhash_registry.yml
+++ b/detections/endpoint/windows_lsa_secrets_nolmhash_registry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry related to the Local Security Authority (LSA) NoLMHash setting. It identifies when the registry value is set to 0, indicating that the system will store passwords in the weaker Lan Manager (LM) hash format. This detection leverages registry activity logs from endpoint data sources like Sysmon or EDR tools. Monitoring this activity is crucial as it can indicate attempts to weaken password storage security. If confirmed malicious, this could allow attackers to exploit weaker LM hashes, potentially leading to unauthorized access and credential theft.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Control\\Lsa\\NoLMHash" Registry.registry_value_data = 0x00000000) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lsa_secrets_nolmhash_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\Lsa\\NoLMHash" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lsa_secrets_nolmhash_registry_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 known_false_positives: Administrator may change this registry setting.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows LSA Secrets NoLMhash Registry on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml
index 68a500f977b..63f87eaca0d 100644
--- a/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml
+++ b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml
@@ -10,27 +10,7 @@ description: The following analytic detects a Windows application establishing a
 data_source:
     - Sysmon EventID 3
 search: |
-    `sysmon`
-    EventCode=3
-    NOT Image IN(
-      "C:\\Program Files \(x86\)\\*",
-      "C:\\Program Files\\*",
-      "C:\\Windows\\System32\\*",
-      "C:\\Windows\\SysWOW64\\*"
-    )
-    (
-      DestinationPortName="smtp"
-      OR
-      DestinationPort IN (25, 587)
-    )
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-    by action app dest dest_ip dest_port direction dvc protocol protocol_version
-       src src_ip src_port transport user vendor_product process_name
-       process_exec process_guid process_id
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_mail_protocol_in_non_common_process_path_filter`
+    `sysmon` EventCode=3 NOT (Image IN ("C:\\Program Files (x86)\\*", "C:\\Program Files\\*", "C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*")) DestinationPortName="smtp" OR DestinationPort IN ("25", "587") | eval process_name=process_name | stats count min(_time) as firstTime max(_time) as lastTime by action app dest dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port transport user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mail_protocol_in_non_common_process_path_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: Third party email or SMTP based applications will trigger this. Apply additional filters as needed. Also consider excluding known email or any SMTP based clients installed outside of the Program Files and Windows directories.
 references:
@@ -43,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_mark_of_the_web_bypass.yml b/detections/endpoint/windows_mark_of_the_web_bypass.yml
index e4ab37c13df..bdd820c0d88 100644
--- a/detections/endpoint/windows_mark_of_the_web_bypass.yml
+++ b/detections/endpoint/windows_mark_of_the_web_bypass.yml
@@ -10,21 +10,8 @@ description: The following analytic identifies a suspicious process that deletes
 data_source:
     - Sysmon EventID 23
     - Sysmon EventID 26
-search: |-
-    `sysmon`
-    EventCode IN (23, 26)
-    TargetFilename = "*:Zone.Identifier"
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-    BY action dest dvc file_path
-       file_hash file_name
-       file_modify_time process_exec process_guid
-       process_id process_name process_path
-       signature signature_id user
-       user_id vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_mark_of_the_web_bypass_filter`
+search: |
+    `sysmon` EventCode=23 EventCode="26" TargetFilename="*:Zone.Identifier" | stats count min(_time) as firstTime max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mark_of_the_web_bypass_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the deleted target file name, process name and process id  from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -38,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A mark-of-the-web data stream is deleted on $dest$
     entity:
diff --git a/detections/endpoint/windows_masquerading_explorer_as_child_process.yml b/detections/endpoint/windows_masquerading_explorer_as_child_process.yml
index 2929b9e0216..67eb0fc1e23 100644
--- a/detections/endpoint/windows_masquerading_explorer_as_child_process.yml
+++ b/detections/endpoint/windows_masquerading_explorer_as_child_process.yml
@@ -6,44 +6,19 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic identifies instances where explorer.exe is spawned by unusual parent processes such as cmd.exe, powershell.exe, or regsvr32.exe.
+description: 'The following analytic identifies instances where explorer.exe is spawned by unusual parent processes such as cmd.exe, powershell.exe, or regsvr32.exe.
+
     This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships.
+
     This activity is significant because explorer.exe is typically initiated by userinit.exe, and deviations from this norm can indicate code injection or process masquerading attempts by malware like Qakbot.
-    If confirmed malicious, this behavior could allow attackers to execute arbitrary code, evade detection, and maintain persistence within the environment.
+
+    If confirmed malicious, this behavior could allow attackers to execute arbitrary code, evade detection, and maintain persistence within the environment.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.parent_process_name IN (
-        "cmd.exe",
-        "powershell.exe",
-        "pwsh.exe",
-        "regsvr32.exe"
-    )
-    Processes.process_name = "explorer.exe"
-    Processes.process IN ("*\\explorer.exe")
-
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_masquerading_explorer_as_child_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*cmd.exe", "*powershell.exe", "*pwsh.exe", "*regsvr32.exe") Processes.process_name="*explorer.exe" Processes.process="*\\explorer.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_masquerading_explorer_as_child_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -56,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: explorer.exe has a suspicious parent process $parent_process_name$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_masquerading_msdtc_process.yml b/detections/endpoint/windows_masquerading_msdtc_process.yml
index ba964b15158..8782236ea57 100644
--- a/detections/endpoint/windows_masquerading_msdtc_process.yml
+++ b/detections/endpoint/windows_masquerading_msdtc_process.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "msdtc.exe" Processes.process = "*msdtc.exe*" Processes.process IN ("* -a*", "* -b*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_masquerading_msdtc_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*msdtc.exe" Processes.process="*msdtc.exe*" Processes.process IN ("* -a*", "* -b*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_masquerading_msdtc_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: msdtc.exe process with process commandline used by PlugX malware on $dest$.
     entity:
diff --git a/detections/endpoint/windows_metasploit_confluence_plugin_execution.yml b/detections/endpoint/windows_metasploit_confluence_plugin_execution.yml
index 20d58f72d88..16d2f251937 100644
--- a/detections/endpoint/windows_metasploit_confluence_plugin_execution.yml
+++ b/detections/endpoint/windows_metasploit_confluence_plugin_execution.yml
@@ -6,38 +6,18 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects the malicious java plugin execution used by metasploit for Atlassian Confluence exploitation.
-    This usually leads to the download of meterpreter giving the actor full control over the Confluence server.
+description: 'Detects the malicious java plugin execution used by metasploit for Atlassian Confluence exploitation.
+
+    This usually leads to the download of meterpreter giving the actor full control over the Confluence server.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_path="*\\Atlassian\\Confluence\\jre\\bin\\java.exe"
-    Processes.process="*-classpath *"
-    Processes.process="*\\AppData\\Local\\Temp\\~spawn*"
-    Processes.process="*.Payload*"
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_metasploit_confluence_plugin_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path="*\\Atlassian\\Confluence\\jre\\bin\\java.exe" Processes.process="*-classpath *" Processes.process="*\\AppData\\Local\\Temp\\~spawn*" Processes.process="*.Payload*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_metasploit_confluence_plugin_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate penetration testing tools or authorized security assessments may trigger this detection. Verify activity with your security team before taking action.
+references: []
 drilldown_searches:
     - earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
@@ -46,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential Metasploit Confluence plugin execution observed on $dest$.
     entity:
diff --git a/detections/endpoint/windows_mimikatz_binary_execution.yml b/detections/endpoint/windows_mimikatz_binary_execution.yml
index d93ecda498a..278d1e5608f 100644
--- a/detections/endpoint/windows_mimikatz_binary_execution.yml
+++ b/detections/endpoint/windows_mimikatz_binary_execution.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=mimikatz.exe
-            OR
-            Processes.original_file_name=mimikatz.exe
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_mimikatz_binary_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*mimikatz.exe" OR Processes.original_file_name="mimikatz.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mimikatz_binary_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited as this is directly looking for Mimikatz, the credential dumping utility.
 references:
@@ -43,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting dump credentials.
     entity:
diff --git a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml
index 710e1709ccf..d460569afd7 100644
--- a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml
+++ b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of files with extensions commonly associated with the Mimikatz Crypto module. It leverages the Endpoint.Filesystem data model to identify specific file names indicative of certificate export activities. This behavior is significant as it may indicate the use of Mimikatz to export cryptographic keys, which is a common tactic for credential theft. If confirmed malicious, this activity could allow an attacker to exfiltrate sensitive cryptographic material, potentially leading to unauthorized access and further compromise of the environment.
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.file_name IN ("*.keyx.rsa.pvk","*sign.rsa.pvk","*sign.dsa.pvk","*dsa.ec.p8k","*dh.ec.p8k", "*.pfx", "*.der")
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `security_content_ctime(lastTime)`
-    | `security_content_ctime(firstTime)`
-    | `drop_dm_object_name(Filesystem)`
-    | `windows_mimikatz_crypto_export_file_extensions_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.keyx.rsa.pvk", "*sign.rsa.pvk", "*sign.dsa.pvk", "*dsa.ec.p8k", "*dh.ec.p8k", "*.pfx", "*.der") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mimikatz_crypto_export_file_extensions_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives may be present and may need to be reviewed before this can be turned into a TTP. In addition, remove .pfx (standalone) if it's too much volume.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_mmc_loaded_script_engine_dll.yml b/detections/endpoint/windows_mmc_loaded_script_engine_dll.yml
index 93958321612..1c1460fd414 100644
--- a/detections/endpoint/windows_mmc_loaded_script_engine_dll.yml
+++ b/detections/endpoint/windows_mmc_loaded_script_engine_dll.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic identifies when a Windows process loads scripting libraries like jscript.dll or vbscript.dll to execute script code on a target system. While these DLLs are legitimate parts of the operating system, their use by unexpected processes or in unusual contexts can indicate malicious activity, such as script-based malware, living-off-the-land techniques, or automated attacks. This detection monitors which processes load these libraries, along with their command-line arguments and parent processes, to help distinguish normal administrative behavior from potential threats. Alerts should be investigated with attention to the process context and any subsequent network or system activity, as legitimate tools like MMC snap-ins may also trigger this behavior under routine administrative tasks.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7  process_name = mmc.exe ImageLoaded IN ("*\\jscript.dll", "*\\vbscript.dll", "*\\jscript9.dll") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mmc_loaded_script_engine_dll_filter`'
+search: |
+    `sysmon` EventCode=7 process_name="mmc.exe" ImageLoaded IN ("*\\jscript.dll", "*\\vbscript.dll", "*\\jscript9.dll") | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mmc_loaded_script_engine_dll_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config.
 known_false_positives: built in Windows tools such as Group Policy Management, Task Scheduler, Event Viewer, or custom MMC snap-ins may load vbscript.dll or jscript.dll to support scripted extensions, automation, or legacy management components. Filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_mock_trusted_directory_msc_file_creation.yml b/detections/endpoint/windows_mock_trusted_directory_msc_file_creation.yml
index aa4bd88b85e..ee8dfe9476e 100644
--- a/detections/endpoint/windows_mock_trusted_directory_msc_file_creation.yml
+++ b/detections/endpoint/windows_mock_trusted_directory_msc_file_creation.yml
@@ -6,39 +6,13 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects the creation of MSC files within a "C:\Windows \System32" directory.
-    Due to how Windows parses paths, the space causes an execution flow hijack and a malicious file will be executed instead of the standard Windows Files.
+description: 'Detects the creation of MSC files within a "C:\Windows \System32" directory.
+
+    Due to how Windows parses paths, the space causes an execution flow hijack and a malicious file will be executed instead of the standard Windows Files.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.file_path IN (
-        "C:\\Windows \\System32\\*.msc",
-        "C:\\Windows \\System32\\de-DE\\*.msc",
-        "C:\\Windows \\System32\\en-US\\*.msc",
-        "C:\\Windows \\System32\\es-ES\\*.msc",
-        "C:\\Windows \\System32\\fr-FR\\*.msc",
-        "C:\\Windows \\System32\\it-IT\\*.msc",
-        "C:\\Windows \\System32\\ja-JP\\*.msc",
-        "C:\\Windows \\System32\\ko-KR\\*.msc",
-        "C:\\Windows \\System32\\zh-CN\\*.msc",
-        "C:\\Windows \\System32\\zh-TW\\*.msc"
-    )
-
-    by Filesystem.dest Filesystem.file_create_time Filesystem.process_path
-       Filesystem.process_guid Filesystem.process_id Filesystem.file_path Filesystem.file_name
-       Filesystem.user Filesystem.vendor_product Filesystem.action
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_mock_trusted_directory_msc_file_creation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("C:\\Windows \\System32\*.msc", "C:\\Windows \\System32\\de-DE\*.msc", "C:\\Windows \\System32\\en-US\*.msc", "C:\\Windows \\System32\\es-ES\*.msc", "C:\\Windows \\System32\\fr-FR\*.msc", "C:\\Windows \\System32\\it-IT\*.msc", "C:\\Windows \\System32\\ja-JP\*.msc", "C:\\Windows \\System32\\ko-KR\*.msc", "C:\\Windows \\System32\\zh-CN\*.msc", "C:\\Windows \\System32\\zh-TW\*.msc") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mock_trusted_directory_msc_file_creation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate software installers or system maintenance tools may create MSC files in the System32 directory with unusual paths. Verify and allow trusted system or vendor-approved processes to reduce false positives.
 references:
@@ -51,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: MSC file created in a mock trusted directory at $file_path$ on $dest$.
     entity:
diff --git a/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml b/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml
index 8dcdd84b190..53a9fccf32c 100644
--- a/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml
+++ b/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects modifications to the Windows registry key "AuthenticationLevelOverride" within the Terminal Server Client settings. It leverages data from the Endpoint.Registry datamodel to identify changes where the registry value is set to 0x00000000. This activity is significant as it may indicate an attempt to override authentication levels for remote connections, a tactic used by DarkGate malware for malicious installations. If confirmed malicious, this could allow attackers to gain unauthorized remote access, potentially leading to data exfiltration or further system compromise.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Terminal Server Client\\AuthenticationLevelOverride"  Registry.registry_value_data = 0x00000000 by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_authenticationleveloverride_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Terminal Server Client\\AuthenticationLevelOverride" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_authenticationleveloverride_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
index 17f8dd6cd0e..699d8cdd96a 100644
--- a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
+++ b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic identifies a suspicious modification to the Windows auto update configuration registry. It detects changes to the registry path "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AutoInstallMinorUpdates" with a value of "0x00000000". This activity is significant as it is commonly used by adversaries, including malware like RedLine Stealer, to bypass detection and deploy additional payloads. If confirmed malicious, this modification could allow attackers to evade defenses, potentially leading to further system compromise and exploitation of zero-day vulnerabilities.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AutoInstallMinorUpdates" AND Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_auto_minor_updates_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AutoInstallMinorUpdates" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_auto_minor_updates_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
diff --git a/detections/endpoint/windows_modify_registry_auto_update_notif.yml b/detections/endpoint/windows_modify_registry_auto_update_notif.yml
index d7edff1a2b9..d5159e04419 100644
--- a/detections/endpoint/windows_modify_registry_auto_update_notif.yml
+++ b/detections/endpoint/windows_modify_registry_auto_update_notif.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects a suspicious modification to the Windows registry that changes the auto-update notification setting to "Notify before download." This detection leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values. This activity is significant because it is a known technique used by adversaries, including malware like RedLine Stealer, to evade detection and potentially deploy additional payloads. If confirmed malicious, this modification could allow attackers to bypass security measures, maintain persistence, and exploit vulnerabilities on the target host.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AUOptions" AND Registry.registry_value_data="0x00000002" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_auto_update_notif_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AUOptions" Registry.registry_value_data="0x00000002" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_auto_update_notif_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_configure_bitlocker.yml b/detections/endpoint/windows_modify_registry_configure_bitlocker.yml
index ccff5acbcb1..069a28043a4 100644
--- a/detections/endpoint/windows_modify_registry_configure_bitlocker.yml
+++ b/detections/endpoint/windows_modify_registry_configure_bitlocker.yml
@@ -9,7 +9,8 @@ type: TTP
 description: This analytic is developed to detect suspicious registry modifications targeting BitLocker settings. The malware ShrinkLocker alters various registry keys to change how BitLocker handles encryption, potentially bypassing TPM requirements, enabling BitLocker without TPM, and enforcing specific startup key and PIN configurations. Such modifications can weaken system security, making it easier for unauthorized access and data breaches. Detecting these changes is crucial for maintaining robust encryption and data protection.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Policies\\Microsoft\\FVE\\*" Registry.registry_value_name IN("EnableBDEWithNoTPM", "EnableNonTPM", "UseAdvancedStartup") Registry.registry_value_data = 0x00000001) OR (Registry.registry_path= "*\\Policies\\Microsoft\\FVE\\*" Registry.registry_value_name IN("UsePIN", "UsePartialEncryptionKey", "UseTPM", "UseTPMKey", "UseTPMKeyPIN", "UseTPMPIN") Registry.registry_value_data = 0x00000002) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_configure_bitlocker_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Policies\\Microsoft\\FVE\\*" Registry.registry_value_name IN ("*EnableBDEWithNoTPM", "*EnableNonTPM", "*UseAdvancedStartup") Registry.registry_value_data="0x00000001") OR (Registry.registry_path="*\\Policies\\Microsoft\\FVE\\*" Registry.registry_value_name IN ("*UsePIN", "*UsePartialEncryptionKey", "*UseTPM", "*UseTPMKey", "*UseTPMKeyPIN", "*UseTPMPIN") Registry.registry_value_data="0x00000002") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_configure_bitlocker_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A registry modification in Windows bitlocker registry settings on $dest$
     entity:
diff --git a/detections/endpoint/windows_modify_registry_default_icon_setting.yml b/detections/endpoint/windows_modify_registry_default_icon_setting.yml
index 1ddaf4d9cb8..12037145bde 100644
--- a/detections/endpoint/windows_modify_registry_default_icon_setting.yml
+++ b/detections/endpoint/windows_modify_registry_default_icon_setting.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious modifications to the Windows registry's default icon settings, a technique associated with Lockbit ransomware. It leverages data from the Endpoint Registry data model, focusing on changes to registry paths under "*HKCR\\*\\defaultIcon\\(Default)*". This activity is significant as it is uncommon for normal users to modify these settings, and such changes can indicate ransomware infection or other malware. If confirmed malicious, this could lead to system defacement and signal a broader ransomware attack, potentially compromising sensitive data and system integrity.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\defaultIcon\\(Default)*" Registry.registry_path = "*HKCR\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_modify_registry_default_icon_setting_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\defaultIcon\\(Default)*" Registry.registry_path="*HKCR\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_default_icon_setting_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml b/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml
index 6bf71773652..1918780e4e9 100644
--- a/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml
+++ b/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a potential deletion of firewall rules, indicating a possible security breach or unauthorized access attempt. It identifies actions where firewall rules are removed using commands like netsh advfirewall firewall delete rule, which can expose the network to external threats by disabling critical security measures. Monitoring these activities helps maintain network integrity and prevent malicious attacks.
 data_source:
     - Sysmon EventID 12
-search: '`sysmon` EventCode=12 TargetObject = "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" EventType=DeleteValue |  stats count min(_time) as firstTime max(_time) as lastTime by action dest process_guid process_id registry_hive registry_path registry_key_name status user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_delete_firewall_rules_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_delete_firewall_rules_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: firewall deletion found in registry on $dest$
     entity:
diff --git a/detections/endpoint/windows_modify_registry_disable_rdp.yml b/detections/endpoint/windows_modify_registry_disable_rdp.yml
index df4afcc733f..82a3b353e49 100644
--- a/detections/endpoint/windows_modify_registry_disable_rdp.yml
+++ b/detections/endpoint/windows_modify_registry_disable_rdp.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: This analytic is developed to detect suspicious registry modifications that disable Remote Desktop Protocol (RDP) by altering the "fDenyTSConnections" key. Changing this key's value to 1 prevents remote connections, which can disrupt remote management and access. Such modifications could indicate an attempt to hinder remote administration or isolate the system from remote intervention, potentially signifying malicious activity.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_rdp_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\Terminal Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_rdp_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_disable_restricted_admin.yml b/detections/endpoint/windows_modify_registry_disable_restricted_admin.yml
index 53a434c3565..b0a720fdbfd 100644
--- a/detections/endpoint/windows_modify_registry_disable_restricted_admin.yml
+++ b/detections/endpoint/windows_modify_registry_disable_restricted_admin.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry entry "DisableRestrictedAdmin," which controls the Restricted Admin mode behavior. This detection leverages registry activity logs from endpoint data sources like Sysmon or Carbon Black. Monitoring this activity is crucial as changes to this setting can disable a security feature that limits credential exposure during remote connections. If confirmed malicious, an attacker could weaken security controls, increasing the risk of credential theft and unauthorized access to sensitive systems.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Control\\Lsa\\DisableRestrictedAdmin" Registry.registry_value_data = 0x00000000) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_restricted_admin_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\Lsa\\DisableRestrictedAdmin" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_restricted_admin_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 known_false_positives: Administrator may change this registry setting. Filter as needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Modify Registry Disable Restricted Admin on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml
index 37ad6574340..579f03a300e 100644
--- a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml
+++ b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects modifications to the Windows registry that disable toast notifications. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" with a value set to "0x00000000". This activity is significant because disabling toast notifications can prevent users from receiving critical system and application updates, which adversaries like Azorult exploit for defense evasion. If confirmed malicious, this action could allow attackers to operate undetected, leading to prolonged persistence and potential further compromise of the system.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_toast_notifications_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_toast_notifications_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml
index 09e6f55681a..1ba2b5a1f24 100644
--- a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml
+++ b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects modifications to the Windows registry that disable the Windows Defender raw write notification feature. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the registry path associated with Windows Defender's real-time protection settings. This activity is significant because disabling raw write notifications can allow malware, such as Azorult, to bypass Windows Defender's behavior monitoring, potentially leading to undetected malicious activities. If confirmed malicious, this could enable attackers to execute code, persist in the environment, and access sensitive information without detection.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Real-Time Protection\\DisableRawWriteNotification*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_win_defender_raw_write_notif_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\Real-Time Protection\\DisableRawWriteNotification*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_win_defender_raw_write_notif_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
index 906d72ca7ff..973ee935c70 100644
--- a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
+++ b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a suspicious registry modification aimed at disabling Windows Defender notifications. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the registry path "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center\\Notifications\\DisableNotifications" with a value of "0x00000001". This activity is significant as it indicates an attempt to evade detection by disabling security alerts, a technique used by adversaries and malware like RedLine Stealer. If confirmed malicious, this could allow attackers to operate undetected, increasing the risk of further compromise and data exfiltration.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center\\Notifications\\DisableNotifications" AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_disable_windefender_notifications_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center\\Notifications\\DisableNotifications" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_windefender_notifications_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A registry modification to disable Windows Defender notification on $dest$
     entity:
diff --git a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml
index d50a14b0a68..131b3b62bdc 100644
--- a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml
+++ b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects modifications to the Windows registry aimed at disabling Windows Security Center notifications. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the registry path "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" with a value of "0x00000000". This activity is significant as it can indicate an attempt by adversaries or malware, such as Azorult, to evade defenses by suppressing critical update notifications. If confirmed malicious, this could allow attackers to persist undetected, potentially leading to further exploitation and compromise of the host system.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_windows_security_center_notif_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_windows_security_center_notif_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml b/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml
index d7047f51b85..bffde181d04 100644
--- a/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml
+++ b/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry key "DisableRemoteDesktopAntiAlias" with a value set to 0x00000001. This detection leverages data from the Endpoint datamodel, specifically monitoring changes in the Registry node. This activity is significant as it may indicate the presence of DarkGate malware, which alters this registry setting to enhance its remote desktop capabilities. If confirmed malicious, this modification could allow an attacker to maintain persistence and control over the compromised host, potentially leading to further exploitation and data exfiltration.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Terminal Services\\DisableRemoteDesktopAntiAlias"  Registry.registry_value_data = 0x00000001 by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disableremotedesktopantialias_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Terminal Services\\DisableRemoteDesktopAntiAlias" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disableremotedesktopantialias_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: the registry for remote desktop settings was modified to be DisableRemoteDesktopAntiAlias on $dest$.
     entity:
diff --git a/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml b/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml
index 1fd32a56a89..ddb0f7e6e46 100644
--- a/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml
+++ b/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry that disable security settings for Terminal Services. It leverages the Endpoint data model, specifically monitoring changes to the registry path associated with Terminal Services security settings. This activity is significant because altering these settings can weaken the security posture of Remote Desktop Services, potentially allowing unauthorized remote access. If confirmed malicious, such modifications could enable attackers to gain persistent remote access to the system, facilitating further exploitation and data exfiltration.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Terminal Services\\DisableSecuritySettings"  Registry.registry_value_data = 0x00000001 by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disablesecuritysettings_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Terminal Services\\DisableSecuritySettings" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disablesecuritysettings_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: the registry for terminal services settings was modified to disable security settings on $dest$.
     entity:
diff --git a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml
index c605fa982fa..836cd918000 100644
--- a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml
+++ b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications in the Windows registry to disable Windows Error Reporting (WER) settings. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to registry paths related to WER with a value set to "0x00000001". This activity is significant as adversaries may disable WER to suppress error notifications, hiding the presence of malicious activities. If confirmed malicious, this could allow attackers to operate undetected, potentially leading to prolonged persistence and further exploitation within the environment.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\disable*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disabling_wer_settings_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\disable*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disabling_wer_settings_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: the registry for WER settings was modified to be disabled on $dest$.
     entity:
diff --git a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml
index 7f813886786..dd66069da50 100644
--- a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml
+++ b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry aimed at preventing the execution of specific computer programs. It leverages data from the Endpoint.Registry datamodel, focusing on changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" with a value of "0x00000001". This activity is significant as it can indicate an attempt to disable security tools, a tactic used by malware like Azorult. If confirmed malicious, this could allow an attacker to evade detection and maintain persistence on the compromised host.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disallow_windows_app_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disallow_windows_app_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The registry for DisallowRun settings was modified to enable on $dest$.
     entity:
diff --git a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml
index 4fcbff8da43..6b73b0b422d 100644
--- a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml
+++ b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects a suspicious modification to the Windows registry that disables automatic updates. It leverages data from the Endpoint datamodel, specifically monitoring changes to the registry path "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DoNotConnectToWindowsUpdateInternetLocations" with a value of "0x00000001". This activity is significant as it can be used by adversaries, including malware like RedLine Stealer, to evade detection and prevent the system from receiving critical updates. If confirmed malicious, this could allow attackers to exploit vulnerabilities, persist in the environment, and potentially deploy additional payloads.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DoNotConnectToWindowsUpdateInternetLocations" AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_do_not_connect_to_win_update_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DoNotConnectToWindowsUpdateInternetLocations" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_do_not_connect_to_win_update_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_dontshowui.yml b/detections/endpoint/windows_modify_registry_dontshowui.yml
index 26351e0a9f0..39ce023652c 100644
--- a/detections/endpoint/windows_modify_registry_dontshowui.yml
+++ b/detections/endpoint/windows_modify_registry_dontshowui.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows Error Reporting registry key "DontShowUI" to suppress error reporting dialogs. It leverages data from the Endpoint datamodel's Registry node to identify changes where the registry value is set to 0x00000001. This activity is significant as it is commonly associated with DarkGate malware, which uses this modification to avoid detection during its installation. If confirmed malicious, this behavior could allow attackers to maintain a low profile, avoiding user alerts and potentially enabling further malicious activities without user intervention.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI"  Registry.registry_value_data = 0x00000001 by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_dontshowui_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DontShowUI" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_dontshowui_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: the registry for WER settings was modified to be disable show UI on $dest$.
     entity:
diff --git a/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml b/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml
index 343b7fed613..e535c920d7e 100644
--- a/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml
+++ b/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a suspicious modification to the Windows registry setting for EnableLinkedConnections. It leverages data from the Endpoint.Registry datamodel to identify changes where the registry path is "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLinkedConnections" and the value is set to "0x00000001". This activity is significant because enabling linked connections can allow network shares to be accessed with both standard and administrator-level privileges, a technique often abused by malware like BlackByte ransomware. If confirmed malicious, this could lead to unauthorized access to sensitive network resources, escalating the attacker's privileges.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLinkedConnections" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_enablelinkedconnections_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLinkedConnections" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_enablelinkedconnections_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A registry modification in Windows EnableLinkedConnections configuration on $dest$
     entity:
diff --git a/detections/endpoint/windows_modify_registry_longpathsenabled.yml b/detections/endpoint/windows_modify_registry_longpathsenabled.yml
index ae6f6a9182a..2744fad9369 100644
--- a/detections/endpoint/windows_modify_registry_longpathsenabled.yml
+++ b/detections/endpoint/windows_modify_registry_longpathsenabled.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects a modification to the Windows registry setting "LongPathsEnabled," which allows file paths longer than 260 characters. This detection leverages data from the Endpoint.Registry datamodel, focusing on changes to the specific registry path and value. This activity is significant because adversaries, including malware like BlackByte, exploit this setting to bypass file path limitations, potentially aiding in evasion techniques. If confirmed malicious, this modification could facilitate the execution of long-path payloads, aiding in persistence and further system compromise.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\CurrentControlSet\\Control\\FileSystem\\LongPathsEnabled" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_longpathsenabled_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentControlSet\\Control\\FileSystem\\LongPathsEnabled" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_longpathsenabled_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml b/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml
index 420b4c96813..292e7aafc32 100644
--- a/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml
+++ b/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic identifies a suspicious modification of the Windows registry setting for max connections per server. It detects changes to specific registry paths using data from the Endpoint.Registry datamodel. This activity is significant because altering this setting can be exploited by attackers to increase the number of concurrent connections to a remote server, potentially facilitating DDoS attacks or enabling more effective lateral movement within a compromised network. If confirmed malicious, this could lead to network disruption or further compromise of additional systems.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server*") Registry.registry_value_data = "0x0000000a" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_maxconnectionperserver_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer*", "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server*") Registry.registry_value_data="0x0000000a" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_maxconnectionperserver_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
index 6d6fd1e86fd..91acd07be5c 100644
--- a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
+++ b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects a suspicious modification to the Windows registry that disables automatic reboot with a logged-on user. This detection leverages the Endpoint data model to identify changes to the registry path `SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoRebootWithLoggedOnUsers` with a value of `0x00000001`. This activity is significant as it is commonly used by adversaries, including malware like RedLine Stealer, to evade detection and maintain persistence. If confirmed malicious, this could allow attackers to bypass security measures and deploy additional payloads without interruption.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoRebootWithLoggedOnUsers" AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_no_auto_reboot_with_logon_user_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoRebootWithLoggedOnUsers" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_no_auto_reboot_with_logon_user_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_no_auto_update.yml b/detections/endpoint/windows_modify_registry_no_auto_update.yml
index 4c332ede536..bf62ed79730 100644
--- a/detections/endpoint/windows_modify_registry_no_auto_update.yml
+++ b/detections/endpoint/windows_modify_registry_no_auto_update.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic identifies a suspicious modification to the Windows registry that disables automatic updates. It detects changes to the registry path `SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate` with a value of `0x00000001`. This activity is significant as it is commonly used by adversaries, including malware like RedLine Stealer, to evade detection and maintain persistence. If confirmed malicious, this could allow attackers to bypass security updates, leaving the system vulnerable to further exploitation and potential zero-day attacks.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoUpdate" AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_no_auto_update_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoUpdate" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_no_auto_update_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_nochangingwallpaper.yml b/detections/endpoint/windows_modify_registry_nochangingwallpaper.yml
index d0a33d6b272..f9fcf4d5ee0 100644
--- a/detections/endpoint/windows_modify_registry_nochangingwallpaper.yml
+++ b/detections/endpoint/windows_modify_registry_nochangingwallpaper.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry aimed at preventing wallpaper changes. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the "NoChangingWallPaper" registry value. This activity is significant as it is a known tactic used by Rhysida ransomware to enforce a malicious wallpaper, thereby limiting user control over system settings. If confirmed malicious, this registry change could indicate a ransomware infection, leading to further system compromise and user disruption.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Windows\\CurrentVersion\\Policies\\ActiveDesktop\\NoChangingWallPaper" Registry.registry_value_data = 1) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_nochangingwallpaper_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows\\CurrentVersion\\Policies\\ActiveDesktop\\NoChangingWallPaper" Registry.registry_value_data="1" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_nochangingwallpaper_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: the registry settings was modified to disable changing of wallpaper on $dest$.
     entity:
diff --git a/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml b/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml
index 14c926a0496..7782c385a6f 100644
--- a/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml
+++ b/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: This analytic is developed to detect suspicious registry modifications targeting the "scforceoption" key. Altering this key enforces smart card login for all users, potentially disrupting normal access methods. Unauthorized changes to this setting could indicate an attempt to restrict access or force a specific authentication method, possibly signifying malicious intent to manipulate system security protocols.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows\\CurrentVersion\\Policies\\System\\scforceoption*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_on_smart_card_group_policy_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows\\CurrentVersion\\Policies\\System\\scforceoption*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_on_smart_card_group_policy_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_proxyenable.yml b/detections/endpoint/windows_modify_registry_proxyenable.yml
index 13261230dae..19e8612f415 100644
--- a/detections/endpoint/windows_modify_registry_proxyenable.yml
+++ b/detections/endpoint/windows_modify_registry_proxyenable.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects modifications to the Windows registry key "ProxyEnable" to enable proxy settings. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the "Internet Settings\ProxyEnable" registry path. This activity is significant as it is commonly exploited by malware and adversaries to establish proxy communication, potentially connecting to malicious Command and Control (C2) servers. If confirmed malicious, this could allow attackers to redirect network traffic through a proxy, facilitating unauthorized communication and data exfiltration, thereby compromising the security of the affected host.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Internet Settings\\ProxyEnable"  Registry.registry_value_data = 0x00000001 by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_proxyenable_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Internet Settings\\ProxyEnable" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_proxyenable_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_proxyserver.yml b/detections/endpoint/windows_modify_registry_proxyserver.yml
index edfd77e587f..d65dddb9818 100644
--- a/detections/endpoint/windows_modify_registry_proxyserver.yml
+++ b/detections/endpoint/windows_modify_registry_proxyserver.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects modifications to the Windows registry key for setting up a proxy server. It leverages data from the Endpoint.Registry datamodel, focusing on changes to the "Internet Settings\\ProxyServer" registry path. This activity is significant as it can indicate malware or adversaries configuring a proxy to facilitate unauthorized communication with Command and Control (C2) servers. If confirmed malicious, this could allow attackers to establish persistent, covert channels for data exfiltration or further exploitation of the compromised host.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Internet Settings\\ProxyServer" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_proxyserver_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Internet Settings\\ProxyServer" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_proxyserver_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml
index 15589536727..f5aca2a1bcc 100644
--- a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml
+++ b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of a suspicious registry entry by Qakbot malware, characterized by 8 random registry value names with encrypted binary data. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry modifications under the "SOFTWARE\\Microsoft\\" path by processes like explorer.exe. This activity is significant as it indicates potential Qakbot infection, which uses the registry to store malicious code or configuration data. If confirmed malicious, this could allow attackers to maintain persistence and execute arbitrary code on the compromised system.
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count dc(registry_value_name) as registry_value_name_count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\*" AND Registry.registry_value_data = "Binary Data" by _time span=1m Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | eval registry_key_name_len = len(registry_key_name) | eval registry_value_name_len = len(registry_value_name) | regex registry_value_name="^[0-9a-fA-F]{8}" | where registry_key_name_len < 80 AND registry_value_name_len == 8 | join process_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("explorer.exe", "wermgr.exe","dxdiag.exe", "OneDriveSetup.exe", "mobsync.exe", "msra.exe", "xwizard.exe") by _time span=1m Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` ] | stats min(_time) as firstTime max(_time) as lastTime values(registry_value_name) as registry_value_name dc(registry_value_name) as registry_value_name_count values(registry_key_name) by dest process_guid process_name parent_process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where registry_value_name_count >= 5 | `windows_modify_registry_qakbot_binary_data_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count dc(registry_value_name) as registry_value_name_count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\*" AND Registry.registry_value_data = "Binary Data" by _time span=1m Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | eval registry_key_name_len = len(registry_key_name) | eval registry_value_name_len = len(registry_value_name) | regex registry_value_name="^[0-9a-fA-F]{8}" | where registry_key_name_len < 80 AND registry_value_name_len == 8 | join process_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("explorer.exe", "wermgr.exe","dxdiag.exe", "OneDriveSetup.exe", "mobsync.exe", "msra.exe", "xwizard.exe") by _time span=1m Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` ] | stats min(_time) as firstTime max(_time) as lastTime values(registry_value_name) as registry_value_name dc(registry_value_name) as registry_value_name_count values(registry_key_name) by dest process_guid process_name parent_process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where registry_value_name_count >= 5 | `windows_modify_registry_qakbot_binary_data_registry_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml
index c178b049dfc..d910c2311a3 100644
--- a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml
+++ b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="regedit.exe"
-            OR
-            Processes.original_file_name="regedit.exe"
-        )
-        AND Processes.process="* /s *" AND Processes.process="*.reg*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_modify_registry_regedit_silent_reg_import_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*regedit.exe" OR Processes.original_file_name="regedit.exe" Processes.process="* /s *" Processes.process="*.reg*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_regedit_silent_reg_import_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may execute this command that may cause some false positive. Filter as needed.
 references:
@@ -43,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_risk_behavior.yml b/detections/endpoint/windows_modify_registry_risk_behavior.yml
index 22b7146defe..72e5f501196 100644
--- a/detections/endpoint/windows_modify_registry_risk_behavior.yml
+++ b/detections/endpoint/windows_modify_registry_risk_behavior.yml
@@ -8,7 +8,7 @@ status: production
 type: Correlation
 description: The following analytic identifies instances where three or more distinct registry modification events associated with MITRE ATT&CK Technique T1112 are detected. It leverages data from the Risk data model in Splunk, focusing on registry-related sources and MITRE technique annotations. This activity is significant because multiple registry modifications can indicate an attempt to persist, hide malicious configurations, or erase forensic evidence. If confirmed malicious, this behavior could allow attackers to maintain persistent access, execute malicious code, and evade detection, posing a severe threat to the integrity and security of the affected host.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
       WHERE source IN ("*registry*") All_Risk.annotations.mitre_attack.mitre_technique_id IN ("*T1112*")
       BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$risk_object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Modify Registry Risk Behavior - $risk_object$
     entity:
diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml
index 302cd984a9b..eec120a0781 100644
--- a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml
+++ b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects modifications in the Windows registry to suppress Windows Defender notifications. It leverages data from the Endpoint.Registry datamodel, specifically targeting changes to the "Notification_Suppress" registry value. This activity is significant because adversaries, including those deploying Azorult malware, use this technique to bypass Windows Defender and disable critical notifications. If confirmed malicious, this behavior could allow attackers to evade detection, maintain persistence, and execute further malicious activities without alerting the user or security tools.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\UX Configuration\\Notification_Suppress*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_suppress_win_defender_notif_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows Defender\\UX Configuration\\Notification_Suppress*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_suppress_win_defender_notif_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml
index 9dcb2e5c5d0..c695b4bbb79 100644
--- a/detections/endpoint/windows_modify_registry_tamper_protection.yml
+++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a suspicious modification to the Windows Defender Tamper Protection registry setting. It leverages data from the Endpoint datamodel, specifically targeting changes where the registry path is set to disable Tamper Protection. This activity is significant because disabling Tamper Protection can allow adversaries to make further undetected changes to Windows Defender settings, potentially leading to reduced security on the system. If confirmed malicious, this could enable attackers to evade detection, persist in the environment, and execute further malicious activities without interference from Windows Defender.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\TamperProtection" AND Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_tamper_protection_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\TamperProtection" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_tamper_protection_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A registry modification to tamper Windows Defender protection on $dest$
     entity:
diff --git a/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml b/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml
index 592188e790b..e088b974258 100644
--- a/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml
+++ b/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml
@@ -10,7 +10,8 @@ description: The following analytic detects a potential addition or modification
 data_source:
     - Sysmon EventID 13
     - Sysmon EventID 14
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"  Registry.action = modified by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_to_add_or_modify_firewall_rule_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.action="modified" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_to_add_or_modify_firewall_rule_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml
index 6e6e402e7a9..ca8b42fae61 100644
--- a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml
+++ b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects a suspicious modification to the Windows Update configuration registry key, specifically targeting the UpdateServiceUrlAlternate setting. It leverages data from the Endpoint.Registry datamodel to identify changes to this registry path. This activity is significant because adversaries, including malware like RedLine Stealer, exploit this technique to bypass detection and deploy additional payloads. If confirmed malicious, this modification could allow attackers to redirect update services, potentially leading to the execution of malicious code, further system compromise, and persistent evasion of security defenses.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\UpdateServiceUrlAlternate" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_updateserviceurlalternate_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\UpdateServiceUrlAlternate" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_updateserviceurlalternate_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_modify_registry_usewuserver.yml b/detections/endpoint/windows_modify_registry_usewuserver.yml
index eaa396339b9..0695a7ce22e 100644
--- a/detections/endpoint/windows_modify_registry_usewuserver.yml
+++ b/detections/endpoint/windows_modify_registry_usewuserver.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects a suspicious modification to the Windows Update configuration registry key "UseWUServer." It leverages data from the Endpoint.Registry data model to identify changes where the registry value is set to "0x00000001." This activity is significant because it is commonly used by adversaries, including malware like RedLine Stealer, to bypass detection mechanisms and potentially exploit zero-day vulnerabilities. If confirmed malicious, this modification could allow attackers to evade defenses, persist on the target host, and deploy additional malicious payloads.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\UseWUServer" AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_usewuserver_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\UseWUServer" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_usewuserver_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
diff --git a/detections/endpoint/windows_modify_registry_utilize_progids.yml b/detections/endpoint/windows_modify_registry_utilize_progids.yml
index babd2abdaec..15c646b5a1d 100644
--- a/detections/endpoint/windows_modify_registry_utilize_progids.yml
+++ b/detections/endpoint/windows_modify_registry_utilize_progids.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects modifications to the Windows Registry specifically targeting Programmatic Identifier associations to bypass User Account Control (UAC) Windows OS feature. ValleyRAT may create or alter registry entries to targetted progIDs like `.pwn` files with malicious processes, allowing it to execute harmful scripts or commands when these files are opened. By monitoring for unusual changes in registry keys linked to ProgIDs, this detection enables security analysts to identify potential threats like ValleyRAT execution attempts. Early detection of these modifications helps mitigate unauthorized execution and prevents further exploitation of the system.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\ms-settings\\CurVer\\(Default)" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_utilize_progids_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\ms-settings\\CurVer\\(Default)" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_utilize_progids_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml b/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml
index c7ca262e8e1..9c0dc0ea7b7 100644
--- a/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml
+++ b/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml
@@ -6,10 +6,11 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: "The following analytic detects modifications to theregistry related to ValleyRAT C2 configuration. Specifically,  it monitors changes in registry keys where ValleyRAT saves the IP address and port information of its command-and-control (C2) server. This activity is a key indicator of ValleyRAT attempting to establish persistent communication with its C2 infrastructure. By identifying these unauthorized registry modifications, security analysts can quickly detect malicious configurations and investigate the associated threats. Early detection of these changes helps prevent further exploitation and limits the malware’s ability to exfiltrate data or control infected systems."
+description: The following analytic detects modifications to theregistry related to ValleyRAT C2 configuration. Specifically,  it monitors changes in registry keys where ValleyRAT saves the IP address and port information of its command-and-control (C2) server. This activity is a key indicator of ValleyRAT attempting to establish persistent communication with its C2 infrastructure. By identifying these unauthorized registry modifications, security analysts can quickly detect malicious configurations and investigate the associated threats. Early detection of these changes helps prevent further exploitation and limits the malware’s ability to exfiltrate data or control infected systems.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Console\\IpDateInfo" AND Registry.registry_value_data="Binary Data") OR (Registry.registry_path= "*\\Console\\SelfPath" AND Registry.registry_value_data="*.exe") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_valleyrat_c2_config_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Console\\IpDateInfo" Registry.registry_value_data="Binary Data") OR (Registry.registry_path="*\\Console\\SelfPath" Registry.registry_value_data="*.exe") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_valleyrat_c2_config_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A registry modification related to ValleyRAT on [$dest$]
     entity:
diff --git a/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml b/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml
index 0b00680eba4..8d7b239247d 100644
--- a/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml
+++ b/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows Registry specifically targeting `.pwn` file associations related to the ValleyRAT malware. ValleyRAT may create or alter registry entries to associate `.pwn` files with malicious processes, allowing it to execute harmful scripts or commands when these files are opened. By monitoring for unusual changes in registry keys linked to `.pwn` extensions, this detection enables security analysts to identify potential ValleyRAT infection attempts. Early detection of these modifications helps mitigate unauthorized execution and prevents further exploitation of the system.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*.pwn\\Shell\\Open\\command" OR Registry.registry_value_data = ".pwn") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_valleyrat_pwn_reg_entry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*.pwn\\Shell\\Open\\command" OR Registry.registry_value_data=".pwn" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_valleyrat_pwn_reg_entry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A possible ValleyRAT Registry modification in [$dest$].
     entity:
diff --git a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml
index bef57f8e575..f4c6bf6f6a3 100644
--- a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml
+++ b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects potentially malicious registry modifications characterized by MD5-like registry key names. It leverages the Endpoint data model to identify registry entries under the SOFTWARE path with 32-character hexadecimal names, a technique often used by NjRAT malware for fileless storage of keylogs and .DLL plugins. This activity is significant as it can indicate the presence of NjRAT or similar malware, which can lead to unauthorized data access and persistent threats within the environment. If confirmed malicious, attackers could maintain persistence and exfiltrate sensitive information.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly`  count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where  Registry.registry_path = "*\\SOFTWARE\\*" Registry.registry_value_data = "Binary Data" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | eval dropped_reg_path = split(registry_path, "\\") | eval dropped_reg_path_split_count = mvcount(dropped_reg_path) | eval validation_result= if(match(registry_value_name,"^[0-9a-fA-F]{32}$"),"md5","nonmd5") | where validation_result = "md5" AND dropped_reg_path_split_count <= 5 | table dest user registry_path registry_value_name registry_value_data registry_key_name reg_key_name dropped_reg_path_split_count validation_result | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_with_md5_reg_key_name_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\*" Registry.registry_value_data="Binary Data" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_with_md5_reg_key_name_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A md5 registry value name $registry_value_name$ is created on $dest$
     entity:
diff --git a/detections/endpoint/windows_modify_registry_wuserver.yml b/detections/endpoint/windows_modify_registry_wuserver.yml
index e0cda8d8c68..c581b01803f 100644
--- a/detections/endpoint/windows_modify_registry_wuserver.yml
+++ b/detections/endpoint/windows_modify_registry_wuserver.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects suspicious modifications to the Windows Update Server (WUServer) registry settings. It leverages data from the Endpoint.Registry data model to identify changes in the registry path associated with Windows Update configurations. This activity is significant because adversaries, including malware like RedLine Stealer, exploit this technique to bypass detection and deploy additional payloads. If confirmed malicious, this registry modification could allow attackers to evade defenses, potentially leading to further system compromise and persistent unauthorized access.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\WUServer" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_wuserver_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\WUServer" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_wuserver_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
 references:
diff --git a/detections/endpoint/windows_modify_registry_wustatusserver.yml b/detections/endpoint/windows_modify_registry_wustatusserver.yml
index 217ea270da5..0998097926f 100644
--- a/detections/endpoint/windows_modify_registry_wustatusserver.yml
+++ b/detections/endpoint/windows_modify_registry_wustatusserver.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic identifies suspicious modifications to the Windows Update configuration registry, specifically targeting the WUStatusServer key. It leverages data from the Endpoint datamodel to detect changes in the registry path associated with Windows Update settings. This activity is significant as it is commonly used by adversaries, including malware like RedLine Stealer, to bypass detection and deploy additional payloads. If confirmed malicious, this modification could allow attackers to evade defenses, potentially leading to further system compromise and persistent unauthorized access.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\WUStatusServer" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_wustatusserver_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\WUStatusServer" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_wustatusserver_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
index 014065e3024..ed6df6c61f4 100644
--- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
+++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects suspicious modifications to the Windows registry keys related to file compression color and information tips. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the "ShowCompColor" and "ShowInfoTip" values under the "Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" path. This activity is significant as it was observed in the Hermetic Wiper malware, indicating potential malicious intent to alter file attributes and user interface elements. If confirmed malicious, this could signify an attempt to manipulate file visibility and deceive users, potentially aiding in further malicious activities.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" AND Registry.registry_value_name  IN("ShowCompColor", "ShowInfoTip")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_show_compress_color_and_info_tip_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" Registry.registry_value_name IN ("*ShowCompColor", "*ShowInfoTip") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_show_compress_color_and_info_tip_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$
     entity:
diff --git a/detections/endpoint/windows_modify_system_firewall_with_notable_process_path.yml b/detections/endpoint/windows_modify_system_firewall_with_notable_process_path.yml
index 8d7eacb6bf6..8b4f9ca1266 100644
--- a/detections/endpoint/windows_modify_system_firewall_with_notable_process_path.yml
+++ b/detections/endpoint/windows_modify_system_firewall_with_notable_process_path.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*" Processes.process = "*allow*" Processes.process = "*add*" Processes.process = "*ENABLE*" Processes.process IN ("*\\windows\\fonts\\*", "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*","*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", "*\\temp\\*", "*\\PerfLogs\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_system_firewall_with_notable_process_path_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*firewall*" Processes.process="*allow*" Processes.process="*add*" Processes.process="*ENABLE*" Processes.process IN ("*\\windows\\fonts\\*", "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "*\\Windows\\repair\\*", "*\\temp\\*", "*\\PerfLogs\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_system_firewall_with_notable_process_path_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: A network operator or systems administrator may utilize an automated or manual execution of this firewall rule that may generate false positives. Filter as needed.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: firewall allowed program commandline $process$ of $process_name$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml
index 28d2662d68b..4185ab08265 100644
--- a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml
+++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name IN ("cmd.exe", "powershell.exe") Processes.process_name=mofcomp.exe) OR (Processes.process_name=mofcomp.exe Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mof_event_triggered_execution_via_wmi_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.parent_process_name IN ("*cmd.exe", "*powershell.exe") Processes.process_name="*mofcomp.exe") OR (Processes.process_name="*mofcomp.exe" Processes.process IN ("*\\AppData\\Local\\*", "*\\Users\\Public\\*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mof_event_triggered_execution_via_wmi_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present from automation based applications (SCCM), filtering may be required. In addition, break the query out based on volume of usage. Filter process names or file paths.
 references:
@@ -29,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ loading a MOF file.
     entity:
diff --git a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml
index b9263af0123..088aebc51a6 100644
--- a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml
+++ b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml
@@ -10,27 +10,19 @@ description: The following analytic detects the creation of new ASPX files in th
 data_source:
     - Sysmon EventID 11
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime FROM datamodel=Endpoint.Filesystem where
-      Filesystem.file_path IN ("*\\MOVEitTransfer\\wwwroot\\*") AND
-      Filesystem.file_name IN("*.ashx", "*.asp*")
-    by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
-    Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path
-    Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-    Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_moveit_transfer_writing_aspx_filter`
-how_to_implement: |
-    To successfully implement this search you need to be ingesting information
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\MOVEitTransfer\\wwwroot\\*" Filesystem.file_name IN ("*.ashx", "*.asp") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_moveit_transfer_writing_aspx_filter`
+how_to_implement: 'To successfully implement this search you need to be ingesting information
+
     on process that include the name of the process responsible for the changes from
+
     your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
-    node.
-known_false_positives: |
-    The query is structured in a way that `action` (read, create)
+
+    node.'
+known_false_positives: 'The query is structured in a way that `action` (read, create)
+
     is not defined. Review the results of this query, filter, and tune as necessary.
-    It may be necessary to generate this query specific to your endpoint product.
+
+    It may be necessary to generate this query specific to your endpoint product.'
 references:
     - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
     - https://www.reddit.com/r/sysadmin/comments/13wxuej/critical_vulnerability_moveit_file_transfer/
@@ -45,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The MOVEit application on $dest$ has written a new ASPX file $file_name$ to disk.
     entity:
diff --git a/detections/endpoint/windows_mpcmdrun_removedefinitions_execution.yml b/detections/endpoint/windows_mpcmdrun_removedefinitions_execution.yml
index 622efb586aa..9b765d2b3e1 100644
--- a/detections/endpoint/windows_mpcmdrun_removedefinitions_execution.yml
+++ b/detections/endpoint/windows_mpcmdrun_removedefinitions_execution.yml
@@ -6,31 +6,17 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    This detection identifies the execution of MpCmdRun.exe with the "-RemoveDefinitions" argument, which is used to remove definitions from the Windows Malware Protection Engine.
-    This behavior can be significant as it might indicate potential malware activity or attempts to bypass security measures.
+description: 'This detection identifies the execution of MpCmdRun.exe with the "-RemoveDefinitions" argument, which is used to remove definitions from the Windows Malware Protection Engine.
+
+    This behavior can be significant as it might indicate potential malware activity or attempts to bypass security measures.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
-      from datamodel=Endpoint.Processes where
-      (Processes.process_name ="MpCmdRun.exe" OR Processes.original_file_name = MpCmdRun.exe)
-      Processes.process = "*-RemoveDefinitions *"
-      by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-         Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-         Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-         Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_mpcmdrun_removedefinitions_execution_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    Administrators may execute this command for testing or auditing.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*MpCmdRun.exe" OR Processes.original_file_name="MpCmdRun.exe" Processes.process="*-RemoveDefinitions *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mpcmdrun_removedefinitions_execution_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Administrators may execute this command for testing or auditing.
 references:
     - https://cert.gov.ua/article/6284730
 drilldown_searches:
@@ -41,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml b/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml
index ddbba330120..4ee11aa075f 100644
--- a/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml
+++ b/detections/endpoint/windows_msc_eviltwin_directory_path_manipulation.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="mmc.exe" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_id Processes.process_name Processes.process_path Processes.action Processes.original_file_name Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_integrity_level Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | regex process="(?i).*mmc\.exe.*((Windows\s+\\\\System32)|(Windows\s+System32)|(\\\\Windows\s+\\\\System32)|(Program\s+Files\s+\\\\)|(Program\s+Files\s+\(\\w+\)\s+\\\\)|(Progra~1\s+\\\\))" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msc_eviltwin_directory_path_manipulation_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="mmc.exe" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_id Processes.process_name Processes.process_path Processes.action Processes.original_file_name Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_integrity_level Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | regex process="(?i).*mmc\.exe.*((Windows\s+\\\\System32)|(Windows\s+System32)|(\\\\Windows\s+\\\\System32)|(Program\s+Files\s+\\\\)|(Program\s+Files\s+\(\\w+\)\s+\\\\)|(Progra~1\s+\\\\))" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msc_eviltwin_directory_path_manipulation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate system maintenance tools might use MSC files with unusual parameters. Filter for specific known maintenance activities in your environment.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Process $process_name$ executed an MSC file with suspicious directory path manipulation on $dest$
     entity:
diff --git a/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml b/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml
index 69909f7ed18..29f8f943e27 100644
--- a/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml
+++ b/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic identifies suspicious Cmdlet usage in Exchange Management logs, focusing on commands like New-MailboxExportRequest and New-ManagementRoleAssignment. It leverages EventCode 1 and specific Message patterns to detect potential ProxyShell and ProxyNotShell abuse. This activity is significant as it may indicate unauthorized access or manipulation of mailboxes and roles, which are critical for maintaining email security. If confirmed malicious, attackers could export mailbox data, assign new roles, or search mailboxes, leading to data breaches and privilege escalation.
 data_source: []
-search: |-
+search: |
     `msexchange_management` EventCode=1 Message IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*", "*New-MailboxSearch*", "*Get-Recipient*", "*Search-Mailbox*")
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY host Message
@@ -28,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_mshta_execution_in_registry.yml b/detections/endpoint/windows_mshta_execution_in_registry.yml
index 02e4c1ad722..83d2823198e 100644
--- a/detections/endpoint/windows_mshta_execution_in_registry.yml
+++ b/detections/endpoint/windows_mshta_execution_in_registry.yml
@@ -9,20 +9,8 @@ type: TTP
 description: The following analytic detects the execution of mshta.exe via registry entries to run malicious scripts. It leverages registry activity logs to identify entries containing "mshta," "javascript," "vbscript," or "WScript.Shell." This behavior is significant as it indicates potential fileless malware, such as Kovter, which uses encoded scripts in the registry to persist and execute without files. If confirmed malicious, this activity could allow attackers to maintain persistence, execute arbitrary code, and evade traditional file-based detection methods, posing a significant threat to system integrity and security.
 data_source:
     - Sysmon EventID 13
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
-      WHERE Registry.registry_value_data = "*mshta*"
-        OR
-        Registry.registry_value_data IN ("*javascript:*", "*vbscript:*","*WScript.Shell*")
-      BY Registry.action Registry.dest Registry.process_guid
-         Registry.process_id Registry.registry_hive Registry.registry_path
-         Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
-         Registry.registry_value_type Registry.status Registry.user
-         Registry.vendor_product
-    | `drop_dm_object_name(Registry)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_mshta_execution_in_registry_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_data IN ("*mshta*", "*javascript:*", "*vbscript:*", "*WScript.Shell*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mshta_execution_in_registry_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -36,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A registry $registry_path$ contains mshta $registry_value_data$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml b/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml
index 859a2268e22..b0d88fab4d3 100644
--- a/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml
+++ b/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml
@@ -10,36 +10,7 @@ description: The following analytic identifies instances of `mshta.exe` writing
 data_source:
     - Sysmon EventID 11
 search: |
-    `sysmon`
-    EventCode=11
-    (
-      Image="*\\mshta.exe"
-      OR
-      OriginalFileName="mshta.exe"
-    )
-    TargetFilename IN (
-                        "*\\Windows\\PLA\\Reports\\*",
-                        "*\\Windows\\PLA\\Rules\\*",
-                        "*\\Windows\\PLA\\Templates\\*",
-                        "*\\Windows\\Registration\\CRMLog\\*",
-                        "*\\Windows\\System32\\Com\\dmp\\*",
-                        "*\\Windows\\System32\\LogFiles\\WMI\\*",
-                        "*\\Windows\\System32\\Microsoft\\Crypto\\RSA\\MachineKeys\\*",
-                        "*\\Windows\\System32\\spool\\drivers\\color\\*",
-                        "*\\Windows\\System32\\spool\\PRINTERS\\*",
-                        "*\\Windows\\System32\\spool\\SERVERS\\*",
-                        "*\\Windows\\System32\\Tasks\\*",
-                        "*\\Windows\\SysWOW64\\Com\\dmp\\*",
-                        "*\\Windows\\SysWOW64\\Tasks\\*",
-                        "*\\Windows\\Tasks\\*",
-                        "*\\Windows\\Temp\\*",
-                        "*\\Windows\\tracing\\*"
-                      )
-    | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name
-    file_path  process_guid process_id user user_id vendor_product Image TargetFilename
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_mshta_writing_to_world_writable_path_filter`
+    `sysmon` EventCode=11 Image="*\\mshta.exe" OR OriginalFileName="mshta.exe" TargetFilename IN ("*\\Windows\\PLA\\Reports\\*", "*\\Windows\\PLA\\Rules\\*", "*\\Windows\\PLA\\Templates\\*", "*\\Windows\\Registration\\CRMLog\\*", "*\\system32\\*", "*\\syswow64\\*", "*\\Windows\\Tasks\\*", "*\\Windows\\Temp\\*", "*\\Windows\\tracing\\*") | eval process_name=process_name, root_drive=root_drive | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name file_path process_guid process_id user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mshta_writing_to_world_writable_path_filter`
 how_to_implement: The analytic is designed to be run against Sysmon event logs collected from endpoints. The analytic requires the Sysmon event logs to be ingested into Splunk. The search focuses on EventCode 11 where the Image is `mshta.exe` and the TargetFilename is within world-writable directories such as `C:\Windows\Tasks`, `C:\Windows\Temp`, and others. The detection is designed to catch the initial file write operation by `mshta.exe` to these locations, which is indicative of an attempt to establish persistence or execute malicious code. The analytic can be modified to include additional world-writable directories as needed.
 known_false_positives: False positives may occur if legitimate processes are writing to world-writable directories. It is recommended to investigate the context of the file write operation to determine if it is malicious or not. Modify the search to include additional known good paths for `mshta.exe` to reduce false positives.
 references:
@@ -53,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $Image$ writing to $TargetFilename$ was detected on $dest$.
     entity:
@@ -84,6 +55,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/mshta_tasks_windows-sysmon.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_msi_rollback_script_deleted_by_non_msiexec_process.yml b/detections/endpoint/windows_msi_rollback_script_deleted_by_non_msiexec_process.yml
index f02724f4c2a..3253d0e772e 100644
--- a/detections/endpoint/windows_msi_rollback_script_deleted_by_non_msiexec_process.yml
+++ b/detections/endpoint/windows_msi_rollback_script_deleted_by_non_msiexec_process.yml
@@ -6,30 +6,18 @@ modification_date: '2026-07-20'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects deletion of a Rollback Script (.rbs) file under C:\Config.Msi, the critical filesystem manipulation step in an MSI Rollback privilege escalation attack that converts an arbitrary file delete primitive into full SYSTEM code execution.
+description: 'Detects deletion of a Rollback Script (.rbs) file under C:\Config.Msi, the critical filesystem manipulation step in an MSI Rollback privilege escalation attack that converts an arbitrary file delete primitive into full SYSTEM code execution.
+
     During a legitimate MSI installation, the Windows Installer service (running as SYSTEM) creates C:\Config.Msi and populates it with a Rollback Script (.rbs) and Rollback File (.rbf).
+
     These files define exactly how to restore the system to its pre-installation state if the install fails.
-    The folder is protected with a strong DACL specifically to prevent tampering by low-privileged users — because whatever is in these files will be executed by the SYSTEM-level Installer service during rollback.
+
+    The folder is protected with a strong DACL specifically to prevent tampering by low-privileged users — because whatever is in these files will be executed by the SYSTEM-level Installer service during rollback.'
 data_source:
     - Sysmon EventID 23
     - Sysmon EventID 26
-search: |-
-    `sysmon`
-    EventCode IN (23, 26)
-    TargetFilename="*:\\Config.Msi\\*"
-    TargetFilename="*.rbs"
-    NOT ProcessName="msiexec.exe"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer ProcessName TargetFilename EventID action dest dvc file_path file_hash
-         file_name file_modify_time process_exec process_guid process_id process_name
-         process_path signature signature_id user user_id vendor_product
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_msi_rollback_script_deleted_by_non_msiexec_process_filter`
+search: |
+    `sysmon` EventCode=23 EventCode="26" TargetFilename="*:\\Config.Msi\\*" TargetFilename="*.rbs" NOT ProcessName="msiexec.exe" | stats count min(_time) as firstTime max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msi_rollback_script_deleted_by_non_msiexec_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate system cleanup or MSI uninstallation processes may delete rbs files under c:\Config.Msi. Verify events with approved maintenance activities to reduce false alarms.
 references:
@@ -42,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: MSI rollback script file $TargetFilename$ was deleted on $dest$ by $ProcessName$.
     entity:
diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml
index ed67803245b..bed90bb7e07 100644
--- a/detections/endpoint/windows_msiexec_dllregisterserver.yml
+++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_msiexec` Processes.process IN ("* /y*", "* -y*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_msiexec_dllregisterserver_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*msiexec.exe" OR Processes.original_file_name="msiexec.exe" Processes.process IN ("* /y*", "* -y*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_dllregisterserver_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a file.
     entity:
diff --git a/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml b/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml
index efd6e738ec7..ce7710d9a3c 100644
--- a/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml
+++ b/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name = msiexec.exe  Processes.process = "* /HideWindow *" Processes.process = "* rundll32*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_msiexec_hidewindow_rundll32_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*msiexec.exe" Processes.process="* /HideWindow *" Processes.process="* rundll32*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_hidewindow_rundll32_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Other possible 3rd party msi software installers use this technique as part of its installation process.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: a msiexec parent process with /hidewindow rundll32 process commandline on $dest$
     entity:
diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml
index bfb1bd01bf6..d515a0d1972 100644
--- a/detections/endpoint/windows_msiexec_remote_download.yml
+++ b/detections/endpoint/windows_msiexec_remote_download.yml
@@ -6,45 +6,44 @@ modification_date: '2026-10-02'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the use of msiexec.exe with an HTTP or
+description: 'The following analytic detects the use of msiexec.exe with an HTTP or
+
     HTTPS URL in the command line, indicating a remote file download attempt. This detection
+
     leverages data from Endpoint Detection and Response (EDR) agents, focusing on process
+
     execution logs that include command-line details. This activity is significant as
+
     it may indicate an attempt to download and execute potentially malicious software
+
     from a remote server. If confirmed malicious, this could lead to unauthorized code
-    execution, system compromise, or further malware deployment within the network.
+
+    execution, system compromise, or further malware deployment within the network.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
     - Cisco Network Visibility Module Flow Data
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    `process_msiexec`
-    Processes.process IN ("*http://*", "*https://*")
-    by Processes.action Processes.dest Processes.original_file_name
-    Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-    Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-    Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
-    Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
-    Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_msiexec_remote_download_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*msiexec.exe" OR Processes.original_file_name="msiexec.exe" Processes.process IN ("*http://*", "*https://*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_remote_download_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    False positives may be present, filter by destination or parent process as needed.
+
+    names and speed up the data modeling process.'
+known_false_positives: False positives may be present, filter by destination or parent process as needed.
 references:
     - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
     - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
@@ -57,7 +56,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml
index 32ff565c796..f4a66308f3d 100644
--- a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml
+++ b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml
@@ -6,15 +6,16 @@ modification_date: '2026-05-13'
 author: Michael Haag, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects MSIExec spawning multiple discovery commands.
+description: 'The following analytic detects MSIExec spawning multiple discovery commands.
+
     This behavior is identified using data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where MSIExec is the parent process.
-    If confirmed malicious, an attacker could use these discovery commands to gather system information, potentially leading to further exploitation or lateral movement within the network.
+
+    If confirmed malicious, an attacker could use these discovery commands to gather system information, potentially leading to further exploitation or lateral movement within the network.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -130,8 +131,7 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_msiexec_spawn_discovery_command_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives might still be present, depending on the installer. Filter as needed.
 references:
     - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
@@ -144,7 +144,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_msiexec_spawn_windbg.yml b/detections/endpoint/windows_msiexec_spawn_windbg.yml
index b73bb3c24d6..a887578d4b8 100644
--- a/detections/endpoint/windows_msiexec_spawn_windbg.yml
+++ b/detections/endpoint/windows_msiexec_spawn_windbg.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=msiexec.exe Processes.process_name=windbg.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_msiexec_spawn_windbg_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*msiexec.exe" Processes.process_name="*windbg.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_spawn_windbg_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives will only be present if the MSIExec process legitimately spawns WinDBG. Filter as needed.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml
index 8d9f150a6b8..bb40a730c09 100644
--- a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml
+++ b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_msiexec` Processes.process IN ("*/z*", "*-z*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_msiexec_unregister_dllregisterserver_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*msiexec.exe" OR Processes.original_file_name="msiexec.exe" Processes.process IN ("*/z*", "*-z*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_unregister_dllregisterserver_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to unregister a file.
     entity:
diff --git a/detections/endpoint/windows_msix_package_interaction.yml b/detections/endpoint/windows_msix_package_interaction.yml
index f05d329c3d1..5e6c04655e6 100644
--- a/detections/endpoint/windows_msix_package_interaction.yml
+++ b/detections/endpoint/windows_msix_package_interaction.yml
@@ -9,13 +9,8 @@ type: Hunting
 description: This hunting query detects user interactions with MSIX packages by monitoring EventCode 171 in the Microsoft-Windows-AppXPackaging/Operational logs. These events are generated when a user clicks on or attempts to interact with an MSIX package, even if the package is not fully installed. This information can be valuable for security teams to identify what MSIX packages users are attempting to open in their environment, which may help detect malicious MSIX packages before they're fully installed. Monitoring these interactions can provide early warning of potential MSIX package abuse, which has been leveraged by threat actors such as FIN7, Zloader (Storm-0569), and FakeBat (Storm-1113).
 data_source:
     - Windows Event Log AppXPackaging 171
-search: |-
-    `wineventlog_appxpackaging` EventCode=171
-      | stats count min(_time) as firstTime max(_time) as lastTime values(packageFullName) as packageFullName values(user_id) as user_id
-        BY host EventCode
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_msix_package_interaction_filter`
+search: |
+    `wineventlog_appxpackaging` EventCode="171" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msix_package_interaction_filter`
 how_to_implement: To implement this detection, you need to be collecting Windows Event logs from the Microsoft-Windows-AppXPackaging/Operational channel. In Splunk, this typically requires the Windows TA and configuration to collect from this specific channel. Ensure your Windows event collection is properly configured to capture EventCode 171 from the Microsoft-Windows-AppXPackaging/Operational log. This query is designed as a hunting query to help identify MSIX package interactions across your environment.
 known_false_positives: This hunting query will detect legitimate MSIX package interactions from normal users. It is not designed to specifically identify malicious activity but rather to provide visibility into all MSIX package interactions. Security teams should review the results and look for unusual patterns, unexpected packages, or suspicious file paths.
 references:
@@ -38,6 +33,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/appx/windows-appxpackaging.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-AppxPackaging/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_msmpeng_writing_to_system32.yml b/detections/endpoint/windows_msmpeng_writing_to_system32.yml
index 5612c1f7386..3441442f7fb 100644
--- a/detections/endpoint/windows_msmpeng_writing_to_system32.yml
+++ b/detections/endpoint/windows_msmpeng_writing_to_system32.yml
@@ -6,32 +6,18 @@ modification_date: '2026-04-27'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects MsMpEng.exe creating a file in C:\\Windows\\System32\\.
+description: 'Detects MsMpEng.exe creating a file in C:\\Windows\\System32\\.
+
     This should never happen under normal operation Windows Defender does not install kernel drivers at runtime.
-    In the BlueHammer exploit, the TOCTOU race causes MsMpEng (SYSTEM) to write the attacker's driver payload directly into the drivers directory.
+
+    In the BlueHammer exploit, the TOCTOU race causes MsMpEng (SYSTEM) to write the attacker''s driver payload directly into the drivers directory.'
 data_source:
     - Sysmon EventID 15
     - Sysmon EventID 11
-search: |-
-    `sysmon`
-    (EventID=15 OR EventID=11)
-    Image="*\\MsMpEng.exe"
-    TargetFilename="*:\\Windows\\System32\\*"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer Image TargetFilename EventID dest dvc
-         file_hash file_name file_path action process_exec
-         process_guid process_id process_name process_path
-         signature signature_id user_id vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_msmpeng_writing_to_system32_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    No false positives have been identified at this time.
+search: |
+    `sysmon` EventCode=11 EventID="11" Image="*\\MsMpEng.exe" TargetFilename="*\\system32\\*" | eval process_name=process_name, root_drive=root_drive | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name file_path process_guid process_id user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msmpeng_writing_to_system32_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://github.com/Nightmare-Eclipse/BlueHammer
 drilldown_searches:
diff --git a/detections/endpoint/windows_mstsc_rdp_commandline.yml b/detections/endpoint/windows_mstsc_rdp_commandline.yml
index b8d9b84f2a4..9e10bfd37a0 100644
--- a/detections/endpoint/windows_mstsc_rdp_commandline.yml
+++ b/detections/endpoint/windows_mstsc_rdp_commandline.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "mstsc.exe" Processes.process = "*/v:*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_mstsc_rdp_commandline_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*mstsc.exe" Processes.process="*/v:*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mstsc_rdp_commandline_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: administrator may remote desktop a spe
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_multiple_account_passwords_changed.yml b/detections/endpoint/windows_multiple_account_passwords_changed.yml
index ce569e1a9fc..d0ee56e6ce4 100644
--- a/detections/endpoint/windows_multiple_account_passwords_changed.yml
+++ b/detections/endpoint/windows_multiple_account_passwords_changed.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects instances where more than five unique Windows account passwords are changed within a 10-minute interval. It leverages Event Code 4724 from the Windows Security Event Log, using the wineventlog_security dataset to monitor and count distinct TargetUserName values. This behavior is significant as rapid password changes across multiple accounts are unusual and may indicate unauthorized access or internal compromise. If confirmed malicious, this activity could lead to widespread account compromise, unauthorized access to sensitive information, and potential disruption of services.
 data_source:
     - Windows Event Log Security 4724
-search: |-
+search: |
     `wineventlog_security` EventCode=4724 status=success
       | bucket span=10m _time
       | stats count dc(user) as unique_users values(user) as user values(dest) as dest
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $src_user$ changed the passwords of multiple accounts in a short period of time.
     entity:
diff --git a/detections/endpoint/windows_multiple_accounts_deleted.yml b/detections/endpoint/windows_multiple_accounts_deleted.yml
index 6b08687901c..b2ec8de53e2 100644
--- a/detections/endpoint/windows_multiple_accounts_deleted.yml
+++ b/detections/endpoint/windows_multiple_accounts_deleted.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the deletion of more than five unique Windows accounts within a 10-minute period, using Event Code 4726 from the Windows Security Event Log. It leverages the `wineventlog_security` dataset, segmenting data into 10-minute intervals to identify suspicious account deletions. This activity is significant as it may indicate an attacker attempting to erase traces of their actions. If confirmed malicious, this could lead to unauthorized access removal, hindering incident response and forensic investigations.
 data_source:
     - Windows Event Log Security 4726
-search: |-
+search: |
     `wineventlog_security` EventCode=4726 status=success
       | bucket span=10m _time
       | stats count dc(user) as unique_users values(user) as user values(dest) as dest
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $src_user$ deleted multiple accounts in a short period of time.
     entity:
diff --git a/detections/endpoint/windows_multiple_accounts_disabled.yml b/detections/endpoint/windows_multiple_accounts_disabled.yml
index ca379eb683a..949ccf9b254 100644
--- a/detections/endpoint/windows_multiple_accounts_disabled.yml
+++ b/detections/endpoint/windows_multiple_accounts_disabled.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies instances where more than five unique Windows accounts are disabled within a 10-minute window, as indicated by Event Code 4725 in the Windows Security Event Log. It leverages the wineventlog_security dataset, grouping data into 10-minute segments and tracking the count and distinct count of TargetUserName. This behavior is significant as it may indicate internal policy breaches or an external attacker's attempt to disrupt operations. If confirmed malicious, this activity could lead to widespread account lockouts, hindering user access and potentially disrupting business operations.
 data_source:
     - Windows Event Log Security 4725
-search: |-
+search: |
     `wineventlog_security` EventCode=4725 status=success
       | bucket span=10m _time
       | stats count dc(user) as unique_users values(user) as user values(dest) as dest
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $src_user$ disabled multiple accounts in a short period of time.
     entity:
diff --git a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml
index b58e5409bc5..30693eca677 100644
--- a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml
+++ b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects a single source endpoint failing to authenticate with 30 unique disabled domain users using the Kerberos protocol within 5 minutes. It leverages Windows Security Event 4768, focusing on failure code `0x12`, indicating revoked credentials. This activity is significant as it may indicate a Password Spraying attack targeting disabled accounts, a tactic used by adversaries to gain initial access or elevate privileges. If confirmed malicious, this could lead to unauthorized access or privilege escalation within the Active Directory environment, posing a severe security risk.
 data_source:
     - Windows Event Log Security 4768
-search: |-
+search: |
     `wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12
       | bucket span=5m _time
       | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user values(dest) as dest
@@ -28,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential Kerberos based password spraying attack from $IpAddress$
     entity:
@@ -52,9 +52,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml
index feaa99e7378..fd97383e7ee 100644
--- a/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml
+++ b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies a source endpoint failing to authenticate with 30 unique invalid domain users using the Kerberos protocol. This detection leverages EventCode 4768, specifically looking for failure code 0x6, indicating the user is not found in the Kerberos database. This activity is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this could lead to unauthorized access or privilege escalation within the Active Directory environment, posing a significant security risk.
 data_source:
     - Windows Event Log Security 4768
-search: |-
+search: |
     `wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6
       | bucket span=5m _time
       | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user values(dest) as dest
@@ -28,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential Kerberos based password spraying attack from $IpAddress$
     entity:
@@ -52,9 +52,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml
index 06f87cfeb2d..dc52a9a692a 100644
--- a/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml
+++ b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects a single source endpoint failing to authenticate with 30 unique invalid users using the NTLM protocol. It leverages EventCode 4776 from Domain Controller logs, focusing on error code 0xC0000064, which indicates non-existent usernames. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the Active Directory environment.
 data_source:
     - Windows Event Log Security 4776
-search: |-
+search: |
     `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064
       | bucket span=5m _time
       | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts values(dest) as dest
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Workstation$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Workstation$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential NTLM based password spraying attack from $Workstation$
     entity:
@@ -50,9 +50,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_multiple_ntlm_null_domain_authentications.yml b/detections/endpoint/windows_multiple_ntlm_null_domain_authentications.yml
index 25f7920ce77..43aee48a304 100644
--- a/detections/endpoint/windows_multiple_ntlm_null_domain_authentications.yml
+++ b/detections/endpoint/windows_multiple_ntlm_null_domain_authentications.yml
@@ -11,7 +11,8 @@ data_source:
     - NTLM Operational 8004
     - NTLM Operational 8005
     - NTLM Operational 8006
-search: '`ntlm_audit` EventCode IN (8004,8005,8006) DomainName=NULL UserName!=NULL | eval src = replace(WorkstationName,"\\\\","")  ```CIM alignment, remove leading \\ from some auth attempts ``` | eval dest = SChannelName, user = UserName ``` CIM alignment``` | where SChannelName!=src ``` Remove NTLM auths to self, improves accuracy for certain applications``` | stats count min(_time) as firstTime max(_time) as lastTime dc(eval(upper(user))) as unique_count dc(eval(upper(src))) as src_count by dest | eventstats avg(unique_count) as unique_avg , stdev(unique_count) as unique_std | eval upperBound_unique=(1+unique_avg+unique_std*3) ``` adjust formula for sensitivity``` | eval isOutlier=CASE(unique_count > upperBound_unique, 1, true(), 0) | where isOutlier==1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_multiple_ntlm_null_domain_authentications_filter`'
+search: |
+    `ntlm_audit` EventCode IN (8004,8005,8006) DomainName=NULL UserName!=NULL | eval src = replace(WorkstationName,"\\\\","")  ```CIM alignment, remove leading \\ from some auth attempts ``` | eval dest = SChannelName, user = UserName ``` CIM alignment``` | where SChannelName!=src ``` Remove NTLM auths to self, improves accuracy for certain applications``` | stats count min(_time) as firstTime max(_time) as lastTime dc(eval(upper(user))) as unique_count dc(eval(upper(src))) as src_count by dest | eventstats avg(unique_count) as unique_avg , stdev(unique_count) as unique_std | eval upperBound_unique=(1+unique_avg+unique_std*3) ``` adjust formula for sensitivity``` | eval isOutlier=CASE(unique_count > upperBound_unique, 1, true(), 0) | where isOutlier==1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_multiple_ntlm_null_domain_authentications_filter`
 how_to_implement: The following analytic requires that NTLM Operational logs to be imported from the environment Domain Controllers. This requires configuration of specific auditing settings, see Microsoft references for further guidance. This analytic is specific to EventID 8004~8006.
 known_false_positives: Applications that deal with non-domain joined authentications. Recommend adjusting the upperBound_unique eval for tailoring the correlation to your environment, running with a 24hr search window will smooth out some statistical noise.
 references:
@@ -28,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The device [$dest$] was the target of $count$ NTLM authentications from $src_count$ sources using $unique_count$ unique user accounts.
     entity:
diff --git a/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml
index aad40b8d5f9..de69f65bb22 100644
--- a/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml
+++ b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies a source user failing to authenticate with 30 unique users using explicit credentials on a host. It leverages Windows Event 4648, which is generated when a process attempts an account logon by explicitly specifying account credentials. This detection is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges within an Active Directory environment. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information.
 data_source:
     - Windows Event Log Security 4648
-search: |-
+search: |
     `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$
       | bucket span=5m _time
       | stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) as tried_account values(dest) as dest values(src_ip) as src_ip values(user) as user
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential password spraying attack from $Computer$
     entity:
@@ -51,9 +51,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml
index 907bc7ac7de..e437026eaf9 100644
--- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml
+++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies a single source endpoint failing to authenticate with 30 unique valid users using the NTLM protocol. It leverages EventCode 4776 from Domain Controller logs, focusing on error code 0xC000006A, which indicates a bad password. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access to sensitive information or further compromise of the Active Directory environment.
 data_source:
     - Windows Event Log Security 4776
-search: |-
+search: |
     `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A
       | bucket span=5m _time
       | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts values(dest) as dest
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Workstation$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Workstation$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential NTLM based password spraying attack from $Workstation$
     entity:
@@ -53,9 +53,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml
index e2eaf4743ae..e9d5329f89b 100644
--- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml
+++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects a source process failing to authenticate with 30 unique users, indicating a potential Password Spraying attack. It leverages Windows Event 4625 with Logon Type 2, collected from domain controllers, member servers, and workstations. This activity is significant as it may represent an adversary attempting to gain initial access or elevate privileges within an Active Directory environment. If confirmed malicious, this could lead to unauthorized access, privilege escalation, or further compromise of the network, posing a severe security risk.
 data_source:
     - Windows Event Log Security 4625
-search: |-
+search: |
     `wineventlog_security` EventCode=4625 Logon_Type=2 ProcessName!="-"
       | bucket span=5m _time
       | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts values(dest) as dest values(src) as src values(user) as user
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential password spraying attack from $dest$
     entity:
@@ -55,9 +55,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml
index df8f9277abe..2b63bf4f806 100644
--- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml
+++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies a single source endpoint failing to authenticate with 30 unique users using the Kerberos protocol. It leverages EventCode 4771 with Status 0x18, indicating wrong password attempts, and aggregates these events over a 5-minute window. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges in an Active Directory environment. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information.
 data_source:
     - Windows Event Log Security 4771
-search: |-
+search: |
     `wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18
       | bucket span=5m _time
       | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user values(dest) as dest
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential Kerberos based password spraying attack from $IpAddress$
     entity:
@@ -54,9 +54,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml
index 0e0b3f69325..fa589595e0e 100644
--- a/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml
+++ b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies a source host failing to authenticate against a remote host with 30 unique users. It leverages Windows Event 4625 with Logon Type 3, indicating remote authentication attempts. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges in an Active Directory environment. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information. This detection is crucial for real-time security monitoring and threat hunting.
 data_source:
     - Windows Event Log Security 4625
-search: |-
+search: |
     `wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-"
       | bucket span=5m _time
       | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts values(dest) as dest values(src) as src values(user) as user
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential password spraying attack on $dest$
     entity:
@@ -54,9 +54,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_mustang_panda_usb_tool_execution.yml b/detections/endpoint/windows_mustang_panda_usb_tool_execution.yml
index 767eb630ec7..255d965c401 100644
--- a/detections/endpoint/windows_mustang_panda_usb_tool_execution.yml
+++ b/detections/endpoint/windows_mustang_panda_usb_tool_execution.yml
@@ -6,64 +6,17 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects known executables used for infection or DLL side loading by Mustang Panda being launched from a non-C:\ location.
+description: 'Detects known executables used for infection or DLL side loading by Mustang Panda being launched from a non-C:\ location.
+
     This can indicate a compromise via USB, or external storage device.
-    You will have to adapt this detection if you do not use C:\ as the root device.
+
+    You will have to adapt this detection if you do not use C:\ as the root device.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    NOT Processes.process_path="C:\\*"
-    Processes.process_path IN (
-        "*atkexComSvcRes.exe",
-        "*AtlTraceTool8.exe",
-        "*browser.ex",
-        "*CefSub.exe",
-        "*dabs.ex",
-        "*FacialFeatureDemo.exe",
-        "*GoogleUpdate*.exe",
-        "*GUP.exe",
-        "*HPCustParticUI.exe",
-        "*install_.exe",
-        "*mcsync.ex",
-        "*melt_64.exe",
-        "*mscorsvw.exe",
-        "*OleView.exe",
-        "*piz.exe",
-        "*PlugInInstallerUtility2.exe",
-        "*rar330.exe",
-        "*Samvd.exe",
-        "*scx.exe",
-        "*spoololk.exe",
-        "*Symantec.exe",
-        "*SymantecHp.exe",
-        "*Symantecs.exe",
-        "*Symantecsy.exe",
-        "*upservice.exe",
-        "*vivaldi.exe",
-        "*wsc_proxy.exe",
-        "*ygfdt.exe"
-    )
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_mustang_panda_usb_tool_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.process_path="C:\\*" Processes.process_name IN ("atkexComSvcRes.exe", "AtlTraceTool8.exe", "browser.ex", "CefSub.exe", "dabs.ex", "FacialFeatureDemo.exe", "GoogleUpdate*.exe", "GUP.exe", "HPCustParticUI.exe", "install_.exe", "mcsync.ex", "melt_64.exe", "mscorsvw.exe", "OleView.exe", "piz.exe", "PlugInInstallerUtility2.exe", "rar330.exe", "Samvd.exe", "scx.exe", "spoololk.exe", "Symantec.exe", "SymantecHp.exe", "Symantecs.exe", "Symantecsy.exe", "upservice.exe", "vivaldi.exe", "wsc_proxy.exe", "ygfdt.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mustang_panda_usb_tool_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate tools may be run from external drives or non-C:\ locations for maintenance or portability. Adjust filters accordingly to avoid false alerts for approved usage scenarios.
 references:
@@ -76,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Mustang Panda-associated USB tool execution observed on $dest$ via $process$.
     entity:
diff --git a/detections/endpoint/windows_net_system_service_discovery.yml b/detections/endpoint/windows_net_system_service_discovery.yml
index 78a2d604241..a69f6910b37 100644
--- a/detections/endpoint/windows_net_system_service_discovery.yml
+++ b/detections/endpoint/windows_net_system_service_discovery.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_net`
-        AND
-        Processes.process="* start*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_net_system_service_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*net1.exe" OR Processes.original_file_name="net1.exe" Processes.process="* start*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_net_system_service_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/windows_netspy_network_scanner_execution.yml b/detections/endpoint/windows_netspy_network_scanner_execution.yml
index 00c20cf3b78..5f0dd6d397b 100644
--- a/detections/endpoint/windows_netspy_network_scanner_execution.yml
+++ b/detections/endpoint/windows_netspy_network_scanner_execution.yml
@@ -6,46 +6,17 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects usage of the Netspy scanner on an endpoint.
+description: 'Detects usage of the Netspy scanner on an endpoint.
+
     Netspy is a lightweight, fast, and cross-platform tool designed for internal network segment discovery.
-    The tool supports various protocols, including ICMP, ARP, TCP, and UDP, allowing users to scan for active hosts and services within predefined IP ranges.
+
+    The tool supports various protocols, including ICMP, ARP, TCP, and UDP, allowing users to scan for active hosts and services within predefined IP ranges.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_name="netspy.exe"
-    Processes.process IN (
-        "*arpspy*",
-        "*as*",
-        "*icmpspy*",
-        "*is*",
-        "*pingspy*",
-        "*ps*",
-        "*tcpspy*",
-        "*ts*",
-        "*udpspy*",
-        "*us*"
-    )
-
-    by Processes.process Processes.process_name Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_netspy_network_scanner_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*netspy.exe" Processes.process IN ("*arpspy*", "*as*", "*icmpspy*", "*is*", "*pingspy*", "*ps*", "*tcpspy*", "*ts*", "*udpspy*", "*us*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_netspy_network_scanner_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate network administrators may use Netspy for authorized network discovery and maintenance. Filter alerts for approved internal network scanning activities.
 references:
@@ -59,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_netsupport_rmm_dll_loaded_by_uncommon_process.yml b/detections/endpoint/windows_netsupport_rmm_dll_loaded_by_uncommon_process.yml
index 5c263941b22..680ac4af466 100644
--- a/detections/endpoint/windows_netsupport_rmm_dll_loaded_by_uncommon_process.yml
+++ b/detections/endpoint/windows_netsupport_rmm_dll_loaded_by_uncommon_process.yml
@@ -6,40 +6,23 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the loading of specific dynamic-link libraries (DLLs) associated with the NetSupport Remote Manager (RMM) tool by any process on a Windows system.
-    Modules such as CryptPak.dll, HTCTL32.DLL, IPCTL32.DLL, keyshowhook.dll, pcicapi.DLL, PCICL32.DLL, and TCCTL32.DLL, are integral to NetSupport's functionality.
+description: 'The following analytic detects the loading of specific dynamic-link libraries (DLLs) associated with the NetSupport Remote Manager (RMM) tool by any process on a Windows system.
+
+    Modules such as CryptPak.dll, HTCTL32.DLL, IPCTL32.DLL, keyshowhook.dll, pcicapi.DLL, PCICL32.DLL, and TCCTL32.DLL, are integral to NetSupport''s functionality.
+
     This detection is particularly valuable when these modules are loaded by processes running from unusual directories (e.g., Downloads, ProgramData, or user-specific folders) rather than the legitimate Program Files installation path, or by executables that have been renamed but retain the internal "client32" identifier.
-    This helps to identify instances where the legitimate NetSupport tool is being misused by adversaries as a Remote Access Trojan (RAT).
+
+    This helps to identify instances where the legitimate NetSupport tool is being misused by adversaries as a Remote Access Trojan (RAT).'
 data_source:
     - Sysmon EventID 7
 search: |
-    `sysmon`
-    EventCode=7
-    ImageLoaded IN (
-      "*\\CryptPak.dll",
-      "*\\HTCTL32.DLL",
-      "*\\pcicapi.dll",
-      "*\\pcichek.dll",
-      "*\\PCICL32.DLL",
-      "*\\TCCTL32.DLL"
-    )
-    NOT Image IN ("C:\\Program Files\\*", "C:\\Program Files (x86)\\*")
-    Signature = "NetSupport Ltd*"
-    | fillnull
-    | stats count min(_time) as firstTime max(_time) as lastTime
-      by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec
-         process_guid process_hash process_id process_name process_path service_dll_signature_exists
-         service_dll_signature_verified signature signature_id user_id vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_netsupport_rmm_dll_loaded_by_uncommon_process_filter`
-how_to_implement: |
-    To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded executions from your endpoints.
-    If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: |
-    NetSupport RMM installations outside of the standard Program Files directory will trigger this detection.
-    Apply appropriate filters to exclude known legitimate installations.
+    `sysmon` EventCode=7 ImageLoaded IN ("*\\CryptPak.dll", "*\\HTCTL32.DLL", "*\\pcicapi.dll", "*\\pcichek.dll", "*\\PCICL32.DLL", "*\\TCCTL32.DLL") NOT (Image IN ("C:\\Program Files\\*", "C:\\Program Files (x86)\\*")) Signature="NetSupport Ltd*" | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_netsupport_rmm_dll_loaded_by_uncommon_process_filter`
+how_to_implement: 'To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded executions from your endpoints.
+
+    If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.'
+known_false_positives: 'NetSupport RMM installations outside of the standard Program Files directory will trigger this detection.
+
+    Apply appropriate filters to exclude known legitimate installations.'
 references:
     - https://www.linkedin.com/posts/mauricefielenbach_cybersecurity-incidentresponse-dfir-activity-7394805779448418304-g0gZ?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAuFTjIB5weY_kcyu4qp3kHbI4v49tO0zEk
     - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
@@ -52,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_network_connection_discovery_via_net.yml b/detections/endpoint/windows_network_connection_discovery_via_net.yml
index c4377f99701..c39f4486b81 100644
--- a/detections/endpoint/windows_network_connection_discovery_via_net.yml
+++ b/detections/endpoint/windows_network_connection_discovery_via_net.yml
@@ -11,27 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            `process_net`
-            OR
-            (Processes.process_name="net.exe"
-            OR
-            Processes.original_file_name="net.exe")
-        )
-        AND (Processes.process=*use)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_network_connection_discovery_via_net_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*net1.exe", "*net.exe") OR Processes.original_file_name IN ("net1.exe", "net.exe") Processes.process="*use" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_connection_discovery_via_net_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/windows_network_connection_from_program_in_suspect_location.yml b/detections/endpoint/windows_network_connection_from_program_in_suspect_location.yml
index 5faa0183c0a..e20b7cb7641 100644
--- a/detections/endpoint/windows_network_connection_from_program_in_suspect_location.yml
+++ b/detections/endpoint/windows_network_connection_from_program_in_suspect_location.yml
@@ -6,13 +6,14 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects network connections from processes running out of suspicious Windows directories such as Recycle Bin, Public, PerfLogs, systemprofile, Fonts, IME, and Addins paths.
+description: 'The following analytic detects network connections from processes running out of suspicious Windows directories such as Recycle Bin, Public, PerfLogs, systemprofile, Fonts, IME, and Addins paths.
+
     This activity is significant because malware often executes from writable or unusual directories while communicating with external infrastructure.
-    If confirmed malicious, the process may represent command-and-control, staging, or data exfiltration activity from a compromised endpoint.
+
+    If confirmed malicious, the process may represent command-and-control, staging, or data exfiltration activity from a compromised endpoint.'
 data_source:
     - Sysmon EventID 3
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -52,7 +53,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_network_share_interaction_via_net.yml b/detections/endpoint/windows_network_share_interaction_via_net.yml
index dc8554eb1be..86ba2ec3d99 100644
--- a/detections/endpoint/windows_network_share_interaction_via_net.yml
+++ b/detections/endpoint/windows_network_share_interaction_via_net.yml
@@ -11,27 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            `process_net`
-            OR
-            (Processes.process_name="net.exe"
-            OR
-            Processes.original_file_name="net.exe")
-        )
-        AND Processes.process IN ("*use *", "*view*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_network_share_interaction_via_net_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*net1.exe", "*net.exe") OR Processes.original_file_name IN ("net1.exe", "net.exe") Processes.process IN ("*use *", "*view*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_share_interaction_via_net_filter`
 how_to_implement: The detection is based on data originating from either Endpoint Detection and Response (EDR) telemetry or EventCode 4688 with process command line logging enabled. These sources provide security-related telemetry from the endpoints. To implement this search, you must ingest logs that contain the process name, parent process, and complete command-line executions. These logs must be mapped to the Splunk Common Information Model (CIM) to normalize the field names capture the data within the datamodel schema.
 known_false_positives: Administrators or power users may use this command. Additional filters needs to be applied.
 references:
diff --git a/detections/endpoint/windows_network_sniffing_tool_executed.yml b/detections/endpoint/windows_network_sniffing_tool_executed.yml
index c2688a50b95..21d013d275d 100644
--- a/detections/endpoint/windows_network_sniffing_tool_executed.yml
+++ b/detections/endpoint/windows_network_sniffing_tool_executed.yml
@@ -6,49 +6,21 @@ modification_date: '2026-10-02'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the execution of common network sniffing tools on Windows systems, including Wireshark, WinPcap, tcpdump, and similar utilities.
+description: 'The following analytic detects the execution of common network sniffing tools on Windows systems, including Wireshark, WinPcap, tcpdump, and similar utilities.
+
     This activity is significant because attackers use packet capture tools to intercept and analyze network traffic, enabling credential theft, sensitive data harvesting, and reconnaissance of internal network communications.
+
     While these tools have legitimate administrative uses, their presence in unexpected environments may indicate an adversary conducting man-in-the-middle attacks or exfiltrating sensitive information traversing the network.
-    If confirmed malicious, this could lead to the exposure of credentials, session tokens, and confidential data, facilitating lateral movement and further compromise of the environment.
+
+    If confirmed malicious, this could lead to the exposure of credentials, session tokens, and confidential data, facilitating lateral movement and further compromise of the environment.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_name IN (
-        "dumpcap.exe",
-        "netcap.exe",
-        "netmon.exe",
-        "tcpdump.exe",
-        "tshark.exe",
-        "windump.exe",
-        "winpcap.exe",
-        "wireshark.exe"
-    )
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid
-       Processes.parent_process_id Processes.process_guid Processes.process_id
-       Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_network_sniffing_tool_executed_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate network administrators and security teams may use these tools for authorized network monitoring and troubleshooting. Filter based on approved software inventory and known administrative activity.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*dumpcap.exe", "*netcap.exe", "*netmon.exe", "*tcpdump.exe", "*tshark.exe", "*windump.exe", "*winpcap.exe", "*wireshark.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_sniffing_tool_executed_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate network administrators and security teams may use these tools for authorized network monitoring and troubleshooting. Filter based on approved software inventory and known administrative activity.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1040/T1040.md
     - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml#L86
@@ -95,8 +67,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
+      test_type: unit
diff --git a/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml b/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml
index 428bde53f8e..9b12f1ee04c 100644
--- a/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml
+++ b/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious modifications to the EventLog security descriptor registry value for defense evasion. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CustomSD" value within the "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\<Channel>\CustomSD" path. This activity is significant as changes to the access permissions of the event log could blind security products and help attackers evade defenses. If confirmed malicious, this could allow attackers to block users and security products from viewing, ingesting and interacting event logs.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\Services\\Eventlog\\*" AND Registry.registry_value_name=CustomSD by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_custom_security_descriptor_set_on_eventlog_channel_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Services\\Eventlog\\*" Registry.registry_value_name="*CustomSD" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_custom_security_descriptor_set_on_eventlog_channel_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time. a legacy option and shouldn't be a common activity.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_new_default_file_association_value_set.yml b/detections/endpoint/windows_new_default_file_association_value_set.yml
index 652a9b3c410..5d146fe80cb 100644
--- a/detections/endpoint/windows_new_default_file_association_value_set.yml
+++ b/detections/endpoint/windows_new_default_file_association_value_set.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects registry changes to the default file association value. It leverages data from the Endpoint data model, specifically monitoring registry paths under "HKCR\\*\\shell\\open\\command\\*". This activity can be significant because, attackers might alter the default file associations in order to execute arbitrary scripts or payloads when a user opens a file, leading to potential code execution. If confirmed malicious, this technique can enable attackers to persist on the compromised host and execute further malicious commands, posing a severe threat to the environment.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\shell\\open\\command\\*" Registry.registry_path IN ("*HKCR\\*", "*HKEY_CLASSES_ROOT\\*") by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_new_default_file_association_value_set_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\shell\\open\\command\\*" Registry.registry_path IN ("*HKCR\\*", "*HKEY_CLASSES_ROOT\\*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_default_file_association_value_set_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 known_false_positives: Windows and third party software will create and modify these file associations during installation or upgrades. Additional filters needs to be applied to tune environment specific false positives.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 analytic_story:
     - Hermetic Wiper
     - Windows Registry Abuse
diff --git a/detections/endpoint/windows_new_deny_permission_set_on_service_sd_via_sc_exe.yml b/detections/endpoint/windows_new_deny_permission_set_on_service_sd_via_sc_exe.yml
index 1abbf79f2e7..07afed5ab80 100644
--- a/detections/endpoint/windows_new_deny_permission_set_on_service_sd_via_sc_exe.yml
+++ b/detections/endpoint/windows_new_deny_permission_set_on_service_sd_via_sc_exe.yml
@@ -6,68 +6,21 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects changes in a service security descriptor where a new deny ace has been added.
+description: 'The following analytic detects changes in a service security descriptor where a new deny ace has been added.
+
     It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for any process execution involving the "sc.exe" binary with the "sdset" flag targeting any service and adding a dedicated deny ace to specific groups.
+
     If confirmed malicious, this could allow an attacker to escalate their privileges, blind defenses and more.
-    Investigate appropariate services and groups to determine if the behavior is malicious.
+
+    Investigate appropariate services and groups to determine if the behavior is malicious.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-            values(Processes.process) as process
-    FROM datamodel=Endpoint.Processes WHERE
-    (
-        Processes.process_name=sc.exe
-        OR
-        Processes.original_file_name=sc.exe
-    )
-    Processes.process="*sdset *"
-    Processes.process="*(D;*"
-    Processes.process IN (
-        "*;IU*",
-        "*;S-1-5-4*",
-        "*;SU*",
-        "*;S-1-5-6*",
-        "*;BA*",
-        "*;S-1-5-32-544*",
-        "*;SY*",
-        "*;S-1-5-18*",
-        "*;WD*",
-        "*;S-1-1-0*",
-        "*;AU*",
-        "*;S-1-5-11*",
-        "*;LS*",
-        "*;S-1-5-19*"
-    )
-    NOT Processes.process IN (
-        "*macmnsvc*",
-        "*masvc*",
-        "*McAfeeFramework*",
-        "*mfefire*",
-        "*mfemms*",
-        "*mfevtp*",
-    )
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_new_deny_permission_set_on_service_sd_via_sc_exe_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    - McAfee related services changes are a known false positive. The sc.exe utility is used to deny groups such as Authenticated Users, Built-in Administrators and System access to certain permissions.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sc.exe" OR Processes.original_file_name="sc.exe" Processes.process="*sdset *" Processes.process="*(D;*" Processes.process IN ("*;IU*", "*;S-1-5-4*", "*;SU*", "*;S-1-5-6*", "*;BA*", "*;S-1-5-32-544*", "*;SY*", "*;S-1-5-18*", "*;WD*", "*;S-1-1-0*", "*;AU*", "*;S-1-5-11*", "*;LS*", "*;S-1-5-19*") NOT (Processes.process IN ("*macmnsvc*", "*masvc*", "*McAfeeFramework*", "*mfefire*", "*mfemms*", "*mfevtp*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_deny_permission_set_on_service_sd_via_sc_exe_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: '- McAfee related services changes are a known false positive. The sc.exe utility is used to deny groups such as Authenticated Users, Built-in Administrators and System access to certain permissions.'
 references:
     - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
     - https://news.sophos.com/wp-content/uploads/2020/06/glupteba_final-1.pdf
@@ -80,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml
index e8905ea4a08..b84f98118b4 100644
--- a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml
+++ b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious modifications to the EventLog security descriptor registry value for defense evasion. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CustomSD" value within the "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\<Channel>\CustomSD" path. This activity is significant as changes to the access permissions of the event log could blind security products and help attackers evade defenses. If confirmed malicious, this could allow attackers to block users and security products from viewing, ingesting and interacting event logs.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path IN ("*\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\*", "*\Microsoft\Windows\EventLog\*") AND Registry.registry_value_name=ChannelAccess by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_eventlog_channelaccess_registry_value_set_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\*", "*MicrosoftWindowsEventLog*") Registry.registry_value_name="*ChannelAccess" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_eventlog_channelaccess_registry_value_set_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: False positives may be triggered from newly installed event providers or windows updates, new "ChannelAccess" values must be investigated.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_new_inprocserver32_added.yml b/detections/endpoint/windows_new_inprocserver32_added.yml
index 286ad20dd6a..3447a729dda 100644
--- a/detections/endpoint/windows_new_inprocserver32_added.yml
+++ b/detections/endpoint/windows_new_inprocserver32_added.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects the addition of new InProcServer32 registry keys on Windows endpoints. It leverages data from the Endpoint.Registry datamodel to identify changes in registry paths associated with InProcServer32. This activity is significant because malware often uses this mechanism to achieve persistence or execute malicious code by registering a new InProcServer32 key pointing to a harmful DLL. If confirmed malicious, this could allow an attacker to persist in the environment or execute arbitrary code, posing a significant threat to system integrity and security.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\InProcServer32\\*" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.dest Registry.process_guid Registry.user | `drop_dm_object_name(Registry)` |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_inprocserver32_added_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\InProcServer32\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_inprocserver32_added_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 known_false_positives: False positives are expected. Filtering will be needed to properly reduce legitimate applications from the results.
 references:
@@ -32,6 +33,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/cve-2024-21378/inprocserver32_windows-sysmon.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_new_service_security_descriptor_set_via_sc_exe.yml b/detections/endpoint/windows_new_service_security_descriptor_set_via_sc_exe.yml
index e9570a01302..276aba42405 100644
--- a/detections/endpoint/windows_new_service_security_descriptor_set_via_sc_exe.yml
+++ b/detections/endpoint/windows_new_service_security_descriptor_set_via_sc_exe.yml
@@ -6,45 +6,23 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects changes in a service security descriptor.
+description: 'The following analytic detects changes in a service security descriptor.
+
     It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for any process execution involving the "sc.exe" binary with the "sdset" flag targeting any service.
-    This behavior can be legitimate, such as when a user or administrator is configuring a service's security settings.
+
+    This behavior can be legitimate, such as when a user or administrator is configuring a service''s security settings.
+
     Investigate appropariate services to determine if the behavior is malicious.
-    If confirmed malicious, this could allow an attacker to escalate their privileges, blind defenses and more.
+
+    If confirmed malicious, this could allow an attacker to escalate their privileges, blind defenses and more.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-            values(Processes.process) as process
-
-    FROM datamodel=Endpoint.Processes WHERE
-    (
-        Processes.process_name=sc.exe
-        OR
-        Processes.original_file_name=sc.exe
-    )
-    Processes.process="*sdset *"
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_new_service_security_descriptor_set_via_sc_exe_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    - False positives are expected from legitimate system administrator scripts or installation utilities. Filter known parent image and commandline combinations.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sc.exe" OR Processes.original_file_name="sc.exe" Processes.process="*sdset *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_service_security_descriptor_set_via_sc_exe_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: '- False positives are expected from legitimate system administrator scripts or installation utilities. Filter known parent image and commandline combinations.'
 references:
     - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
     - https://news.sophos.com/wp-content/uploads/2020/06/glupteba_final-1.pdf
@@ -57,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml
index 0f8ad3b931f..c00e3b7c234 100644
--- a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml
+++ b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=ngrok.exe Processes.process IN ("*start*", "*--config*","*http*","*authtoken*", "*tcp*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_ngrok_reverse_proxy_usage_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*ngrok.exe" Processes.process IN ("*start*", "*--config*", "*http*", "*authtoken*", "*tcp*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ngrok_reverse_proxy_usage_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives will be present based on organizations that allow the use of Ngrok. Filter or monitor as needed.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml
index 7e4a09118f1..ed7cebf6102 100644
--- a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml
+++ b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml
@@ -6,11 +6,13 @@ modification_date: '2026-10-01'
 author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the creation of files associated with the NirSoft tool bundles on Windows endpoints.
+description: 'The following analytic detects the creation of files associated with the NirSoft tool bundles on Windows endpoints.
+
     NirSoft is a well-known provider of free, portable utilities that can be used for various system and network tasks. However, threat actors often leverage these tools for malicious purposes, such as credential harvesting, network reconnaissance, and data exfiltration.
+
     The detection focuses on the creation of specific NirSoft tool bundle files, which may indicate that an attacker is preparing to use these utilities on a compromised system.
-    Security teams should investigate any instances of these files being created, especially if they are found in unexpected locations or on systems that should not be using such tools.
+
+    Security teams should investigate any instances of these files being created, especially if they are found in unexpected locations or on systems that should not be using such tools.'
 data_source:
     - Sysmon EventID 11
 search: |
@@ -38,13 +40,14 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_nirsoft_tool_bundle_file_created_filter`
-how_to_implement: |
-    To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node.
+how_to_implement: 'To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node.
+
     This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon.
-    The data used for this search is typically generated via logs that report file-system reads and writes.
-known_false_positives: |
-    Administrators or users may download NirSoft tools for legitimate purposes, such as system maintenance or troubleshooting.
-    These instances should be reviewed to determine if the activity is authorized.
+
+    The data used for this search is typically generated via logs that report file-system reads and writes.'
+known_false_positives: 'Administrators or users may download NirSoft tools for legitimate purposes, such as system maintenance or troubleshooting.
+
+    These instances should be reviewed to determine if the activity is authorized.'
 references:
     - https://thedfirreport.com/2020/04/04/gogoogle-ransomware/
     - https://asec.ahnlab.com/en/48940/
@@ -58,7 +61,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml
index 5d5dd6628d8..91869e4bb61 100644
--- a/detections/endpoint/windows_nirsoft_utilities.yml
+++ b/detections/endpoint/windows_nirsoft_utilities.yml
@@ -6,12 +6,15 @@ modification_date: '2026-10-09'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems.
+description: 'The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems.
+
     This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance.
+
     If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise.
+
     Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes.
-    Apply additional filtering as necessary to enhance this.
+
+    Apply additional filtering as necessary to enhance this.'
 data_source:
     - Sysmon EventID 1
 search: |
@@ -42,9 +45,9 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_nirsoft_utilities_filter`
-how_to_implement: |-
-    To successfully implement this search, ingest process creation events from your endpoints and normalize them to the Processes node of the Endpoint data model using the Splunk Common Information Model (CIM).
-    Ensure the normalized events populate the original_file_name field, which this search uses to identify NirSoft utilities. Supported sources might include Sysmon and CrowdStrike ProcessRollup2 when mapped to the data model.
+how_to_implement: 'To successfully implement this search, ingest process creation events from your endpoints and normalize them to the Processes node of the Endpoint data model using the Splunk Common Information Model (CIM).
+
+    Ensure the normalized events populate the original_file_name field, which this search uses to identify NirSoft utilities. Supported sources might include Sysmon and CrowdStrike ProcessRollup2 when mapped to the data model.'
 known_false_positives: False positives may be present. Filtering may be required before setting to alert.
 references:
     - https://www.cisa.gov/uscert/ncas/alerts/TA18-201A
@@ -59,7 +62,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_njrat_fileless_storage_via_registry.yml b/detections/endpoint/windows_njrat_fileless_storage_via_registry.yml
index 15e6a90e5ca..dbc7e9787d8 100644
--- a/detections/endpoint/windows_njrat_fileless_storage_via_registry.yml
+++ b/detections/endpoint/windows_njrat_fileless_storage_via_registry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects suspicious registry modifications indicative of NjRat's fileless storage technique. It leverages the Endpoint.Registry data model to identify specific registry paths and values commonly used by NjRat for keylogging and executing DLL plugins. This activity is significant as it helps evade traditional file-based detection systems, making it crucial for SOC analysts to monitor. If confirmed malicious, this behavior could allow attackers to persist on the host, execute arbitrary code, and capture sensitive keystrokes, leading to potential data breaches and further system compromise.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\[kl]" OR  Registry.registry_value_data IN ("*[ENTER]*", "*[TAP]*", "*[Back]*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_njrat_fileless_storage_via_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\[kl]" OR Registry.registry_value_data IN ("*[ENTER]*", "*[TAP]*", "*[Back]*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_njrat_fileless_storage_via_registry_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: a suspicious registry entry related to NjRAT keylloging registry on $dest$
     entity:
diff --git a/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml b/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml
index 12620b32bc1..88b828d3236 100644
--- a/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml
+++ b/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml
@@ -6,15 +6,16 @@ modification_date: '2026-09-16'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic identifies `node.exe` directly executing a single `.js` script located in the same directory it was launched from, where that directory is an unusual location such as a user profile, PerfLogs, ProgramData, or Temp folder.
+description: 'The following analytic identifies `node.exe` directly executing a single `.js` script located in the same directory it was launched from, where that directory is an unusual location such as a user profile, PerfLogs, ProgramData, or Temp folder.
+
     Legitimate Node.js application, module, and package manager directories are excluded.
-    This pattern is commonly associated with malware loaders and second-stage payloads that leverage the Node.js runtime to execute JavaScript outside of a typical development or application context.
+
+    This pattern is commonly associated with malware loaders and second-stage payloads that leverage the Node.js runtime to execute JavaScript outside of a typical development or application context.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -69,13 +70,17 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_node_exe_executing_js_script_in_immediate_folder_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are
+
     designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this
+
     search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must
+
     ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons
+
     that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model.
-    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+
+    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.'
 known_false_positives: Legitimate custom Node.js tooling or utility scripts that are intentionally placed and executed from a user profile, PerfLogs, ProgramData, or Temp directory may trigger this analytic.
 references:
     - https://www.bluevoyant.com/blog/clickfix-to-nodejs-rat
diff --git a/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml b/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml
index 929fe80e689..30ec5539cd4 100644
--- a/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml
+++ b/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects non-Discord applications accessing the Discord LevelDB database. It leverages Windows Security Event logs, specifically event code 4663, to identify file access attempts to the LevelDB directory by processes other than Discord. This activity is significant as it may indicate attempts to steal Discord credentials or access sensitive user data. If confirmed malicious, this could lead to unauthorized access to user profiles, messages, and other critical information, potentially compromising the security and privacy of the affected users.
 data_source:
     - Windows Event Log Security 4663
-search: '`wineventlog_security` EventCode=4663 object_file_path IN ("*\\discord\\Local Storage\\leveldb*") AND process_name != *\\discord.exe AND NOT (process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWow64\\*", "*:\\Program Files*", "*:\\Windows\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_non_discord_app_access_discord_leveldb_filter`'
+search: |
+    `wineventlog_security` EventCode=4663 object_file_path="*\\discord\\Local Storage\\leveldb*" NOT process_name="*\\discord.exe" NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*", "*:\\Program Files*", "*:\\Windows\\*")) | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_non_discord_app_access_discord_leveldb_filter`
 how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_non_system_account_targeting_lsass.yml b/detections/endpoint/windows_non_system_account_targeting_lsass.yml
index 902254e559a..f86b712c14f 100644
--- a/detections/endpoint/windows_non_system_account_targeting_lsass.yml
+++ b/detections/endpoint/windows_non_system_account_targeting_lsass.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies non-SYSTEM accounts requesting access to lsass.exe. This detection leverages Sysmon EventCode 10 logs to monitor access attempts to the Local Security Authority Subsystem Service (lsass.exe) by non-SYSTEM users. This activity is significant as it may indicate credential dumping attempts or unauthorized access to sensitive credentials. If confirmed malicious, an attacker could potentially extract credentials from memory, leading to privilege escalation or lateral movement within the network. Immediate investigation is required to determine the legitimacy of the access request and to mitigate any potential threats.
 data_source:
     - Sysmon EventID 10
-search: '`sysmon` EventCode=10 TargetImage=*lsass.exe NOT (SourceUser="NT AUTHORITY\\*") | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_non_system_account_targeting_lsass_filter`'
+search: |
+    `sysmon` EventCode=10 TargetImage="*lsass.exe" NOT SourceUser="NT AUTHORITY\\*" | eval granted_access=granted_access, parent_process_path=parent_process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest user_id process_name process_guid process_id signature SourceImage TargetImage GrantedAccess CallTrace | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_non_system_account_targeting_lsass_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
 known_false_positives: False positives will occur based on legitimate application requests, filter based on source image as needed.
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_id$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process, $parent_process_path$, has loaded $TargetImage$ that are typically related to credential dumping on $dest$. Review for further details.
     entity:
diff --git a/detections/endpoint/windows_non_system_process_querying_definition_update.yml b/detections/endpoint/windows_non_system_process_querying_definition_update.yml
index b428d437a8c..0e91cf15334 100644
--- a/detections/endpoint/windows_non_system_process_querying_definition_update.yml
+++ b/detections/endpoint/windows_non_system_process_querying_definition_update.yml
@@ -6,42 +6,15 @@ modification_date: '2026-10-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component.
-    BlueHammer utilizes these definition updates as part of its exploit chain.
+description: 'Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component.
+
+    BlueHammer utilizes these definition updates as part of its exploit chain.'
 data_source:
     - Sysmon EventID 22
-search: |-
-    `sysmon`
-    EventID="22"
-    QueryName="*definitionupdates.microsoft.com*"
-    NOT Image IN (
-        "C:\\Program Files\\Microsoft Office\\*",
-        "C:\\Program Files\\Windows Defender\\*",
-        "C:\\ProgramData\\Microsoft\\Windows Defender\\*",
-        "C:\\Windows\\System32\\*",
-        "C:\\Windows\\SysWOW64\\*"
-    )
-
-    | rename Computer as dest,
-             Image as process_path
-
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-
-      by src dest answer answer_count
-         process_path process_name process_exec process_guid
-         query query_count QueryResults record_type reply_code_id
-         signature signature_id user_id vendor_product
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-
-    | `windows_non_system_process_querying_definition_update_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate third-party applications or security tools may query these update domains for Windows Defender updates. Filter alerts for trusted software and verified update mechanisms.
+search: |
+    `sysmon` EventCode=22 QueryName="*definitionupdates.microsoft.com*" NOT (Image IN ("C:\\Program Files\\Microsoft Office\\*", "C:\\Program Files\\Windows Defender\\*", "C:\\ProgramData\\Microsoft\\Windows Defender\\*", "C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*")) | eval process_name=process_name, dvc=dvc, dest=Computer, QueryName=QueryName | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count query query_count reply_code_id src vendor_product process_path | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_non_system_process_querying_definition_update_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate third-party applications or security tools may query these update domains for Windows Defender updates. Filter alerts for trusted software and verified update mechanisms.
 references:
     - https://github.com/Nightmare-Eclipse/BlueHammer
 drilldown_searches:
diff --git a/detections/endpoint/windows_northstar_c2_agent_execution.yml b/detections/endpoint/windows_northstar_c2_agent_execution.yml
index 113a88f704a..217fee40c49 100644
--- a/detections/endpoint/windows_northstar_c2_agent_execution.yml
+++ b/detections/endpoint/windows_northstar_c2_agent_execution.yml
@@ -6,39 +6,17 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects the initial agent or persistent agent processes for Northstar C2 being run.
+description: 'Detects the initial agent or persistent agent processes for Northstar C2 being run.
+
     NorthStarC2 is an open-source command and control framework developed for penetration testing and red teaming purposes by Engin Demirbilek.
-    NorthStar C2 Framework consists of two applications, a server-side GUI web application for managing sessions and a client-side stager to communicate with C2 server.
+
+    NorthStar C2 Framework consists of two applications, a server-side GUI web application for managing sessions and a client-side stager to communicate with C2 server.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.original_file_name="NorthstarStager.exe"
-    OR
-    Processes.process_name IN (
-        "NorthstarStager.exe",
-        "SystemHealthCheck.exe"
-    )
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_northstar_c2_agent_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.original_file_name="NorthstarStager.exe" OR Processes.process_name IN ("*NorthstarStager.exe", "*SystemHealthCheck.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_northstar_c2_agent_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate red team or penetration testing activities may use Northstar C2 agents. Filter alerts when these tools are approved for authorized testing.
 references:
@@ -51,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: NorthStar C2 agent execution observed on $dest$ via $process$.
     entity:
diff --git a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml
index 52a4fea38c5..10e869e2140 100644
--- a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml
+++ b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml
@@ -9,15 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of RAR Self-Extracting (SFX) files by monitoring the generation of file related to rar sfx .tmp file creation during sfx installation. This method leverages a heuristic to identify RAR SFX archives based on specific markers that indicate a combination of executable code and compressed RAR data. By tracking such activity, the analytic helps pinpoint potentially unauthorized or suspicious file creation events, which are often associated with malware packaging or data exfiltration. Legitimate usage may include custom installers or compressed file delivery.
 data_source:
     - Sysmon EventID 11
-search: |-
-    `sysmon` EventCode=11 TargetFilename IN ("*__tmp_rar_sfx_access_check*")
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY action dest file_name
-           file_path process_guid process_id
-           user user_id vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_obfuscated_files_or_information_via_rar_sfx_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*__tmp_rar_sfx_access_check*" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_obfuscated_files_or_information_via_rar_sfx_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, TargetFilename, and eventcode 11 executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where rar sfx executable may be used.
 known_false_positives: It can detect a third part utility software tool compiled to rar sfx.
 references:
@@ -30,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_odbcconf_hunting.yml b/detections/endpoint/windows_odbcconf_hunting.yml
index 600ac7ab14b..856d64ea6c7 100644
--- a/detections/endpoint/windows_odbcconf_hunting.yml
+++ b/detections/endpoint/windows_odbcconf_hunting.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=odbcconf.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_odbcconf_hunting_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*odbcconf.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_hunting_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives will be present as this is meant to assist with filtering and tuning.
 references:
diff --git a/detections/endpoint/windows_odbcconf_load_dll.yml b/detections/endpoint/windows_odbcconf_load_dll.yml
index 73a269d2df5..a35141fa527 100644
--- a/detections/endpoint/windows_odbcconf_load_dll.yml
+++ b/detections/endpoint/windows_odbcconf_load_dll.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=odbcconf.exe Processes.process IN ("*/a *",  "*-a*") Processes.process="*regsvr*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_odbcconf_load_dll_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*odbcconf.exe" Processes.process IN ("*/a *", "*-a*") Processes.process="*regsvr*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_dll_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls.
     entity:
diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml
index 9a9028cbaf0..e57a8080607 100644
--- a/detections/endpoint/windows_odbcconf_load_response_file.yml
+++ b/detections/endpoint/windows_odbcconf_load_response_file.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=odbcconf.exe Processes.process IN ("*-f *","*/f *") Processes.process="*.rsp*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_odbcconf_load_response_file_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*odbcconf.exe" Processes.process IN ("*-f *", "*/f *") Processes.process="*.rsp*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_response_file_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls.
     entity:
diff --git a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml
index b487e7bd261..ac19995736e 100644
--- a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml
+++ b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml
@@ -10,7 +10,7 @@ description: The following analytic detects Office products writing .cab or .inf
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 11
     - Windows Event Log Security 4688 AND Sysmon EventID 11
-search: |-
+search: |
     | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
       WHERE `process_office_products`
       BY _time span=1h Processes.action
@@ -51,7 +51,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $process_name$ was identified on $dest$ writing an inf or cab file to this. This is not typical of $process_name$.
     entity:
diff --git a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml
index 2720d6d0511..777910fa5e0 100644
--- a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml
+++ b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects Microsoft Office applications dropping or creating executables or scripts on a Windows OS. It leverages process creation and file system events from the Endpoint data model to identify Office applications like Word or Excel generating files with extensions such as ".exe", ".dll", or ".ps1". This behavior is significant as it is often associated with spear-phishing attacks where malicious files are dropped to compromise the host. If confirmed malicious, this activity could lead to code execution, privilege escalation, or persistent access, posing a severe threat to the environment.
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 11
-search: |-
+search: |
     | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
       WHERE `process_office_products`
       BY _time span=1h Processes.action
@@ -47,7 +47,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_office_product_loaded_mshtml_module.yml b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml
index b1ca85f4ab9..76ecbd3e667 100644
--- a/detections/endpoint/windows_office_product_loaded_mshtml_module.yml
+++ b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the loading of the mshtml.dll module into an Office product, which is indicative of CVE-2021-40444 exploitation. It leverages Sysmon EventID 7 to monitor image loads by specific Office processes. This activity is significant because it can indicate an attempt to exploit a vulnerability in the MSHTML component via a malicious document. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further network penetration.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventID=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe", "wordpad.exe", "wordview.exe") loaded_file_path IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loaded_mshtml_module_filter`'
+search: |
+    `sysmon` EventCode=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe", "wordpad.exe", "wordview.exe") loaded_file_path IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll", "*\\IE.Interop.MSHTML.dll", "*\\MshtmlDac.dll", "*\\MshtmlDed.dll", "*\\MshtmlDer.dll") | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loaded_mshtml_module_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: Limited false positives will be present, however, tune as necessary. Some applications may legitimately load mshtml.dll.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_office_product_loading_taskschd_dll.yml b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml
index b459d8c21cd..0dfc608fc5a 100644
--- a/detections/endpoint/windows_office_product_loading_taskschd_dll.yml
+++ b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects an Office document creating a scheduled task, either through a macro VBA API or by loading `taskschd.dll`. This detection leverages Sysmon EventCode 7 to identify when Office applications load the `taskschd.dll` file. This activity is significant as it is a common technique used by malicious macro malware to establish persistence or initiate beaconing. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary commands, or schedule future malicious activities, posing a significant threat to the environment.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") loaded_file_path = "*\\taskschd.dll" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loading_taskschd_dll_filter`'
+search: |
+    `sysmon` EventCode=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") loaded_file_path="*\\taskschd.dll" | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loading_taskschd_dll_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config.
 known_false_positives: False positives may occur if legitimate office documents are creating scheduled tasks. Ensure to investigate the scheduled task and the command to be executed. If the task is benign, add the task name to the exclusion list. Some applications may legitimately load taskschd.dll.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_office_product_loading_vbe7_dll.yml b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml
index c98dd31698d..ffc34e6e8dc 100644
--- a/detections/endpoint/windows_office_product_loading_vbe7_dll.yml
+++ b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic identifies office documents executing macro code. It leverages Sysmon EventCode 7 to detect when processes like WINWORD.EXE or EXCEL.EXE load specific DLLs associated with macros (e.g., VBE7.DLL). This activity is significant because macros are a common attack vector for delivering malicious payloads, such as malware. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the system. Disabling macros by default is recommended to mitigate this risk.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") loaded_file_path IN ("*\\VBE7INTL.DLL", "*\\VBE7.DLL", "*\\VBEUI.DLL") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loading_vbe7_dll_filter`'
+search: |
+    `sysmon` EventCode=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") loaded_file_path IN ("*\\VBE7INTL.DLL", "*\\VBE7.DLL", "*\\VBEUI.DLL") | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loading_vbe7_dll_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config.
 known_false_positives: False positives may occur if legitimate office documents are executing macro code. Ensure to investigate the macro code and the command to be executed. If the macro code is benign, add the document name to the exclusion list. Some applications may legitimately load VBE7INTL.DLL, VBE7.DLL, or VBEUI.DLL.
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml
index 41281a77dad..fcf0003a4b8 100644
--- a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml
+++ b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml
@@ -12,25 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    `process_office_products_parent`
-    Processes.process IN ("*http:*","*https:*")
-    NOT (
-      Processes.original_file_name IN ("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")
-      OR
-      Processes.process_name IN ("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")
-    )
-    by Processes.action Processes.dest
-    Processes.original_file_name Processes.parent_process Processes.parent_process_exec
-    Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
-    Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
-    Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
-    Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_office_product_spawned_child_process_for_download_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*EQNEDT32.exe", "*excel.exe", "*Graph.exe", "*msaccess.exe", "*mspub.exe", "*onenote.exe", "*onenoteim.exe", "*onenotem.exe", "*outlook.exe", "*powerpnt.exe", "*visio.exe", "*winproj.exe", "*winword.exe") Processes.process IN ("*http:*", "*https:*") NOT (Processes.original_file_name IN ("firefox.exe", "chrome.exe", "iexplore.exe", "msedge.exe") OR Processes.process_name IN ("*firefox.exe", "*chrome.exe", "*iexplore.exe", "*msedge.exe")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_spawned_child_process_for_download_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Default browser not in the filter list.
 references:
@@ -44,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Office document spawning suspicious child process on $dest$
     entity:
diff --git a/detections/endpoint/windows_office_product_spawned_control.yml b/detections/endpoint/windows_office_product_spawned_control.yml
index 87e863b3269..36dd908d931 100644
--- a/detections/endpoint/windows_office_product_spawned_control.yml
+++ b/detections/endpoint/windows_office_product_spawned_control.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_office_products_parent` Processes.process_name=control.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_office_product_spawned_control_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*EQNEDT32.exe", "*excel.exe", "*Graph.exe", "*msaccess.exe", "*mspub.exe", "*onenote.exe", "*onenoteim.exe", "*onenotem.exe", "*outlook.exe", "*powerpnt.exe", "*visio.exe", "*winproj.exe", "*winword.exe") Processes.process_name="*control.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_spawned_control_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Limited false positives should be present.
 references:
@@ -43,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ clicking a suspicious attachment.
     entity:
diff --git a/detections/endpoint/windows_office_product_spawned_msdt.yml b/detections/endpoint/windows_office_product_spawned_msdt.yml
index 19f5c06dd58..a54abc68246 100644
--- a/detections/endpoint/windows_office_product_spawned_msdt.yml
+++ b/detections/endpoint/windows_office_product_spawned_msdt.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_office_products_parent` Processes.process_name=msdt.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_office_product_spawned_msdt_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*EQNEDT32.exe", "*excel.exe", "*Graph.exe", "*msaccess.exe", "*mspub.exe", "*onenote.exe", "*onenoteim.exe", "*onenotem.exe", "*outlook.exe", "*powerpnt.exe", "*visio.exe", "*winproj.exe", "*winword.exe") Processes.process_name="*msdt.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_spawned_msdt_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited, however filter as needed.
 references:
@@ -43,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Office process $parent_process_name$ has spawned a child process $process_name$ on host $dest$.
     entity:
diff --git a/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml
index 2750a2f5a2d..10cdaad6d3f 100644
--- a/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml
+++ b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_office_products_parent` `process_rundll32` (Processes.process!=*.dll*)
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_office_product_spawned_rundll32_with_no_dll_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*EQNEDT32.exe", "*excel.exe", "*Graph.exe", "*msaccess.exe", "*mspub.exe", "*onenote.exe", "*onenoteim.exe", "*onenotem.exe", "*outlook.exe", "*powerpnt.exe", "*visio.exe", "*winproj.exe", "*winword.exe") Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" NOT Processes.process="*.dll*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_spawned_rundll32_with_no_dll_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited, but if any are present, filter as needed.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Office process $parent_process_name$ observed executing a suspicious child process $process_name$ with process id $process_id$ and no dll commandline $process$ on host $dest$
     entity:
diff --git a/detections/endpoint/windows_office_product_spawned_uncommon_process.yml b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml
index d3fd032734c..76e89658344 100644
--- a/detections/endpoint/windows_office_product_spawned_uncommon_process.yml
+++ b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml
@@ -12,48 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    `process_office_products_parent`
-    AND
-    (
-      Processes.process_name IN (
-        bitsadmin.exe,
-        certutil.exe,
-        cmd.exe,
-        cscript.exe,
-        mshta.exe,
-        powershell.exe,
-        pwsh.exe,
-        regsvr32.exe,
-        rundll32.exe,
-        wmic.exe,
-        wscript.exe
-      )
-      OR
-      Processes.original_file_name IN (
-        bitsadmin.exe,
-        CertUtil.exe,
-        Cmd.Exe,
-        cscript.exe,
-        MSHTA.EXE,
-        PowerShell.EXE,
-        pwsh.dll,
-        REGSVR32.EXE,
-        RUNDLL32.EXE,
-        wmic.exe,
-        wscript.exe
-      )
-    )
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
-       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
-       Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_office_product_spawned_uncommon_process_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*EQNEDT32.exe", "*excel.exe", "*Graph.exe", "*msaccess.exe", "*mspub.exe", "*onenote.exe", "*onenoteim.exe", "*onenotem.exe", "*outlook.exe", "*powerpnt.exe", "*visio.exe", "*winproj.exe", "*winword.exe") Processes.process_name IN ("*bitsadmin.exe", "*certutil.exe", "*cmd.exe", "*cscript.exe", "*mshta.exe", "*powershell.exe", "*pwsh.exe", "*regsvr32.exe", "*rundll32.exe", "*wmic.exe", "*wscript.exe") OR Processes.original_file_name IN ("bitsadmin.exe", "CertUtil.exe", "Cmd.Exe", "cscript.exe", "MSHTA.EXE", "PowerShell.EXE", "pwsh.dll", "REGSVR32.EXE", "RUNDLL32.EXE", "wmic.exe", "wscript.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_spawned_uncommon_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited, however filter as needed.
 references:
@@ -80,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: User $user$ on $dest$ spawned Windows Script Host from Winword.exe
     entity:
diff --git a/detections/endpoint/windows_onedrive_share_mounted_via_net.yml b/detections/endpoint/windows_onedrive_share_mounted_via_net.yml
index 8db97428fea..83b030a6fc6 100644
--- a/detections/endpoint/windows_onedrive_share_mounted_via_net.yml
+++ b/detections/endpoint/windows_onedrive_share_mounted_via_net.yml
@@ -6,38 +6,20 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the use of net.exe or net1.exe to mount a OneDrive share as a network drive.
+description: 'The following analytic detects the use of net.exe or net1.exe to mount a OneDrive share as a network drive.
+
     This behavior may indicate an attempt to stage, access, or exfiltrate data through a cloud-hosted WebDAV path rather than a traditional file share.
-    If confirmed malicious, an attacker could use the mounted share to move data outside the environment over trusted cloud infrastructure.
+
+    If confirmed malicious, an attacker could use the mounted share to move data outside the environment over trusted cloud infrastructure.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    `process_net`
-    Processes.process="*use*"
-    Processes.process="*https://d.docs.live.net*"
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_onedrive_share_mounted_via_net_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*net1.exe" OR Processes.original_file_name="net1.exe" Processes.process="*use*" Processes.process="*https://d.docs.live.net*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_onedrive_share_mounted_via_net_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate users may mount OneDrive shares for synchronized access or backup purposes. Monitor for unauthorized or unusual mounting activity to reduce false alerts.
+references: []
 drilldown_searches:
     - earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
@@ -46,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_outlook_dialogs_disabled_from_unusual_process.yml b/detections/endpoint/windows_outlook_dialogs_disabled_from_unusual_process.yml
index 1d61f448334..e31b24aa243 100644
--- a/detections/endpoint/windows_outlook_dialogs_disabled_from_unusual_process.yml
+++ b/detections/endpoint/windows_outlook_dialogs_disabled_from_unusual_process.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the modification of the Windows Registry key "PONT_STRING" under Outlook Options. This disables certain dialog popups, which could allow malicious scripts to run without notice. This detection leverages data from the Endpoint.Registry datamodel to search for this key changing from an unusual process. This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path="*\\Outlook\\Options\\General*" Registry.registry_value_name="PONT_STRING" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes WHERE NOT (Processes.process_name = "Outlook.exe") by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`] | fields _time parent_process_name parent_process process_name process_path process process_guid registry_path registry_value_name registry_value_data registry_key_name action dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_outlook_dialogs_disabled_from_unusual_process_filter`'
+search: |
+    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path="*\\Outlook\\Options\\General*" Registry.registry_value_name="PONT_STRING" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes WHERE NOT (Processes.process_name = "Outlook.exe") by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`] | fields _time parent_process_name parent_process process_name process_path process process_guid registry_path registry_value_name registry_value_data registry_key_name action dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_outlook_dialogs_disabled_from_unusual_process_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: It is unusual for processes other than Outlook to modify this feature on a Windows system since it is a default Outlook functionality. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Outlook Dialog registry key modified on $dest$ by unusual process
     entity:
diff --git a/detections/endpoint/windows_outlook_loadmacroprovideronboot_persistence.yml b/detections/endpoint/windows_outlook_loadmacroprovideronboot_persistence.yml
index e64d845fd64..643844b129d 100644
--- a/detections/endpoint/windows_outlook_loadmacroprovideronboot_persistence.yml
+++ b/detections/endpoint/windows_outlook_loadmacroprovideronboot_persistence.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the modification of the Windows Registry key "LoadMacroProviderOnBoot" under Outlook. This enables automatic loading of macros, which could allow malicious scripts to run without notice. This detection leverages data from the Endpoint.Registry datamodel to search for this key being enabled. This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path="*\\Outlook\\*" Registry.registry_value_name="LoadMacroProviderOnBoot" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_outlook_loadmacroprovideronboot_persistence_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Outlook\\*" Registry.registry_value_name="*LoadMacroProviderOnBoot" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_outlook_loadmacroprovideronboot_persistence_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: It is unusual to modify this feature on a Windows system. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Outlook LoadMacroProviderOnBoot registry key modified on $dest$
     entity:
diff --git a/detections/endpoint/windows_outlook_macro_created_by_suspicious_process.yml b/detections/endpoint/windows_outlook_macro_created_by_suspicious_process.yml
index b1d9f709b13..7733f0e4624 100644
--- a/detections/endpoint/windows_outlook_macro_created_by_suspicious_process.yml
+++ b/detections/endpoint/windows_outlook_macro_created_by_suspicious_process.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation of an Outlook Macro (VbaProject.OTM) by a suspicious process. This file is normally created when you create a macro from within Outlook. If this file is created by a process other than Outlook.exe it may be maliciously created. This detection leverages data from the Filesystem datamodel, specifically looking for the file creation event for VbaProject.OTM. This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
 data_source:
     - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.file_create_time) as file_create_time from datamodel=Endpoint.Filesystem where Filesystem.file_path="*Appdata\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_outlook_macro_created_by_suspicious_process_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*Appdata\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_outlook_macro_created_by_suspicious_process_filter`
 how_to_implement: You must be ingesting data that records file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
 known_false_positives: Because this file are always created by Outlook in normal operations, you should investigate all results.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious Outlook macro $file_name$ created on $dest$
     entity:
diff --git a/detections/endpoint/windows_outlook_macro_security_modified.yml b/detections/endpoint/windows_outlook_macro_security_modified.yml
index 47ccc31d467..9a60812976e 100644
--- a/detections/endpoint/windows_outlook_macro_security_modified.yml
+++ b/detections/endpoint/windows_outlook_macro_security_modified.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the modification of the Windows Registry key "Level" under Outlook Security. This allows macros to execute without warning, which could allow malicious scripts to run without notice. This detection leverages data from the Endpoint.Registry datamodel, specifically looking for the registry value name "Level" with a value of "0x00000001". This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path="*\\Outlook\\Security*" Registry.registry_value_name="Level" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_outlook_macro_security_modified_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Outlook\\Security*" Registry.registry_value_name="*Level" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_outlook_macro_security_modified_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: It is unusual to modify this feature on a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Outlook Macro Security Level registry modified on $dest$
     entity:
diff --git a/detections/endpoint/windows_outlook_webview_registry_modification.yml b/detections/endpoint/windows_outlook_webview_registry_modification.yml
index 775ca988648..a18f72a3504 100644
--- a/detections/endpoint/windows_outlook_webview_registry_modification.yml
+++ b/detections/endpoint/windows_outlook_webview_registry_modification.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic identifies modifications to specific Outlook registry values related to WebView and Today features. It detects when a URL is set in these registry locations, which could indicate attempts to manipulate Outlook's web-based components. The analytic focuses on changes to the "URL" value within Outlook's WebView and Today registry paths. This activity is significant as it may represent an attacker's effort to redirect Outlook's web content or inject malicious URLs. If successful, this technique could lead to phishing attempts, data theft, or serve as a stepping stone for further compromise of the user's email client and potentially sensitive information.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count values(Registry.registry_value_name) as registry_value_name values(Registry.registry_value_data) as registry_value_data min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path="*\\Software\\Microsoft\\Office\\*\\Outlook\\WebView\\*" OR Registry.registry_path="*\\Software\\Microsoft\\Office\\*\\Outlook\\Today") AND Registry.registry_value_name="URL" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_outlook_webview_registry_modification_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Software\\Microsoft\\Office\*\\Outlook\\WebView\\*", "\\Software\\Microsoft\\Office\*\\Outlook\\Today") Registry.registry_value_name="*URL" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_outlook_webview_registry_modification_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may occur if legitimate Outlook processes are modified.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_papercut_ng_spawn_shell.yml b/detections/endpoint/windows_papercut_ng_spawn_shell.yml
index 25a3009bb13..beea3a3dacb 100644
--- a/detections/endpoint/windows_papercut_ng_spawn_shell.yml
+++ b/detections/endpoint/windows_papercut_ng_spawn_shell.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=pc-app.exe `process_cmd`
-        OR
-        `process_powershell`
-        OR
-        Processes.process_name=java.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_papercut_ng_spawn_shell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.parent_process_name="*pc-app.exe" Processes.process_name="*cmd.exe" OR Processes.original_file_name="Cmd.Exe") OR Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe", "*java.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_papercut_ng_spawn_shell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present, but most likely not. Filter as needed.
 references:
@@ -42,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The PaperCut NG application has spawned a shell $process_name$ on endpoint $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml b/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml
index d12ab3f3c17..60bedc5884d 100644
--- a/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml
+++ b/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*explorer.exe*" Processes.process="*/root,*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_parent_pid_spoofing_with_explorer_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*explorer.exe*" Processes.process="*/root,*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_parent_pid_spoofing_with_explorer_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An explorer.exe process with process commandline $process$ on dest $dest$
     entity:
diff --git a/detections/endpoint/windows_password_managers_discovery.yml b/detections/endpoint/windows_password_managers_discovery.yml
index 7ad0eb58cc6..2205505df3f 100644
--- a/detections/endpoint/windows_password_managers_discovery.yml
+++ b/detections/endpoint/windows_password_managers_discovery.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process = "*dir *"
-        OR
-        Processes.process = "*findstr*"
-        AND
-        Processes.process IN ( "*.kdbx*", "*credential*", "*key3.db*","*pass*", "*cred*", "*key4.db*", "*accessTokens*", "*access_tokens*", "*.htpasswd*", "*Ntds.dit*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_password_managers_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*findstr*" Processes.process IN ("*dir *", "*.kdbx*", "*credential*", "*key3.db*", "*pass*", "*cred*", "*key4.db*", "*accessTokens*", "*access_tokens*", "*.htpasswd*", "*Ntds.dit*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_password_managers_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -43,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_password_policy_discovery_with_net.yml b/detections/endpoint/windows_password_policy_discovery_with_net.yml
index d0dde0ca55e..56415b316bb 100644
--- a/detections/endpoint/windows_password_policy_discovery_with_net.yml
+++ b/detections/endpoint/windows_password_policy_discovery_with_net.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_net`
-        AND
-        Processes.process = "*accounts*"
-        AND
-        NOT Processes.process IN ("*/FORCELOGOFF*", "*/MINPWLEN*", "*/MAXPWAGE*", "*/MINPWAGE*", "*/UNIQUEPW*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_password_policy_discovery_with_net_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*net1.exe" OR Processes.original_file_name="net1.exe" Processes.process="*accounts*" NOT (Processes.process IN ("*/FORCELOGOFF*", "*/MINPWLEN*", "*/MAXPWAGE*", "*/MINPWAGE*", "*/UNIQUEPW*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_password_policy_discovery_with_net_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/windows_phantom_dll_created_on_disk.yml b/detections/endpoint/windows_phantom_dll_created_on_disk.yml
index d953b9f1e62..fa1fabf0b5f 100644
--- a/detections/endpoint/windows_phantom_dll_created_on_disk.yml
+++ b/detections/endpoint/windows_phantom_dll_created_on_disk.yml
@@ -6,51 +6,25 @@ modification_date: '2026-08-20'
 author: Onur Mustafa Erdogan, Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects creation of DLL files with names associated with phantom DLL hijacking opportunities.
+description: 'The following analytic detects creation of DLL files with names associated with phantom DLL hijacking opportunities.
+
     These DLLs are usually absent from standard Windows installations, but legitimate Windows components or services may attempt to load them when they are present in expected search paths such as System32.
+
     Phantom DLL hijacking involves placing a malicious DLL where a legitimate process will search for a non-existent dependency, allowing the attacker-controlled library to execute in that process context.
+
     ShieldBreak is one example where the exploit redirects a privileged Defender-driven write into C:\Windows\System32\phoneinfo.dll and then triggers Windows Error Reporting so wermgr.exe loads the planted DLL at SYSTEM integrity.
-    If confirmed malicious, this activity can indicate preparation for code execution, persistence, or local privilege escalation through DLL search order hijacking.
+
+    If confirmed malicious, this activity can indicate preparation for code execution, persistence, or local privilege escalation through DLL search order hijacking.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.action IN ("created","modified")
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*:\\Windows\\System32\\axeonoffhelper.dll", "*:\\Windows\\System32\\cdpsgshims.dll", "*:\\Windows\\System32\\oci.dll", "*:\\Windows\\System32\\offdmpsvc.dll", "*:\\Windows\\System32\\shellchromeapi.dll", "*:\\Windows\\System32\\TSMSISrv.dll", "*:\\Windows\\System32\\TSVIPSrv.dll", "*:\\Windows\\System32\\wbem\\wbemcomn.dll", "*:\\Windows\\System32\\WLBSCTRL.dll", "*:\\Windows\\System32\\wow64log.dll", "*:\\Windows\\System32\\WptsExtensions.dll", "*\\phoneinfo.dll", "*\\SprintCSP.dll") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_phantom_dll_created_on_disk_filter`
+how_to_implement: 'To successfully implement this search, you need file creation telemetry from Windows endpoints mapped into the Endpoint.Filesystem datamodel.
 
-    Filesystem.file_path IN (
-        "*:\\Windows\\System32\\axeonoffhelper.dll",
-        "*:\\Windows\\System32\\cdpsgshims.dll",
-        "*:\\Windows\\System32\\oci.dll",
-        "*:\\Windows\\System32\\offdmpsvc.dll",
-        "*:\\Windows\\System32\\shellchromeapi.dll",
-        "*:\\Windows\\System32\\TSMSISrv.dll",
-        "*:\\Windows\\System32\\TSVIPSrv.dll",
-        "*:\\Windows\\System32\\wbem\\wbemcomn.dll",
-        "*:\\Windows\\System32\\WLBSCTRL.dll",
-        "*:\\Windows\\System32\\wow64log.dll",
-        "*:\\Windows\\System32\\WptsExtensions.dll",
-        "*\\phoneinfo.dll",
-        "*\\SprintCSP.dll"
-    )
-    by Filesystem.action Filesystem.dest Filesystem.file_hash
-       Filesystem.file_name Filesystem.file_path Filesystem.process_id
-       Filesystem.user Filesystem.vendor_product
+    If you are using Sysmon, enable EventID 11 and ensure the FileCreate configuration captures the full target filename for DLL creations in Windows system paths.'
+known_false_positives: 'Some legacy or third-party components may create DLLs with these names for legitimate compatibility reasons, but creation in Windows system paths should be uncommon.
 
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_phantom_dll_created_on_disk_filter`
-how_to_implement: |-
-    To successfully implement this search, you need file creation telemetry from Windows endpoints mapped into the Endpoint.Filesystem datamodel.
-    If you are using Sysmon, enable EventID 11 and ensure the FileCreate configuration captures the full target filename for DLL creations in Windows system paths.
-known_false_positives: |-
-    Some legacy or third-party components may create DLLs with these names for legitimate compatibility reasons, but creation in Windows system paths should be uncommon.
-    Review the creating process, signer, file hash, path, and whether the DLL is expected on the host before tuning.
+    Review the creating process, signer, file hash, path, and whether the DLL is expected on the host before tuning.'
 references:
     - http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
     - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/
@@ -76,7 +50,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A phantom DLL candidate named [$file_name$] was created at [$file_path$] on [$dest$]
     entity:
diff --git a/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml b/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml
index 3651c3d96f2..56ad930f554 100644
--- a/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml
+++ b/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation of a DLL file by an outlook.exe process in the AppData\Local\Microsoft\FORMS directory. This detection leverages data from the Endpoint.Processes and Endpoint.Filesystem datamodels, focusing on process and file creation events. This activity is significant as it may indicate an attempt to exploit CVE-2024-21378, where a custom MAPI form loads a potentially malicious DLL. If confirmed malicious, this could allow an attacker to execute arbitrary code, leading to further system compromise or data exfiltration.
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | join process_guid, _time [ | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name ="*.dll" Filesystem.file_path = "*\\AppData\\Local\\Microsoft\\FORMS\\IPM*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` | fields file_name file_path process_name process_path process dest file_create_time _time process_guid] | `windows_phishing_outlook_drop_dll_in_form_dir_filter`'
+search: |
+    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | join process_guid, _time [ | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name ="*.dll" Filesystem.file_path = "*\\AppData\\Local\\Microsoft\\FORMS\\IPM*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` | fields file_name file_path process_name process_path process dest file_create_time _time process_guid] | `windows_phishing_outlook_drop_dll_in_form_dir_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: an outlook process dropped dll file into $file_path$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml b/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml
index 11a5273e5fc..e6b363d8618 100644
--- a/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml
+++ b/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name  IN ("AcroRd32.exe", "FoxitPDFReader.exe") Processes.process_name IN ("firefox.exe", "chrome.exe", "iexplore.exe")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_phishing_pdf_file_executes_url_link_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*AcroRd32.exe", "*FoxitPDFReader.exe") Processes.process_name IN ("*firefox.exe", "*chrome.exe", "*iexplore.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_phishing_pdf_file_executes_url_link_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives in PDF file opened PDF Viewer having legitimate URL link, however filter as needed.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
index 3f11a1adb43..c61e2bb7393 100644
--- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
+++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects the creation of registry artifacts when an ISO container is opened, clicked, or mounted on a Windows operating system. It leverages data from the Endpoint.Registry data model, specifically monitoring registry keys related to recent ISO or IMG file executions. This activity is significant as adversaries increasingly use container-based phishing campaigns to bypass macro-based document execution controls. If confirmed malicious, this behavior could indicate an initial access attempt, potentially leading to further exploitation, persistence, or data exfiltration within the environment.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.img*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_phishing_recent_iso_exec_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso*", "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.img*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_phishing_recent_iso_exec_registry_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives may be high depending on the environment and consistent use of ISOs. Restrict to servers, or filter out based on commonly used ISO names. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml
index c4dc611bb05..0250c532a94 100644
--- a/detections/endpoint/windows_possible_credential_dumping.yml
+++ b/detections/endpoint/windows_possible_credential_dumping.yml
@@ -6,12 +6,12 @@ modification_date: '2026-10-09'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects possible credential dumping by identifying suspicious process access to LSASS with credential-dumping-related call traces.
-    It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_LIMITED_INFORMATION (0x1000) and PROCESS_DUP_HANDLE (0x40).
+description: 'The following analytic detects possible credential dumping by identifying suspicious process access to LSASS with credential-dumping-related call traces.
+
+    It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_LIMITED_INFORMATION (0x1000) and PROCESS_DUP_HANDLE (0x40).'
 data_source:
     - Sysmon EventID 10
-search: |-
+search: |
     `sysmon`
     EventCode=10
     TargetImage=*\\lsass.exe
@@ -69,7 +69,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_id$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_post_exploitation_risk_behavior.yml b/detections/endpoint/windows_post_exploitation_risk_behavior.yml
index 13e7633a14e..1eb2f210be5 100644
--- a/detections/endpoint/windows_post_exploitation_risk_behavior.yml
+++ b/detections/endpoint/windows_post_exploitation_risk_behavior.yml
@@ -8,7 +8,7 @@ status: production
 type: Correlation
 description: The following analytic identifies four or more distinct post-exploitation behaviors on a Windows system. It leverages data from the Risk data model in Splunk Enterprise Security, focusing on multiple risk events and their associated MITRE ATT&CK tactics and techniques. This activity is significant as it indicates potential malicious actions following an initial compromise, such as persistence, privilege escalation, or data exfiltration. If confirmed malicious, this behavior could allow attackers to maintain control, escalate privileges, and further exploit the compromised environment, leading to significant security breaches and data loss.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
       WHERE All_Risk.analyticstories IN ("*Windows Post-Exploitation*")
       BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$risk_object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Post Exploitation Risk Behavior - $risk_object$
     entity:
diff --git a/detections/endpoint/windows_potato_privilege_escalation_tool_execution.yml b/detections/endpoint/windows_potato_privilege_escalation_tool_execution.yml
index 5b24b278d07..63eaa869d96 100644
--- a/detections/endpoint/windows_potato_privilege_escalation_tool_execution.yml
+++ b/detections/endpoint/windows_potato_privilege_escalation_tool_execution.yml
@@ -6,64 +6,19 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects execution of known Potato-family privilege escalation tools based on original file name, process name, or binary path.
+description: 'Detects execution of known Potato-family privilege escalation tools based on original file name, process name, or binary path.
+
     A tool class that has been a dominant post-compromise privilege escalation method for over a decade and remains actively used by ransomware operators, red teams, and nation-state actors alike.
+
     The Potato family exploits Windows token impersonation and privilege abuse to escalate from a service account, IIS worker process, or other restricted context to SYSTEM.
-    The core abuse chain across most variants involves tricking a SYSTEM-level process into authenticating to an attacker-controlled endpoint, capturing that authentication, and impersonating the resulting SYSTEM token to spawn an elevated process.
+
+    The core abuse chain across most variants involves tricking a SYSTEM-level process into authenticating to an attacker-controlled endpoint, capturing that authentication, and impersonating the resulting SYSTEM token to spawn an elevated process.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats summariesonly=false allow_old_summaries=true
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.original_file_name IN (
-        "*CertPotato*",
-        "*CoercedPotato*",
-        "*GenericPotato*",
-        "*GhostPotato*",
-        "*GodPotato*",
-        "*HotPotato*",
-        "*JuicyPotato*",
-        "*LocalPotato*",
-        "*LonelyPotato*",
-        "*RoguePotato*",
-        "*RottenPotato*",
-        "*SharpPotato*",
-        "*SweetPotato*"
-    )
-    OR Processes.process_path IN (
-        "*CertPotato*",
-        "*CoercedPotato*",
-        "*GenericPotato*",
-        "*GhostPotato*",
-        "*GodPotato*",
-        "*HotPotato*",
-        "*JuicyPotato*",
-        "*LocalPotato*",
-        "*LonelyPotato*",
-        "*RoguePotato*",
-        "*RottenPotato*",
-        "*SharpPotato*",
-        "*SweetPotato*"
-    )
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_potato_privilege_escalation_tool_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.original_file_name IN ("*CertPotato*", "*CoercedPotato*", "*GenericPotato*", "*GhostPotato*", "*GodPotato*", "*HotPotato*", "*JuicyPotato*", "*LocalPotato*", "*LonelyPotato*", "*RoguePotato*", "*RottenPotato*", "*SharpPotato*", "*SweetPotato*") OR Processes.process_path IN ("*CertPotato*", "*CoercedPotato*", "*GenericPotato*", "*GhostPotato*", "*GodPotato*", "*HotPotato*", "*JuicyPotato*", "*LocalPotato*", "*LonelyPotato*", "*RoguePotato*", "*RottenPotato*", "*SharpPotato*", "*SweetPotato*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_potato_privilege_escalation_tool_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate security tools or authorized pentesting software may use potato privilege escalation methods for testing purposes. Filter alerts based on approved security testing activities.
 references:
@@ -76,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential Potato Privilege Escalation Tools activity observed on $dest$ via $process$.
     entity:
diff --git a/detections/endpoint/windows_potential_appdomainmanager_hijack_artifacts_creation.yml b/detections/endpoint/windows_potential_appdomainmanager_hijack_artifacts_creation.yml
index aa5c007180b..ffebf2069e5 100644
--- a/detections/endpoint/windows_potential_appdomainmanager_hijack_artifacts_creation.yml
+++ b/detections/endpoint/windows_potential_appdomainmanager_hijack_artifacts_creation.yml
@@ -10,35 +10,7 @@ description: The following analytic detects the creation of an .exe file along w
 data_source:
     - Sysmon EventID 11
 search: |
-    | tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime from datamodel=Endpoint.Filesystem
-    where Filesystem.file_name IN ("*.exe", "*.exe.config", "*.dll") AND Filesystem.file_path IN
-      ("*\\windows\\fonts\\*", "*\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*","*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "*\\Windows\\repair\\*", "*\\PerfLogs\\*")
-    AND Filesystem.action = "created"
-    by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name("Filesystem")`
-    | stats values(file_name) AS file_name
-            values(file_path) AS file_path
-            values(user) AS user
-            min(firstTime) AS firstTime max(lastTime) AS lastTime
-            BY dest process_guid
-    | eval exe_present = if(mvcount(mvfilter(match(file_name, "\.exe$"))) > 0, 1, 0)
-    | eval config_present = if(mvcount(mvfilter(match(file_name, "\.exe\.config$"))) > 0, 1, 0)
-    | eval dll_present = if(mvcount(mvfilter(match(file_name, "\.dll$"))) > 0, 1, 0)
-
-    | eval exe_files = mvfilter(match(file_name, "\.exe$") AND NOT match(file_name, "\.exe\.config$"))
-    | eval config_files = mvfilter(match(file_name, "\.exe\.config$"))
-    | eval exe_base_names = mvmap(exe_files, replace(exe_files, "\.exe$", ""))
-    | eval config_base_names = mvmap(config_files, replace(config_files, "\.exe\.config$", ""))
-
-    | mvexpand exe_base_names
-    | mvexpand config_base_names
-
-    | eval file_count = mvcount(file_name)
-
-    | where file_count >= 3 AND exe_present = 1 AND config_present = 1 AND dll_present = 1 AND exe_base_names = config_base_names
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_potential_appdomainmanager_hijack_artifacts_creation_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe", "*.exe.config", "*.dll") Filesystem.file_path IN ("*\\windows\\fonts\\*", "*\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "*\\Windows\\repair\\*", "*\\PerfLogs\\*") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_potential_appdomainmanager_hijack_artifacts_creation_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: This detection may still produce false positives, so additional filtering is recommended. To validate potential alerts, verify that the executable’s original file name matches its current file name, and also review the associated .config file to confirm which DLLs are expected to load during execution. This helps distinguish legitimate activity from suspicious behavior.
 references:
@@ -55,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_potential_cloudflared_network_connection.yml b/detections/endpoint/windows_potential_cloudflared_network_connection.yml
index a5b8983947f..08d7e68de1c 100644
--- a/detections/endpoint/windows_potential_cloudflared_network_connection.yml
+++ b/detections/endpoint/windows_potential_cloudflared_network_connection.yml
@@ -6,13 +6,14 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Hunting
-description: |-
-    This analytic detects network connection events possibly associated with the Cloudflared tool, a tool used to create tunnels via Cloudflare.
+description: 'This analytic detects network connection events possibly associated with the Cloudflared tool, a tool used to create tunnels via Cloudflare.
+
     Cloudflared is functionally very similar to ngrok, an ingress-as-a-service tool.
-    It reaches out to the Cloudflare Edge Servers, creating an outbound connection over HTTPS(HTTP2/QUIC), where the tunnel's controller makes services or private networks accessible.
+
+    It reaches out to the Cloudflare Edge Servers, creating an outbound connection over HTTPS(HTTP2/QUIC), where the tunnel''s controller makes services or private networks accessible.'
 data_source:
     - Sysmon EventID 3
-search: |-
+search: |
     | tstats `security_content_summariesonly`
        count min(_time) as firstTime
              max(_time) as lastTime
diff --git a/detections/endpoint/windows_potential_cloudflared_tunnel_execution.yml b/detections/endpoint/windows_potential_cloudflared_tunnel_execution.yml
index 96bd708fb1d..b3e7748eeed 100644
--- a/detections/endpoint/windows_potential_cloudflared_tunnel_execution.yml
+++ b/detections/endpoint/windows_potential_cloudflared_tunnel_execution.yml
@@ -6,45 +6,17 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic detects command-line arguments associated with the cloudflared client used to create Cloudflare tunnels.
+description: 'This analytic detects command-line arguments associated with the cloudflared client used to create Cloudflare tunnels.
+
     Cloudflared is functionally very similar to ngrok, an ingress-as-a-service tool.
-    Cloudflared reaches out to the Cloudflare Edge Servers, creating an outbound connection over HTTPS(HTTP2/QUIC), where the tunnel's controller makes services or private networks accessible.
+
+    Cloudflared reaches out to the Cloudflare Edge Servers, creating an outbound connection over HTTPS(HTTP2/QUIC), where the tunnel''s controller makes services or private networks accessible.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process="*tunnel*"
-    (
-        (
-            Processes.process="*run*"
-            Processes.process="*token*"
-        )
-        OR
-        (
-            Processes.process="*--url*"
-            Processes.process="*localhost*"
-        )
-    )
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_potential_cloudflared_tunnel_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*tunnel*" (Processes.process="*run*" Processes.process="*token*") OR (Processes.process="*--url*" Processes.process="*localhost*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_potential_cloudflared_tunnel_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate use cases include authorized DevOps or IT teams using Cloudflared for secure remote access and network management. Filter alerts based on approved usage and trusted users.
 references:
@@ -59,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_potential_web_shell_creation_for_vmware_workspace_one.yml b/detections/endpoint/windows_potential_web_shell_creation_for_vmware_workspace_one.yml
index fd2656c3774..be2142173a6 100644
--- a/detections/endpoint/windows_potential_web_shell_creation_for_vmware_workspace_one.yml
+++ b/detections/endpoint/windows_potential_web_shell_creation_for_vmware_workspace_one.yml
@@ -6,31 +6,11 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic looks for evidence of web shells being created in the VMware Workspace ONE path on Windows or Linux systems, which has been actively exploited by attackers via CVE-2022-22954.
+description: This analytic looks for evidence of web shells being created in the VMware Workspace ONE path on Windows or Linux systems, which has been actively exploited by attackers via CVE-2022-22954.
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.file_path IN (
-        "*/vmware/horizon/workspace/webapps/*",
-        "*\\vmware\\horizon\\workspace\\webapps\\*"
-    )
-    Filesystem.file_path="*.jsp"
-
-    by Filesystem.dest Filesystem.file_create_time Filesystem.process_path
-       Filesystem.process_guid Filesystem.process_id Filesystem.file_path Filesystem.file_name
-       Filesystem.user Filesystem.vendor_product Filesystem.action
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_potential_web_shell_creation_for_vmware_workspace_one_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/vmware/horizon/workspace/webapps/*", "*\\vmware\\horizon\\workspace\\webapps\\*") Filesystem.file_name="*.jsp" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_potential_web_shell_creation_for_vmware_workspace_one_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate software updates or administrative scripts may create files in the VMware Workspace ONE path, triggering alerts. Review and allow trusted processes to reduce false positives.
 references:
@@ -43,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_powershell_add_module_to_global_assembly_cache.yml b/detections/endpoint/windows_powershell_add_module_to_global_assembly_cache.yml
index 4d3dee5e790..505e5828b1a 100644
--- a/detections/endpoint/windows_powershell_add_module_to_global_assembly_cache.yml
+++ b/detections/endpoint/windows_powershell_add_module_to_global_assembly_cache.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the addition of a DLL to the Windows Global Assembly Cache (GAC) using PowerShell. It leverages PowerShell Script Block Logging to identify commands containing "system.enterpriseservices.internal.publish". This activity is significant because adding a DLL to the GAC allows it to be shared across multiple applications, potentially enabling an adversary to execute malicious code system-wide. If confirmed malicious, this could lead to widespread code execution, privilege escalation, and persistent access across the operating system, posing a severe security risk.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText IN("*system.enterpriseservices.internal.publish*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powershell_add_module_to_global_assembly_cache_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*system.enterpriseservices.internal.publish*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_add_module_to_global_assembly_cache_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: False positives may be present based on developers or third party utilities adding items to the GAC.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: PowerShell was used to install a module to the Global Assembly Cache on $dest$.
     entity:
diff --git a/detections/endpoint/windows_powershell_commands_from_dns_txt.yml b/detections/endpoint/windows_powershell_commands_from_dns_txt.yml
index 7db563b9a0f..dd157106b1b 100644
--- a/detections/endpoint/windows_powershell_commands_from_dns_txt.yml
+++ b/detections/endpoint/windows_powershell_commands_from_dns_txt.yml
@@ -6,39 +6,24 @@ modification_date: '2026-07-30'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects execution of powershell commands retrieved from a remote DNS TXT query response.
+description: 'The following analytic detects execution of powershell commands retrieved from a remote DNS TXT query response.
+
     The use of the DNS TXT record for C2 is an uncommon method for malware that is resilient due to the need for DNS in normal networking
+
     activities.
-    This can ensure that their C2 is not blocked by any firewalls.
+
+    This can ensure that their C2 is not blocked by any firewalls.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventCode=4104
-    ScriptBlockText IN ("*resolve-dnsname *", "*nslookup *", "*dig *")
-    ScriptBlockText IN ("*-Type TXT*", "*type=txt*", "* TXT*")
-    ScriptBlockText IN ("*. (*", "*IEX*")
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*resolve-dnsname *", "*nslookup *", "*dig *") Processes.process IN ("*-Type TXT*", "*type=txt*", "* TXT*") Processes.process IN ("*. (*", "*IEX*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_commands_from_dns_txt_filter`
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions are available at https://docs.splunk.com/Documentation/ES/latest/Admin/Configurepowershelllogging.
+known_false_positives: 'While false positives should be unlikely given the uncommon combination of PowerShell execution and DNS TXT query responses.
 
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-
-    by dest signature signature_id
-       user_id vendor_product EventID
-       Guid Opcode Name
-       Path ProcessID ScriptBlockId
-       ScriptBlockText
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_powershell_commands_from_dns_txt_filter`
-how_to_implement: |-
-    To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions are available at https://docs.splunk.com/Documentation/ES/latest/Admin/Configurepowershelllogging.
-known_false_positives: |-
-    While false positives should be unlikely given the uncommon combination of PowerShell execution and DNS TXT query responses.
     Due to the nature of Script Block Logging, it is possible that legitimate strings or unrelated commands might all match at once.
-    Apply appropriate exclusions for those edge cases.
+
+    Apply appropriate exclusions for those edge cases.'
+references: []
 drilldown_searches:
     - name: View the detection results for - "$user_id$" and "$dest$"
       search: '%original_detection_search% | search  user_id = "$user_id$" dest = "$dest$"'
@@ -47,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user_id$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_powershell_cryptography_namespace.yml b/detections/endpoint/windows_powershell_cryptography_namespace.yml
index e517ba8e775..deb8fa110ef 100644
--- a/detections/endpoint/windows_powershell_cryptography_namespace.yml
+++ b/detections/endpoint/windows_powershell_cryptography_namespace.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious PowerShell script execution involving the cryptography namespace via EventCode 4104. It leverages PowerShell Script Block Logging to identify scripts using cryptographic functions, excluding common hashes like SHA and MD5. This activity is significant as it is often associated with malware that decrypts or decodes additional malicious payloads. If confirmed malicious, this could allow an attacker to execute further code, escalate privileges, or establish persistence within the environment. Analysts should investigate the parent process, decrypted data, network connections, and the user executing the script.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*System.Security.Cryptography*" AND NOT(ScriptBlockText IN ("*SHA*", "*MD5*", "*DeriveBytes*"))
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powershell_cryptography_namespace_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*System.Security.Cryptography*" NOT (Processes.process IN ("*SHA*", "*MD5*", "*DeriveBytes*")) by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_cryptography_namespace_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: False positives should be limited. Filter as needed.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_powershell_disable_http_logging.yml b/detections/endpoint/windows_powershell_disable_http_logging.yml
index 47ae84c3fc3..cfcc8107fa4 100644
--- a/detections/endpoint/windows_powershell_disable_http_logging.yml
+++ b/detections/endpoint/windows_powershell_disable_http_logging.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the use of `get-WebConfigurationProperty` and `Set-ItemProperty` commands in PowerShell to disable HTTP logging on Windows systems. This detection leverages PowerShell Script Block Logging, specifically looking for script blocks that reference HTTP logging properties and attempt to set them to "false" or "dontLog". Disabling HTTP logging is significant as it can be used by adversaries to cover their tracks and delete logs, hindering forensic investigations. If confirmed malicious, this activity could allow attackers to evade detection and persist in the environment undetected.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText IN("*get-WebConfigurationProperty*","*Set-ItemProperty*") AND ScriptBlockText IN ("*httpLogging*","*Logfile.enabled*") AND ScriptBlockText IN ("*dontLog*", "*false*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powershell_disable_http_logging_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*get-WebConfigurationProperty*", "*Set-ItemProperty*") Processes.process IN ("*httpLogging*", "*Logfile.enabled*") Processes.process IN ("*dontLog*", "*false*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_disable_http_logging_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: It is possible administrators or scripts may run these commands, filtering may be required.
 references:
@@ -37,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A PowerShell Cmdlet related to disable or modifying a IIS HTTP logging has occurred on $dest$.
     entity:
diff --git a/detections/endpoint/windows_powershell_export_certificate.yml b/detections/endpoint/windows_powershell_export_certificate.yml
index 11d6e2368d3..b3628682026 100644
--- a/detections/endpoint/windows_powershell_export_certificate.yml
+++ b/detections/endpoint/windows_powershell_export_certificate.yml
@@ -9,19 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of the PowerShell Cmdlet `export-certificate` by leveraging Script Block Logging. This activity is significant as it may indicate an adversary attempting to exfiltrate certificates from the local Certificate Store on a Windows endpoint. Monitoring this behavior is crucial because stolen certificates can be used to impersonate users, decrypt sensitive data, or facilitate further attacks. If confirmed malicious, this activity could lead to unauthorized access to encrypted communications and sensitive information, posing a severe security risk.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText IN ("*export-certificate*")
-      | rename Computer as dest
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powershell_export_certificate_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*export-certificate*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_export_certificate_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: It is possible administrators or scripts may run these commands, filtering may be required.
 references:
@@ -36,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_powershell_export_pfxcertificate.yml b/detections/endpoint/windows_powershell_export_pfxcertificate.yml
index d497c1abb9e..13849415382 100644
--- a/detections/endpoint/windows_powershell_export_pfxcertificate.yml
+++ b/detections/endpoint/windows_powershell_export_pfxcertificate.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of the PowerShell cmdlet `export-pfxcertificate` by leveraging Script Block Logging. This activity is significant as it may indicate an adversary attempting to exfiltrate certificates from the Windows Certificate Store. Monitoring this behavior is crucial for identifying potential certificate theft, which can lead to unauthorized access and impersonation attacks. If confirmed malicious, this activity could allow attackers to compromise secure communications, authenticate as legitimate users, and escalate their privileges within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText IN ("*export-pfxcertificate*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powershell_export_pfxcertificate_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*export-pfxcertificate*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_export_pfxcertificate_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: It is possible administrators or scripts may run these commands, filtering may be required.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_powershell_fakecaptcha_clipboard_execution.yml b/detections/endpoint/windows_powershell_fakecaptcha_clipboard_execution.yml
index c6b1440c9b3..265cce522e3 100644
--- a/detections/endpoint/windows_powershell_fakecaptcha_clipboard_execution.yml
+++ b/detections/endpoint/windows_powershell_fakecaptcha_clipboard_execution.yml
@@ -6,45 +6,14 @@ modification_date: '2026-07-14'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    This detection identifies potential FakeCAPTCHA/ClickFix clipboard hijacking campaigns by looking for PowerShell execution with hidden window parameters and distinctive strings related to fake CAPTCHA verification. These campaigns use social engineering to trick users into pasting malicious PowerShell commands from their clipboard, typically delivering information stealers or remote access trojans.
+description: This detection identifies potential FakeCAPTCHA/ClickFix clipboard hijacking campaigns by looking for PowerShell execution with hidden window parameters and distinctive strings related to fake CAPTCHA verification. These campaigns use social engineering to trick users into pasting malicious PowerShell commands from their clipboard, typically delivering information stealers or remote access trojans.
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
     - Cisco Network Visibility Module Flow Data
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_powershell`
-        AND
-        Processes.process="*-w*h*"
-        AND
-        ( (Processes.process IN ("*robot*", "*captcha*", "*verify*", "*security check*", "*complete verification*"))
-        OR
-        ( (Processes.process IN ("*iwr *", "*Invoke-WebRequest*", "*wget *", "*curl *", "*Net.WebClient*", "*DownloadString*", "*[Convert]::FromBase64String*"))
-        AND
-        (Processes.process IN ("*iex*", "*Invoke-Expression*"))
-        AND
-        (Processes.process IN ("*click*", "*verify*", "*check*", "*human*", "*bot*", "*token*", "*challenge*")) )
-        OR
-        ( Processes.process="*clipboard*"
-        AND
-        Processes.process="*iex*"
-        AND
-        (Processes.process="*FromBase64String*"
-        OR
-        Processes.process="*decode*") ) )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_powershell_fakecaptcha_clipboard_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") Processes.process="*-w*h*" (Processes.process IN ("*iwr *", "*Invoke-WebRequest*", "*wget *", "*curl *", "*Net.WebClient*", "*DownloadString*", "*[Convert]::FromBase64String*") Processes.process IN ("*iex*", "*Invoke-Expression*") Processes.process IN ("*click*", "*verify*", "*check*", "*human*", "*bot*", "*token*", "*challenge*")) OR (Processes.process="*clipboard*" Processes.process="*iex*" Processes.process IN ("*FromBase64String*", "*decode*")) OR Processes.process IN ("*robot*", "*captcha*", "*verify*", "*security check*", "*complete verification*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_fakecaptcha_clipboard_execution_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, process path, and command-line executions from your endpoints. If you are using Sysmon, you must have at least Sysmon version 6.0.4 with EventID 1 configured. The full command line arguments are necessary for proper detection.
 known_false_positives: Legitimate PowerShell commands that use hidden windows for automation tasks may trigger this detection. The search specifically looks for patterns typical of FakeCAPTCHA campaigns. You may need to add additional exclusions for legitimate administrative activities in your environment by modifying the filter macro.
 references:
@@ -61,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A potential FakeCAPTCHA/ClickFix campaign execution was detected on $dest$ running a PowerShell command with hidden window and suspicious verification strings typical of social engineering attacks.
     entity:
diff --git a/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml b/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml
index e023cb7ee97..ff4066c7c1e 100644
--- a/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml
+++ b/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of the Get-CimInstance cmdlet with the -ComputerName parameter, indicating an attempt to retrieve information from a remote computer. It leverages PowerShell Script Block Logging to identify this specific command execution. This activity is significant as it may indicate unauthorized remote access or information gathering by an attacker. If confirmed malicious, this could allow the attacker to collect sensitive data from remote systems, potentially leading to further exploitation or lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText="*get-ciminstance*" AND ScriptBlockText="*computername*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powershell_get_ciminstance_remote_computer_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*get-ciminstance*" Processes.process="*computername*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_get_ciminstance_remote_computer_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: This is meant to be a low risk RBA anomaly analytic or to be used for hunting. Enable this with a low risk score and let it generate risk in the risk index.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_powershell_history_file_deletion.yml b/detections/endpoint/windows_powershell_history_file_deletion.yml
index 508e7722f7f..09620f601ba 100644
--- a/detections/endpoint/windows_powershell_history_file_deletion.yml
+++ b/detections/endpoint/windows_powershell_history_file_deletion.yml
@@ -9,17 +9,8 @@ type: Anomaly
 description: The following analytic detects the usage of PowerShell to delete its command history file, which may indicate an attempt to evade detection by removing evidence of executed commands. PowerShell stores command history in ConsoleHost_history.txt under the user’s profile directory. Adversaries or malicious scripts may delete this file using Remove-Item, del, or similar commands. This detection focuses on file deletion events targeting the history file, correlating them with recent PowerShell activity. While legitimate users may occasionally clear history, frequent or automated deletions should be investigated for potential defense evasion or post-exploitation cleanup activities.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*Remove-Item*" ScriptBlockText = "*.HistorySavePath"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product Guid
-           Opcode Name Path
-           ProcessID ScriptBlockId ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powershell_history_file_deletion_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Remove-Item*" Processes.process="*.HistorySavePath" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_history_file_deletion_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: administrators may execute this command that may cause some false positive.
 references:
@@ -32,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml
index e81a5f975ef..6f9643e3d5f 100644
--- a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml
+++ b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the usage of PowerShell Cmdlets - New-WebGlobalModule, Enable-WebGlobalModule, and Set-WebGlobalModule, which are used to create, enable, or modify IIS Modules. This detection leverages PowerShell Script Block Logging, specifically monitoring EventCode 4104 for these cmdlets. This activity is significant as adversaries may use these lesser-known cmdlets to manipulate IIS configurations, similar to AppCmd.exe, potentially bypassing traditional defenses. If confirmed malicious, this could allow attackers to persist in the environment, manipulate web server behavior, or escalate privileges.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText IN("*New-WebGlobalModule*","*Enable-WebGlobalModule*","*Set-WebGlobalModule*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powershell_iis_components_webglobalmodule_usage_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*New-WebGlobalModule*", "*Enable-WebGlobalModule*", "*Set-WebGlobalModule*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_iis_components_webglobalmodule_usage_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: It is possible administrators or scripts may run these commands, filtering may be required.
 references:
@@ -39,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_powershell_import_applocker_policy.yml b/detections/endpoint/windows_powershell_import_applocker_policy.yml
index 603a840dc13..2ea8ae79e13 100644
--- a/detections/endpoint/windows_powershell_import_applocker_policy.yml
+++ b/detections/endpoint/windows_powershell_import_applocker_policy.yml
@@ -6,30 +6,17 @@ modification_date: '2026-06-29'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the import of Windows PowerShell Applocker cmdlets, specifically identifying the use of "Import-Module Applocker" and "Set-AppLockerPolicy" with an XML policy.
+description: 'The following analytic detects the import of Windows PowerShell Applocker cmdlets, specifically identifying the use of "Import-Module Applocker" and "Set-AppLockerPolicy" with an XML policy.
+
     It leverages PowerShell Script Block Logging (EventCode 4104) to capture and analyze script block text.
+
     This activity is significant as it may indicate an attempt to enforce restrictive Applocker policies, potentially used by malware like Azorult to disable antivirus products.
-    If confirmed malicious, this could allow an attacker to bypass security controls, leading to further system compromise and persistence.
+
+    If confirmed malicious, this could allow an attacker to bypass security controls, leading to further system compromise and persistence.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventCode=4104
-    ScriptBlockText="*Import-Module Applocker*"
-    ScriptBlockText="*Set-AppLockerPolicy*"
-    ScriptBlockText="* -XMLPolicy *"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by dest signature signature_id
-         user_id vendor_product EventID
-         Guid Opcode Name
-         Path ProcessID ScriptBlockId
-         ScriptBlockText
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_powershell_import_applocker_policy_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Import-Module Applocker*" Processes.process="*Set-AppLockerPolicy*" Processes.process="* -XMLPolicy *" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_import_applocker_policy_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: administrators may execute this command that may cause some false positive.
 references:
@@ -42,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_powershell_invoke_restmethod_ip_information_collection.yml b/detections/endpoint/windows_powershell_invoke_restmethod_ip_information_collection.yml
index 7e988383c16..eb53f17d719 100644
--- a/detections/endpoint/windows_powershell_invoke_restmethod_ip_information_collection.yml
+++ b/detections/endpoint/windows_powershell_invoke_restmethod_ip_information_collection.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of PowerShell's Invoke-RestMethod cmdlet to collect geolocation data from ipinfo.io or IP address information from api.ipify.org. This behavior leverages PowerShell Script Block Logging to identify scripts that gather external IP information and potential geolocation data. This activity is significant as it may indicate reconnaissance efforts, where threat actors are attempting to determine the geographical location or network details of a compromised system. While some legitimate software may use these services, this pattern is commonly observed in malware and post-exploitation toolkits like those used by Water Gamayun threat actors.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText="*Invoke-RestMethod*" AND (ScriptBlockText="*ipinfo.io*" OR ScriptBlockText="*api.ipify.org*"))
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product Guid
-           Opcode Name Path
-           ProcessID ScriptBlockId ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powershell_invoke_restmethod_ip_information_collection_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Invoke-RestMethod*" Processes.process IN ("*ipinfo.io*", "*api.ipify.org*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_invoke_restmethod_ip_information_collection_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Some legitimate applications or administrative scripts may use these services for IP validation or geolocation. Filter as needed for approved administrative tools.
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_powershell_invoke_sqlcmd_execution.yml b/detections/endpoint/windows_powershell_invoke_sqlcmd_execution.yml
index bfa744ed823..2e6d83038d6 100644
--- a/detections/endpoint/windows_powershell_invoke_sqlcmd_execution.yml
+++ b/detections/endpoint/windows_powershell_invoke_sqlcmd_execution.yml
@@ -9,15 +9,8 @@ type: Hunting
 description: This detection identifies potentially suspicious usage of Invoke-Sqlcmd PowerShell cmdlet, which can be used for database operations and potential data exfiltration. The detection looks for suspicious parameter combinations and query patterns that may indicate unauthorized database access, data theft, or malicious database operations. Threat actors may prefer using PowerShell Invoke-Sqlcmd over sqlcmd.exe as it provides a more flexible programmatic interface and can better evade detection.
 data_source:
     - Powershell Script Block Logging 4104
-search: '`powershell` EventCode=4104 ScriptBlockText="*invoke-sqlcmd*" | eval script_lower=lower(ScriptBlockText) | eval has_query=case( match(script_lower, "(?i)-query\\s+"), 1, match(script_lower, "(?i)-q\\s+"), 1, true(), 0 ), has_input_file=case( match(script_lower, "(?i)-inputfile\\s+"), 1, match(script_lower, "(?i)-i\\s+"), 1, true(), 0 ), has_url_input=case( match(script_lower, "(?i)-inputfile\\s+https?://"), 1, match(script_lower, "(?i)-i\\s+https?://"), 1, match(script_lower, "(?i)-inputfile\\s+ftp://"), 1, match(script_lower, "(?i)-i\\s+ftp://"), 1, true(), 0 ), has_admin_conn=case( match(script_lower, "(?i)-dedicatedadministratorconnection"), 1, true(), 0 ), has_suspicious_auth=case( match(script_lower, "(?i)-username\\s+sa\\b"), 1, match(script_lower, "(?i)-u\\s+sa\\b"), 1, match(script_lower, "(?i)-username\\s+admin\\b"), 1, match(script_lower, "(?i)-u\\s+admin\\b"), 1, true(), 0 ), has_suspicious_query=case( match(script_lower, "(?i)(xp_cmdshell|sp_oacreate|sp_execute_external|openrowset|bulk\\s+insert)"), 1, match(script_lower, "(?i)(master\\.\\.\\.sysdatabases|msdb\\.\\.\\.backuphistory|sysadmin|securityadmin)"), 1, match(script_lower, "(?i)(select.*from.*sys\\.|select.*password|dump\\s+database)"), 1, match(script_lower, "(?i)(sp_addextendedproc|sp_makewebtask|sp_addsrvrolemember)"), 1, match(script_lower, "(?i)(sp_configure.*show\\s+advanced|reconfigure|enable_xp_cmdshell)"), 1, match(script_lower, "(?i)(exec.*master\\.dbo\\.|exec.*msdb\\.dbo\\.)"), 1, match(script_lower, "(?i)(sp_password|sp_control_dbmasterkey_password|sp_dropextendedproc)"), 1, match(script_lower, "(?i)(powershell|cmd\\.exe|rundll32|regsvr32|certutil)"), 1, true(), 0 ), has_data_exfil=case( match(script_lower, "(?i)-outputas\\s+(dataset|datatables)"), 1, match(script_lower, "(?i)-as\\s+(dataset|datatables)"), 1, match(script_lower, "(?i)(for\\s+xml|for\\s+json)"), 1, match(script_lower, "(?i)(select.*into.*from|select.*into.*outfile)"), 1, true(), 0 ), has_cert_bypass=case( match(script_lower, "(?i)-trustservercertificate"), 1, true(), 0 )
-
-    | eval risk_score=0 | eval risk_score=case( has_suspicious_query=1 AND has_data_exfil=1, risk_score + 90, has_url_input=1, risk_score + 80, has_suspicious_query=1, risk_score + 60, has_data_exfil=1, risk_score + 60, has_admin_conn=1, risk_score + 50, has_suspicious_auth=1, risk_score + 40, has_cert_bypass=1, risk_score + 20, true(), risk_score )
-
-    | eval command_type=case( match(script_lower, "xp_cmdshell"), "xp_cmdshell abuse", match(script_lower, "https?://"), "Remote file execution", match(script_lower, "sys\\.server_principals"), "System enumeration", match(script_lower, "fn_my_permissions"), "Permission enumeration", match(script_lower, "username\\s+sa\\b"), "SA account usage", match(script_lower, "show\\s+advanced\\s+options"), "Configuration change attempt", match(script_lower, "select.*from\\s+customers"), "Large data export", match(script_lower, "select.*password"), "Sensitive data query", match(script_lower, "sp_configure.*xp_cmdshell"), "Enable xp_cmdshell", 1=1, "General database access" )
-
-    | eval risk_factors=mvappend( if(has_suspicious_query=1 AND has_data_exfil=1, "High-risk query with data extraction: ".command_type, null()), if(has_url_input=1, "Remote file input detected in command", null()), if(has_suspicious_query=1, "Suspicious SQL query pattern: ".command_type, null()), if(has_data_exfil=1, "Potential data exfiltration using ".command_type, null()), if(has_admin_conn=1, "Administrative database connection", null()), if(has_suspicious_auth=1, "Suspicious authentication method used", null()), if(has_cert_bypass=1, "Certificate validation bypassed", null()) ) | eval risk_message="PowerShell Invoke-Sqlcmd execution with risk factors: ".mvjoin(risk_factors, ", ")
-
-    | where risk_score >= 30 | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText UserID Computer risk_message risk_score command_type | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_invoke_sqlcmd_execution_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*invoke-sqlcmd*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_invoke_sqlcmd_execution_filter`
 how_to_implement: To successfully implement this detection, you need to be ingesting PowerShell logs with Script Block Logging and Module Logging enabled. The detection looks for Invoke-Sqlcmd usage in PowerShell scripts and evaluates the parameters and queries for suspicious patterns. Configure your PowerShell logging to capture script block execution and ensure the logs are mapped to the PowerShell node of the Endpoint data model. The analytic will need to be tuned based on organization specific data. Currently, set to hunting to allow for tuning. Invoke-Sqlcmd is a legitimate tool for database management and scripting tasks within enterprise environments.
 known_false_positives: Database administrators and developers frequently use Invoke-Sqlcmd as a legitimate tool for various database management tasks. This includes running automated database maintenance scripts, performing ETL (Extract, Transform, Load) processes, executing data migration jobs, implementing database deployment and configuration scripts, and running monitoring and reporting tasks. To effectively manage false positives in your environment, consider implementing several mitigation strategies. First, establish a whitelist of known administrator and service accounts that regularly perform these operations. Second, create exceptions for approved script paths where legitimate database operations typically occur. Additionally, it's important to baseline your environment's normal PowerShell database interaction patterns and implement monitoring for any deviations from these established patterns. Finally, consider adjusting the risk score thresholds based on your specific environment and security requirements to achieve an optimal balance between security and operational efficiency.
 references:
diff --git a/detections/endpoint/windows_powershell_logoff_user_via_quser.yml b/detections/endpoint/windows_powershell_logoff_user_via_quser.yml
index 7061caf78ce..f5190383734 100644
--- a/detections/endpoint/windows_powershell_logoff_user_via_quser.yml
+++ b/detections/endpoint/windows_powershell_logoff_user_via_quser.yml
@@ -6,27 +6,15 @@ modification_date: '2026-06-29'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the process of logging off a user through the use of the quser and logoff commands.
+description: 'The following analytic detects the process of logging off a user through the use of the quser and logoff commands.
+
     By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt.
-    This detection helps identify potential misuse or malicious activity where a user's access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation.
+
+    This detection helps identify potential misuse or malicious activity where a user''s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventCode=4104
-    ScriptBlockText = "*quser*logoff*"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by dest signature signature_id
-         user_id vendor_product EventID
-         Guid Opcode Name
-         Path ProcessID ScriptBlockId
-         ScriptBlockText
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_powershell_logoff_user_via_quser_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*quser*logoff*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_logoff_user_via_quser_filter`
 how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators or power users may use this command.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_powershell_module_file_created.yml b/detections/endpoint/windows_powershell_module_file_created.yml
index 303e9d399c1..3ac3fb23f6c 100644
--- a/detections/endpoint/windows_powershell_module_file_created.yml
+++ b/detections/endpoint/windows_powershell_module_file_created.yml
@@ -6,31 +6,15 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects the creation of a DLL within the various PowerShell module directories.
+description: 'Detects the creation of a DLL within the various PowerShell module directories.
+
     This can indicate a new module being installed, attempts at ScriptBlock smuggling, or other malicious PowerShell activity utilizing modules.
-    False positives could include installation of legitimate modules.
+
+    False positives could include installation of legitimate modules.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.action="created"
-    Filesystem.file_path="*\\WindowsPowerShell\\Modules\\*.dll"
-    Filesystem.file_name="*.dll"
-
-    by Filesystem.dest Filesystem.file_create_time Filesystem.process_path
-       Filesystem.process_guid Filesystem.process_id Filesystem.file_path Filesystem.file_name
-       Filesystem.user Filesystem.vendor_product Filesystem.action
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_powershell_module_file_created_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="\\WindowsPowerShell\\Modules\*.dll" Filesystem.file_name="*.dll" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_module_file_created_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate installation of approved PowerShell modules may trigger this detection. Verify module sources to reduce false positives.
 references:
@@ -44,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_powershell_msix_package_installation.yml b/detections/endpoint/windows_powershell_msix_package_installation.yml
index f550a0f32a5..98c149d0ec2 100644
--- a/detections/endpoint/windows_powershell_msix_package_installation.yml
+++ b/detections/endpoint/windows_powershell_msix_package_installation.yml
@@ -9,26 +9,18 @@ type: TTP
 description: The following analytic detects the execution of PowerShell commands to install unsigned AppX packages using Add-AppxPackage or Add-AppPackage cmdlets with the -AllowUnsigned flag. This detection leverages PowerShell Script Block Logging (EventCode=4104) to capture the full command content. This activity is significant as adversaries may use unsigned AppX packages to install malicious applications, bypass security controls, or establish persistence. If confirmed malicious, this could allow attackers to install unauthorized applications that may contain malware, backdoors, or other malicious components.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText IN("*Add-AppPackage *", "*Add-AppxPackage *") AND ScriptBlockText IN ("* -AllowUnsigned*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powershell_msix_package_installation_filter`
-      | `windows_powershell_msix_package_installation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*Add-AppPackage *", "*Add-AppxPackage *") Processes.process="* -AllowUnsigned*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_msix_package_installation_filter`
 how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. Ensure PowerShell Script Block Logging is enabled in your environment to capture the full command content.
-known_false_positives: |
-    Installation of unsigned packages for testing purposes by developers or system administrators.
+known_false_positives: 'Installation of unsigned packages for testing purposes by developers or system administrators.
+
     Legitimate software development and testing activities may trigger this detection.
+
     Internal application development teams testing MSIX packages before signing.
+
     System administrators installing custom unsigned applications for business purposes.
-    Note: The -AllowUnsigned flag is only available on Windows 11 and later versions.
+
+    Note: The -AllowUnsigned flag is only available on Windows 11 and later versions.'
 references:
     - https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package
     - https://learn.microsoft.com/en-us/windows/msix/desktop/powershell-msix-cmdlets
@@ -45,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The user $user_id$ attempted to install an unsigned AppX package on $dest$ using PowerShell.
     entity:
diff --git a/detections/endpoint/windows_powershell_process_implementing_manual_base64_decoder.yml b/detections/endpoint/windows_powershell_process_implementing_manual_base64_decoder.yml
index d776f283e54..0d48faf5e4c 100644
--- a/detections/endpoint/windows_powershell_process_implementing_manual_base64_decoder.yml
+++ b/detections/endpoint/windows_powershell_process_implementing_manual_base64_decoder.yml
@@ -6,54 +6,43 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali
 status: production
 type: Anomaly
-description: |
-    The following analytic identifies Windows PowerShell processes that implement a manual Base64 decoder.
+description: 'The following analytic identifies Windows PowerShell processes that implement a manual Base64 decoder.
+
     Threat actors often use Base64 encoding to obfuscate malicious payloads or commands within PowerShell scripts.
+
     By manually decoding Base64 strings, attackers can evade detection mechanisms that look for standard decoding functions like using the "-enc" flag or the "FromBase64String" function.
+
     This detection focuses on PowerShell processes that exhibit characteristics of manual Base64 decoding, such as the presence of specific string manipulation methods and bitwise operations.
-    Security teams should investigate any instances of such activity, especially if found in conjunction with other suspicious behaviors or on systems that should not be using PowerShell for such tasks.
+
+    Security teams should investigate any instances of such activity, especially if found in conjunction with other suspicious behaviors or on systems that should not be using PowerShell for such tasks.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") Processes.process="*ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/*" Processes.process="*.Substring(*" Processes.process="*.GetString(*" Processes.process="*.IndexOf(*" Processes.process IN ("*-shl*", "*-shr*", "*-bxor*", "*-bor*", "*-band*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_process_implementing_manual_base64_decoder_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-      from datamodel=Endpoint.Processes where
-
-      `process_powershell`
-      Processes.process = "*ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/*"
-      Processes.process = "*.Substring(*"
-      Processes.process = "*.GetString(*"
-      Processes.process = "*.IndexOf(*"
-      Processes.process IN ("*-shl*", *-shr*, "*-bxor*", "*-bor*", "*-band*")
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id
-       Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_powershell_process_implementing_manual_base64_decoder_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    Legitimate use of PowerShell for decoding Base64 strings by administrators
+
+    names and speed up the data modeling process.'
+known_false_positives: 'Legitimate use of PowerShell for decoding Base64 strings by administrators
+
     or power users may trigger this detection. It is essential to review the context
-    of the PowerShell execution to determine if it is malicious, suspicious or even authorized activity.
+
+    of the PowerShell execution to determine if it is malicious, suspicious or even authorized activity.'
 references:
     - https://www.virustotal.com/gui/file/4b3ab4d9f2332da6b6cd8d9d0f4910a5eb85ac8c969108acb3ad49631812f998/behavior
 drilldown_searches:
@@ -64,7 +53,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_powershell_process_with_malicious_string.yml b/detections/endpoint/windows_powershell_process_with_malicious_string.yml
index 3093678429b..bfae62b7ade 100644
--- a/detections/endpoint/windows_powershell_process_with_malicious_string.yml
+++ b/detections/endpoint/windows_powershell_process_with_malicious_string.yml
@@ -11,7 +11,7 @@ data_source:
     - Windows Event Log Security 4688
     - Sysmon EventID 1
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
       WHERE `process_powershell`
       BY Processes.action Processes.dest Processes.original_file_name
@@ -42,7 +42,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate PowerShell on $dest$
       search: '| from datamodel:Endpoint.Processes | search dest=$dest|s$ process_name=$process_name$ "*$match$*"'
       earliest_offset: $info_min_time$
diff --git a/detections/endpoint/windows_powershell_remotesigned_file.yml b/detections/endpoint/windows_powershell_remotesigned_file.yml
index 33efbcff4c7..c67ffc5da9e 100644
--- a/detections/endpoint/windows_powershell_remotesigned_file.yml
+++ b/detections/endpoint/windows_powershell_remotesigned_file.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_powershell` Processes.process="* remotesigned *" Processes.process="* -File *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_powershell_remotesigned_file_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") Processes.process="* remotesigned *" Processes.process="* -File *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_remotesigned_file_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: It is possible administrators or scripts may run these commands, filtering may be required.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_powershell_scheduletask.yml b/detections/endpoint/windows_powershell_scheduletask.yml
index 2a5eed3da25..d213cd81333 100644
--- a/detections/endpoint/windows_powershell_scheduletask.yml
+++ b/detections/endpoint/windows_powershell_scheduletask.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects potential malicious activities involving PowerShell's task scheduling cmdlets. It leverages PowerShell Script Block Logging (EventCode 4104) to identify unusual or suspicious use of cmdlets like 'New-ScheduledTask' and 'Set-ScheduledTask'. This activity is significant as attackers often use these cmdlets for persistence and remote execution of malicious code. If confirmed malicious, this could allow attackers to maintain access, deliver additional payloads, or execute ransomware, leading to data theft or other severe impacts. Immediate investigation and mitigation are crucial to prevent further compromise.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText IN ("*New-ScheduledTask*", "*New-ScheduledTaskAction*", "*New-ScheduledTaskSettingsSet*", "*New-ScheduledTaskTrigger*", "*Register-ClusteredScheduledTask*", "*Register-ScheduledTask*", "*Set-ClusteredScheduledTask*", "*Set-ScheduledTask*", "*Start-ScheduledTask*", "*Enable-ScheduledTask*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powershell_scheduletask_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*New-ScheduledTask*", "*New-ScheduledTaskAction*", "*New-ScheduledTaskSettingsSet*", "*New-ScheduledTaskTrigger*", "*Register-ClusteredScheduledTask*", "*Register-ScheduledTask*", "*Set-ClusteredScheduledTask*", "*Set-ScheduledTask*", "*Start-ScheduledTask*", "*Enable-ScheduledTask*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_scheduletask_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Benign administrative tasks can also trigger alerts, necessitating a firm understanding of the typical system behavior and precise tuning of the analytic to reduce false positives.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml b/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml
index 8556e4f6761..dbca790205e 100644
--- a/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml
+++ b/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the execution of multiple offensive toolkits and commands by leveraging PowerShell Script Block Logging (EventCode=4104). This method captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities including several well-known tools used for credential theft, lateral movement, and persistence. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment.
 data_source:
     - Powershell Script Block Logging 4104
-search: '`powershell` ScriptBlockText=* EventCode=4104 | stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Guid) as Guid values(Opcode) as Opcode values(Name) as Name values(Path) as Path values(ProcessID) as ProcessID values(ScriptBlockId) as ScriptBlockId values(ScriptBlockText) as ScriptBlockText by dest signature signature_id user_id vendor_product | eval command = mvjoin(command,"\n") | lookup local=t malicious_powershell_strings command | where isnotnull(match) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_script_block_with_malicious_string_filter`'
+search: |
+    `powershell` ScriptBlockText=* EventCode=4104 | stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Guid) as Guid values(Opcode) as Opcode values(Name) as Name values(Path) as Path values(ProcessID) as ProcessID values(ScriptBlockId) as ScriptBlockId values(ScriptBlockText) as ScriptBlockText by dest signature signature_id user_id vendor_product | eval command = mvjoin(command,"\n") | lookup local=t malicious_powershell_strings command | where isnotnull(match) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_script_block_with_malicious_string_filter`
 how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: No false positives have been identified at this time. commands with overlap.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The user $user_id$ ran a known malicious PowerShell string matching *$match$* on $dest$
     entity:
diff --git a/detections/endpoint/windows_powershell_script_from_windowsapps_directory.yml b/detections/endpoint/windows_powershell_script_from_windowsapps_directory.yml
index de8ccb067ba..9e4a7973cb7 100644
--- a/detections/endpoint/windows_powershell_script_from_windowsapps_directory.yml
+++ b/detections/endpoint/windows_powershell_script_from_windowsapps_directory.yml
@@ -6,44 +6,21 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic identifies the execution of PowerShell scripts from the WindowsApps directory, which is a common technique used in malicious MSIX package execution.
+description: 'The following analytic identifies the execution of PowerShell scripts from the WindowsApps directory, which is a common technique used in malicious MSIX package execution.
+
     This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command lines and parent process paths.
+
     This activity is significant as adversaries have been observed using MSIX packages with embedded PowerShell scripts (particularly StartingScriptWrapper.ps1) to execute malicious code.
-    If confirmed malicious, this could allow attackers to execute arbitrary code, establish persistence, or deliver malware while evading traditional detection mechanisms.
+
+    If confirmed malicious, this could allow attackers to execute arbitrary code, establish persistence, or deliver malware while evading traditional detection mechanisms.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes where
-
-    (
-        `process_powershell`
-        OR
-        `process_cmd`
-    )
-    AND
-    (
-        Processes.parent_process_path="*\\WindowsApps\\*"
-        OR
-        Processes.process IN ("*WindowsApps*-file *", "*WindowsApps*.ps1*")
-    )
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_powershell_script_from_windowsapps_directory_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain process execution information, including process paths and command lines. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate applications installed via the Microsoft Store or MSIX packages may execute PowerShell scripts from the WindowsApps directory as part of their normal operation. Verify if the MSIX package is from a trusted source and signed by a trusted publisher before taking action. Look for additional suspicious activities like network connections to unknown domains or execution of known malicious payloads.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe", "*cmd.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE", "Cmd.Exe") Processes.process IN ("*WindowsApps*-file *", "*WindowsApps*.ps1*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_script_from_windowsapps_directory_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain process execution information, including process paths and command lines. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate applications installed via the Microsoft Store or MSIX packages may execute PowerShell scripts from the WindowsApps directory as part of their normal operation. Verify if the MSIX package is from a trusted source and signed by a trusted publisher before taking action. Look for additional suspicious activities like network connections to unknown domains or execution of known malicious payloads.
 references:
     - https://redcanary.com/blog/threat-intelligence/msix-installers/
     - https://redcanary.com/threat-detection-report/techniques/installer-packages/
@@ -57,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Look for specific StartingScriptWrapper.ps1 execution
       search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name="powershell.exe" AND Processes.process="*StartingScriptWrapper.ps1*" by Processes.dest Processes.process Processes.parent_process_name'
       earliest_offset: $info_min_time$
@@ -88,6 +65,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/msix_powershell/windows-sysmon.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_powershell_script_tabexpansion_direct_call.yml b/detections/endpoint/windows_powershell_script_tabexpansion_direct_call.yml
index 512ec657a5b..22853e55992 100644
--- a/detections/endpoint/windows_powershell_script_tabexpansion_direct_call.yml
+++ b/detections/endpoint/windows_powershell_script_tabexpansion_direct_call.yml
@@ -6,29 +6,17 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects specific indicators associated with the execution of the TabExpansion internal function in PowerShell.
+description: 'Detects specific indicators associated with the execution of the TabExpansion internal function in PowerShell.
+
     Calling this function directly is not normal and can be indicative of malicious activity such as TabShell.
+
     Due to the way PowerShell internals work it can be used in conjunction with directory transversal to load any PowerShell functions even in a sandboxed session.
-    False positives could include legitimate usage of the TabExpansion function but calling it directly is very rare.
+
+    False positives could include legitimate usage of the TabExpansion function but calling it directly is very rare.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventID="4104"
-    ScriptBlockText="*$lastWord*"
-    ScriptBlockText="*$_val=' + $_expression*"
-    ScriptBlockText="*function Write-Members*"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer EventID ScriptBlockText signature signature_id user_id vendor_product Guid
-         Opcode Name Path ProcessID ScriptBlockId
-
-    | rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_powershell_script_tabexpansion_direct_call_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*$lastWord*" Processes.process="*$_val=' + $_expression*" Processes.process="*function Write-Members*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_script_tabexpansion_direct_call_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate use of the TabExpansion function is rare but possible. Filter alerts if direct calls are from trusted administrative or development activities.
 references:
@@ -41,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_powershell_wmi_win32_scheduledjob.yml b/detections/endpoint/windows_powershell_wmi_win32_scheduledjob.yml
index 6797bd24499..96690e40b9c 100644
--- a/detections/endpoint/windows_powershell_wmi_win32_scheduledjob.yml
+++ b/detections/endpoint/windows_powershell_wmi_win32_scheduledjob.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the use of the Win32_ScheduledJob WMI class via PowerShell script block logging. This class, which manages scheduled tasks, is disabled by default due to security concerns and must be explicitly enabled through registry modifications. The detection leverages PowerShell event code 4104 and script block text analysis. Monitoring this activity is crucial as it may indicate malicious intent, especially if the class was enabled by an attacker. If confirmed malicious, this could allow attackers to persist in the environment by creating scheduled tasks.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText="*win32_scheduledjob*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powershell_wmi_win32_scheduledjob_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*win32_scheduledjob*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_wmi_win32_scheduledjob_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: False positives may be present based on legacy applications or utilities. Win32_ScheduledJob uses the Remote Procedure Call (RPC) protocol to create scheduled tasks on remote computers. It uses the DCOM (Distributed Component Object Model) infrastructure to establish a connection with the remote computer and invoke the necessary methods. The RPC service needs to be running on both the local and remote computers for the communication to take place.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: PowerShell attempting to create a task via WMI - Win32_ScheduledJob,  was ran on $dest$.
     entity:
diff --git a/detections/endpoint/windows_powersploit_gpp_discovery.yml b/detections/endpoint/windows_powersploit_gpp_discovery.yml
index 18ee259eb97..64a3fae7526 100644
--- a/detections/endpoint/windows_powersploit_gpp_discovery.yml
+++ b/detections/endpoint/windows_powersploit_gpp_discovery.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the Get-GPPPassword PowerShell cmdlet, which is used to search for unsecured credentials in Group Policy Preferences (GPP). This detection leverages PowerShell Script Block Logging to identify specific script block text associated with this cmdlet. Monitoring this activity is crucial as it can indicate an attempt to retrieve and decrypt stored credentials from SYSVOL, potentially leading to unauthorized access. If confirmed malicious, this activity could allow an attacker to escalate privileges or move laterally within the network by exploiting exposed credentials.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104  (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword)
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powersploit_gpp_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("Get-GPPPassword", "Get-CachedGPPPassword") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powersploit_gpp_discovery_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -38,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Commandlets leveraged to discover GPP credentials were executed on $dest$
     entity:
diff --git a/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml b/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml
index 59c1fa0ee84..6654d965d9d 100644
--- a/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml
+++ b/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of PowerView PowerShell cmdlets `Get-ObjectAcl` or `Get-DomainObjectAcl`, which are used to enumerate Access Control List (ACL) permissions for Active Directory objects. It leverages Event ID 4104 from PowerShell Script Block Logging to identify this activity. This behavior is significant as it may indicate an attempt to discover weak permissions in Active Directory, potentially leading to privilege escalation. If confirmed malicious, attackers could exploit these permissions to gain unauthorized access or escalate their privileges within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104  (ScriptBlockText=*get-objectacl* OR ScriptBlockText=*Get-DomainObjectAcl*)
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powerview_ad_access_control_list_enumeration_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*get-objectacl*", "*Get-DomainObjectAcl*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powerview_ad_access_control_list_enumeration_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.=
 known_false_positives: Administrators may leverage PowerView for legitimate purposes, filter as needed.
 references:
@@ -36,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: PowerView AD acccess control list enumeration detected on $dest$
     entity:
diff --git a/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml b/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml
index 42b778f2a54..edf1f3eebda 100644
--- a/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml
+++ b/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the use of PowerView commandlets to discover Windows endpoints with Kerberos Constrained Delegation. It leverages PowerShell Script Block Logging (EventCode=4104) to identify specific commandlets like `Get-DomainComputer` or `Get-NetComputer` with the `-TrustedToAuth` parameter. This activity is significant as it indicates potential reconnaissance efforts by adversaries or Red Teams to map out privileged delegation settings in Active Directory. If confirmed malicious, this could allow attackers to identify high-value targets for further exploitation, potentially leading to privilege escalation or lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*" OR ScriptBlockText = "*Get-NetComputer*") AND (ScriptBlockText = "*-TrustedToAuth*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powerview_constrained_delegation_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*Get-DomainComputer*", "*Get-NetComputer*") Processes.process="*-TrustedToAuth*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powerview_constrained_delegation_discovery_filter`
 how_to_implement: The following  analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators or power users may leverage PowerView for system management or troubleshooting.
 references:
@@ -38,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious PowerShell Get-DomainComputer was identified on endpoint $dest$
     entity:
diff --git a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml
index 750c9d8558b..a4dd5c8efb1 100644
--- a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml
+++ b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Get-DomainSPNTicket` commandlet, part of the PowerView tool, by leveraging PowerShell Script Block Logging (EventCode=4104). This commandlet requests Kerberos service tickets for specified service principal names (SPNs). Monitoring this activity is crucial as it can indicate attempts to perform Kerberoasting, a technique used to extract SPN account passwords via cracking tools like hashcat. If confirmed malicious, this activity could allow attackers to gain unauthorized access to sensitive accounts, potentially leading to privilege escalation and further network compromise.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText=*Get-DomainSPNTicket*
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powerview_kerberos_service_ticket_request_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-DomainSPNTicket*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powerview_kerberos_service_ticket_request_filter`
 how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: False positive may include Administrators using PowerView for troubleshooting and management.
 references:
@@ -38,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: PowerView commandlets used for requesting SPN service ticket executed on $dest$
     entity:
diff --git a/detections/endpoint/windows_powerview_spn_discovery.yml b/detections/endpoint/windows_powerview_spn_discovery.yml
index 3f6f40be026..6839daea5c5 100644
--- a/detections/endpoint/windows_powerview_spn_discovery.yml
+++ b/detections/endpoint/windows_powerview_spn_discovery.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the execution of the `Get-DomainUser` or `Get-NetUser` PowerShell cmdlets with the `-SPN` parameter, indicating the use of PowerView for SPN discovery. It leverages PowerShell Script Block Logging (EventCode=4104) to identify these specific commands. This activity is significant as it suggests an attempt to enumerate domain accounts associated with Service Principal Names (SPNs), a common precursor to Kerberoasting attacks. If confirmed malicious, this could allow an attacker to identify and target accounts for credential theft, potentially leading to unauthorized access and privilege escalation within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText =*Get-NetUser* OR ScriptBlockText=*Get-DomainUser*) ScriptBlockText= *-SPN*
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powerview_spn_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*Get-NetUser*", "*Get-DomainUser*") Processes.process="*-SPN*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powerview_spn_discovery_filter`
 how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: False positive may include Administrators using PowerView for troubleshooting and management.
 references:
@@ -36,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: PowerView commandlets used for SPN discovery executed on $dest$
     entity:
diff --git a/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml b/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml
index 500cc343b70..325c098d598 100644
--- a/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml
+++ b/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the use of PowerView commandlets to discover Windows endpoints with Kerberos Unconstrained Delegation. It leverages PowerShell Script Block Logging (EventCode=4104) to identify specific commands like `Get-DomainComputer` or `Get-NetComputer` with the `-Unconstrained` parameter. This activity is significant as it indicates potential reconnaissance efforts by adversaries or Red Teams to map out privileged delegation settings in Active Directory. If confirmed malicious, this could allow attackers to identify high-value targets for further exploitation, potentially leading to privilege escalation or lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*" OR ScriptBlockText = "*Get-NetComputer*") AND (ScriptBlockText = "*-Unconstrained*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_powerview_unconstrained_delegation_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*Get-DomainComputer*", "*Get-NetComputer*") Processes.process="*-Unconstrained*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powerview_unconstrained_delegation_discovery_filter`
 how_to_implement: The following  analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators or power users may leverage PowerView for system management or troubleshooting.
 references:
@@ -37,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious PowerShell Get-DomainComputer was identified on endpoint $dest$
     entity:
diff --git a/detections/endpoint/windows_powgoop_beacon_decoding.yml b/detections/endpoint/windows_powgoop_beacon_decoding.yml
index 866c237aa15..6b6734e4b10 100644
--- a/detections/endpoint/windows_powgoop_beacon_decoding.yml
+++ b/detections/endpoint/windows_powgoop_beacon_decoding.yml
@@ -6,37 +6,18 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects a DLL decoding and executing the PowGoop config.txt payload, the stage in the MuddyWater infection chain where an obfuscated PowerShell beacon is unwrapped and live C2 communication begins.
+description: 'Detects a DLL decoding and executing the PowGoop config.txt payload, the stage in the MuddyWater infection chain where an obfuscated PowerShell beacon is unwrapped and live C2 communication begins.
+
     PowGoop is the primary loader used by MuddyWater (also tracked as SeedWorm, Static Kitten, and MERCURY) and has been their main initial access loader since at least 2020.
+
     It abuses DLL side-loading against a fake GoogleUpdate.exe to execute a multi-stage decoding chain, a fully functional PowerShell backdoor disguised with a benign extension.
-    The config.txt contains a hardcoded C2 address and victim GUID, beacons via modified base64-encoded HTTP, and runs C2 traffic under the legitimate Google Update process to evade network detection.
+
+    The config.txt contains a hardcoded C2 address and victim GUID, beacons via modified base64-encoded HTTP, and runs C2 traffic under the legitimate Google Update process to evade network detection.'
 data_source:
     - Sysmon EventID 1
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.parent_process_path="*rundll32.exe"
-    Processes.process_name="powershell.exe"
-    Processes.process="*FromBase64String*"
-    Processes.process="*config.txt*"
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_powgoop_beacon_decoding_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*powershell.exe" Processes.process="*FromBase64String*" Processes.process="*config.txt*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powgoop_beacon_decoding_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some security tools or legitimate debugging processes may decode config files similar to PowGoop. Review and whitelist trusted applications to reduce false alerts.
 references:
@@ -49,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential PowGoop Beacon Decoding activity observed on $dest$ via $process$.
     entity:
diff --git a/detections/endpoint/windows_private_keys_discovery.yml b/detections/endpoint/windows_private_keys_discovery.yml
index b55f95f5e91..40beabf0c34 100644
--- a/detections/endpoint/windows_private_keys_discovery.yml
+++ b/detections/endpoint/windows_private_keys_discovery.yml
@@ -6,16 +6,18 @@ modification_date: '2026-08-31'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies processes that retrieve information related to private key files, often used by post-exploitation tools like winpeas.
+description: 'The following analytic identifies processes that retrieve information related to private key files, often used by post-exploitation tools like winpeas.
+
     This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that search for private key certificates.
+
     This activity is significant as it indicates potential attempts to locate insecurely stored credentials, which adversaries can exploit for privilege escalation, persistence, or remote service authentication.
-    If confirmed malicious, this behavior could allow attackers to access sensitive information, escalate privileges, or maintain persistence within the compromised environment.
+
+    If confirmed malicious, this behavior could allow attackers to access sensitive information, escalate privileges, or maintain persistence within the compromised environment.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -62,10 +64,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_private_keys_discovery_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Very long command line arguments may contain these keywords in irrelevant sections of the code.
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Very long command line arguments may contain these keywords in irrelevant sections of the code.
 references:
     - https://attack.mitre.org/techniques/T1552/004/
     - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
@@ -78,7 +78,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_privilege_escalation_attempt_via_msi_rollback.yml b/detections/endpoint/windows_privilege_escalation_attempt_via_msi_rollback.yml
index 743ac46d0f7..3b9169758c6 100644
--- a/detections/endpoint/windows_privilege_escalation_attempt_via_msi_rollback.yml
+++ b/detections/endpoint/windows_privilege_escalation_attempt_via_msi_rollback.yml
@@ -6,36 +6,19 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects an attacker abusing the Windows Installer rollback mechanism to escalate privileges from a standard user to SYSTEM without triggering a UAC prompt, using a technique known as FolderContentsDeleteToFolderDelete.
+description: 'Detects an attacker abusing the Windows Installer rollback mechanism to escalate privileges from a standard user to SYSTEM without triggering a UAC prompt, using a technique known as FolderContentsDeleteToFolderDelete.
+
     Windows Installer (msiexec.exe) creates rollback scripts during software installation to undo changes if an installation fails.
+
     These rollback scripts are generated and executed by the Windows Installer service, which runs as SYSTEM.
-    The FolderContentsDeleteToFolderDelete technique abuses this trusted mechanism by crafting a malicious rollback script that instructs the SYSTEM-level Installer service to delete attacker-chosen files or directories — effectively giving a low-privileged attacker the ability to make SYSTEM-level filesystem modifications without any privilege prompt.
+
+    The FolderContentsDeleteToFolderDelete technique abuses this trusted mechanism by crafting a malicious rollback script that instructs the SYSTEM-level Installer service to delete attacker-chosen files or directories — effectively giving a low-privileged attacker the ability to make SYSTEM-level filesystem modifications without any privilege prompt.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process="*/target \"C:\\Config.msi\" *"
-    Processes.process="*/initial*"
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_privilege_escalation_attempt_via_msi_rollback_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*/target \"C:\\Config.msi\" *" Processes.process="*/initial*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_privilege_escalation_attempt_via_msi_rollback_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate system cleanup or maintenance scripts may use similar FolderContentsDeleteToFolderDelete commands. Review and whitelist approved tools to reduce false alerts.
 references:
@@ -48,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential MSI Rollback Privilege Escalation activity observed on $dest$ via $process$.
     entity:
diff --git a/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml b/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml
index 7b711dbac07..5332a8e9d29 100644
--- a/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml
+++ b/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml
@@ -6,14 +6,16 @@ modification_date: '2026-05-13'
 author: Steven Dick
 status: production
 type: TTP
-description: |
-    The following analytic detects when a process running with low or medium integrity from a user account spawns an elevated process with high or system integrity in suspicious locations.
+description: 'The following analytic detects when a process running with low or medium integrity from a user account spawns an elevated process with high or system integrity in suspicious locations.
+
     This behavior is identified using process execution data from Windows process monitoring.
+
     This activity is significant as it may indicate a threat actor successfully elevating privileges, which is a common tactic in advanced attacks.
-    If confirmed malicious, this could allow the attacker to execute code with higher privileges, potentially leading to full system compromise and persistent access.
+
+    If confirmed malicious, this could allow the attacker to execute code with higher privileges, potentially leading to full system compromise and persistent access.'
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 1
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
 
@@ -117,10 +119,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_privilege_escalation_suspicious_process_elevation_filter`
-how_to_implement: |-
-    Target environment must ingest process execution data sources such as Windows process monitoring and/or Sysmon EID 1.
-known_false_positives: |-
-    False positives may be generated by administrators installing benign applications using run-as/elevation.
+how_to_implement: Target environment must ingest process execution data sources such as Windows process monitoring and/or Sysmon EID 1.
+known_false_positives: False positives may be generated by administrators installing benign applications using run-as/elevation.
 references:
     - https://attack.mitre.org/techniques/T1068/
     - https://vuls.cert.org/confluence/display/Wiki/2021/06/21/Finding+Privilege+Escalation+Vulnerabilities+in+Windows+using+Process+Monitor
@@ -134,7 +134,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The user $src_user$ launched a process [$parent_process_name$] which spawned a suspicious elevated integrity process [$process_name$].
     entity:
@@ -166,9 +166,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/windows_escalation_behavior/windows_escalation_behavior_sysmon.log
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml b/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml
index fa88190135a..6b4fc269d8e 100644
--- a/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml
+++ b/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects any system integrity level process spawned by a non-system account. It leverages Sysmon EventID 1, focusing on process integrity and parent user data. This behavior is significant as it often indicates successful privilege escalation to SYSTEM from a user-controlled process or service. If confirmed malicious, this activity could allow an attacker to gain full control over the system, execute arbitrary code, and potentially compromise the entire environment.
 data_source:
     - Sysmon EventID 1
-search: '`sysmon` EventCode=1 IntegrityLevel="system" ParentUser=* NOT ParentUser IN ("*SYSTEM","*LOCAL SERVICE","*NETWORK SERVICE","*DWM-*","*$","-") | eval src_user = replace(ParentUser,"^[^\\\]+\\\\","") | stats count min(_time) as firstTime max(_time) as lastTime by action dest original_file_name parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process process_exec process_guid process_hash process_id process_integrity_level process_name process_path user user_id vendor_product src_user | `security_content_ctime(firstTime)`  | `security_content_ctime(lastTime)` | `windows_privilege_escalation_system_process_without_system_parent_filter`'
+search: |
+    `sysmon` EventCode=1 IntegrityLevel="system" ParentUser="*" NOT (ParentUser IN ("*SYSTEM", "*LOCAL SERVICE", "*NETWORK SERVICE", "*DWM-", "*$", "*-")) | eval src_user=src_user | stats count min(_time) as firstTime max(_time) as lastTime by action dest original_file_name parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process process_exec process_guid process_hash process_id process_integrity_level process_name process_path user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_privilege_escalation_system_process_without_system_parent_filter`
 how_to_implement: Target environment must ingest sysmon data, specifically Event ID 1 with process integrity and parent user data.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$src_user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$src_user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The process [$process_name$] on $dest$ was launched with system level integrity by $src_user$.
     entity:
@@ -56,9 +57,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/windows_escalation_behavior/windows_escalation_behavior_sysmon.log
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml b/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml
index f50eaddfc91..fab01f6a22e 100644
--- a/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml
+++ b/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml
@@ -6,14 +6,16 @@ modification_date: '2026-05-13'
 author: Steven Dick
 status: production
 type: TTP
-description: |
-    The following analytic detects when a process with low, medium, or high integrity spawns a system integrity process from a user-controlled location.
+description: 'The following analytic detects when a process with low, medium, or high integrity spawns a system integrity process from a user-controlled location.
+
     This behavior is indicative of privilege escalation attempts where attackers elevate their privileges to SYSTEM level from a user-controlled process or service.
+
     The detection leverages Sysmon data, specifically Event ID 15, to identify such transitions.
-    Monitoring this activity is crucial as it can signify an attacker gaining SYSTEM-level access, potentially leading to full control over the affected system, unauthorized access to sensitive data, and further malicious activities.
+
+    Monitoring this activity is crucial as it can signify an attacker gaining SYSTEM-level access, potentially leading to full control over the affected system, unauthorized access to sensitive data, and further malicious activities.'
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 1
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
 
@@ -96,7 +98,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The user $user$ launched the process $process_name$ which spawned a system level integrity process.
     entity:
@@ -129,9 +131,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/windows_escalation_behavior/windows_escalation_behavior_sysmon.log
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_privileged_group_modification.yml b/detections/endpoint/windows_privileged_group_modification.yml
index 9ad62213aee..eec3a58d2d2 100644
--- a/detections/endpoint/windows_privileged_group_modification.yml
+++ b/detections/endpoint/windows_privileged_group_modification.yml
@@ -6,10 +6,11 @@ modification_date: '2026-05-13'
 author: Brandon Sternfield, Optiv + ClearShark
 status: production
 type: TTP
-description: |
-    This analytic detects modifications to privileged groups in Active Directory, including addition, creation, deletion, and changes to various types of groups such as local, global, universal, and LDAP query groups.
+description: 'This analytic detects modifications to privileged groups in Active Directory, including addition, creation, deletion, and changes to various types of groups such as local, global, universal, and LDAP query groups.
+
     It specifically monitors for changes to high-privilege groups like "Administrators", "Domain Admins", "Enterprise Admins", and "ESX Admins", among others.
-    This detection is particularly relevant in the context of potential exploitation of vulnerabilities like the VMware ESXi Active Directory Integration Authentication Bypass (CVE-2024-37085), where attackers may attempt to manipulate privileged groups to gain unauthorized access to systems.
+
+    This detection is particularly relevant in the context of potential exploitation of vulnerabilities like the VMware ESXi Active Directory Integration Authentication Bypass (CVE-2024-37085), where attackers may attempt to manipulate privileged groups to gain unauthorized access to systems.'
 data_source:
     - Windows Event Log Security 4727
     - Windows Event Log Security 4731
@@ -20,67 +21,10 @@ data_source:
     - Windows Event Log Security 4759
     - Windows Event Log Security 4783
     - Windows Event Log Security 4790
-search: |-
-    `wineventlog_security`
-    EventCode IN (
-            4727,
-            4731,
-            4744,
-            4749,
-            4754,
-            4756,
-            4759,
-            4783,
-            4790
-        )
-    TargetUserName IN (
-            "Account Operators",
-            "Administrators",
-            "Admins DNS",
-            "Backup Operators",
-            "DnsAdmins",
-            "Domain Admins",
-            "Enterprise Admins",
-            "Enterprise Key Admins",
-            "ESX Admins",
-            "ESXi Admins",
-            "Group Policy Creator Owners",
-            "Hyper-V Administrators",
-            "Key Admins",
-            "Print Operators",
-            "Remote Desktop Users",
-            "Remote Management Users",
-            "Replicators",
-            "Schema Admins",
-            "Server Operators"
-        )
-    | eval object_category=case(
-            EventCode="4727", "Global Group (Security)",
-            EventCode="4731", "Local Group (Security)",
-            EventCode="4744", "Local Group (Distribution)",
-            EventCode="4749", "Global Group (Distribution)",
-            EventCode="4754", "Universal Group (Security)",
-            EventCode="4756", "Universal Group (Security)",
-            EventCode="4759", "Universal Group (Distribution)",
-            EventCode="4783", "Basic Application Group",
-            EventCode="4790", "LDAP Query Group"
-        )
-
-    | rename Computer as dest
-             result as change_type
-             TargetUserName as object
-             TargetSid as object_path
-
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-        BY EventCode src_user object_category
-           object object_path dest
-           change_type status
-    | `windows_privileged_group_modification_filter`
-how_to_implement: |
-    To successfully implement this search, ensure that Windows Security Event logging is enabled and being ingested into Splunk, particularly for event codes 4727, 4730, and 4737. Configure Group Policy settings to audit these specific events.
-known_false_positives: |
-    Legitimate administrators might create, delete, or modify an a privileged group for valid reasons. Verify that the group changes are authorized and part of normal administrative tasks. Consider the context of the action, such as the user performing it and any related activities.
+search: |
+    `wineventlog_security` EventCode IN ("4727", "4731", "4744", "4749", "4754", "4756", "4759", "4783", "4790") TargetUserName IN ("Account Operators", "Administrators", "Admins DNS", "Backup Operators", "DnsAdmins", "Domain Admins", "Enterprise Admins", "Enterprise Key Admins", "ESX Admins", "ESXi Admins", "Group Policy Creator Owners", "Hyper-V Administrators", "Key Admins", "Print Operators", "Remote Desktop Users", "Remote Management Users", "Replicators", "Schema Admins", "Server Operators") | eval SubjectUserName=SubjectUserName, EventCodeDescription=EventCodeDescription, src_user=src_user, object=object, object_category=object_category, change_type=change_type | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_privileged_group_modification_filter`
+how_to_implement: To successfully implement this search, ensure that Windows Security Event logging is enabled and being ingested into Splunk, particularly for event codes 4727, 4730, and 4737. Configure Group Policy settings to audit these specific events.
+known_false_positives: Legitimate administrators might create, delete, or modify an a privileged group for valid reasons. Verify that the group changes are authorized and part of normal administrative tasks. Consider the context of the action, such as the user performing it and any related activities.
 references:
     - https://nvd.nist.gov/vuln/detail/CVE-2024-37085
     - https://www.rapid7.com/blog/post/2024/07/30/vmware-esxi-cve-2024-37085-targeted-in-ransomware-campaigns/%5C
@@ -93,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A privileged group modification was detected. Group "$object$" ($object_category$) was $change_type$ on $dest$ by user $src_user$.
     entity:
diff --git a/detections/endpoint/windows_process_accessing_ironlanguages_repository_on_github.yml b/detections/endpoint/windows_process_accessing_ironlanguages_repository_on_github.yml
index fa994a611a1..4e150ac8348 100644
--- a/detections/endpoint/windows_process_accessing_ironlanguages_repository_on_github.yml
+++ b/detections/endpoint/windows_process_accessing_ironlanguages_repository_on_github.yml
@@ -6,48 +6,33 @@ modification_date: '2026-09-16'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies a process command line referencing the IronLanguages GitHub repository, which hosts .NET implementation of popular scripting engines.
+description: 'The following analytic identifies a process command line referencing the IronLanguages GitHub repository, which hosts .NET implementation of popular scripting engines.
+
     Adversaries have downloaded these .NET implementations to avoid getting detected by security controls while executing their payloads.
-    This activity is uncommon in typical enterprise environments outside of software development contexts.
+
+    This activity is uncommon in typical enterprise environments outside of software development contexts.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    FROM datamodel=Endpoint.Processes WHERE
-
-    Processes.process="*/ironlanguages/*"
-    Processes.process="*github.com*"
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*/ironlanguages/*" Processes.process="*github.com*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_accessing_ironlanguages_repository_on_github_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents
 
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user Processes.user_id
-       Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_process_accessing_ironlanguages_repository_on_github_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents
     are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement
+
     this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally,
+
     you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk
+
     Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node
+
     of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and
-    speed up the data modeling process.
-known_false_positives: |-
-    Software developers or DevOps personnel may legitimately clone or download the IronPython repository from GitHub for development purposes.
-    Filter as needed based on known developer hosts or users in your environment.
+
+    speed up the data modeling process.'
+known_false_positives: 'Software developers or DevOps personnel may legitimately clone or download the IronPython repository from GitHub for development purposes.
+
+    Filter as needed based on known developer hosts or users in your environment.'
 references:
     - https://packetwatch.com/resources/threat-profile/clickfix-abuses-finger-to-deliver-castleloader
     - https://github.com/IronLanguages/ironpython3
diff --git a/detections/endpoint/windows_process_accessing_windows_recall_directory.yml b/detections/endpoint/windows_process_accessing_windows_recall_directory.yml
index c883a6cb6a8..daa7e735838 100644
--- a/detections/endpoint/windows_process_accessing_windows_recall_directory.yml
+++ b/detections/endpoint/windows_process_accessing_windows_recall_directory.yml
@@ -6,35 +6,21 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    This detection triggers on a process accessing the Windows Recall directory.
-    Recall is a new feature Microsoft release that takes screenshots every 5 or so seconds to provide context to it's AI features.
+description: 'This detection triggers on a process accessing the Windows Recall directory.
+
+    Recall is a new feature Microsoft release that takes screenshots every 5 or so seconds to provide context to it''s AI features.
+
     The initial release of Recall was lacking in the security department due to it being trivial to view and steal the data.
-    Due to this lack of security it's likely that info stealer malware will take advantage of this new feature.
+
+    Due to this lack of security it''s likely that info stealer malware will take advantage of this new feature.
+
     Microsoft has recognized the security issues with Recall and is planning on making improvements.
-    Once those improvements are released we will re-assess this detection to make sure it is still relevant.
+
+    Once those improvements are released we will re-assess this detection to make sure it is still relevant.'
 data_source:
     - Windows Event Log Security 4663
-search: |-
-    `wineventlog_security`
-    AccessList="%%4416"
-    EventID="4663"
-    ObjectName="*CoreAIPlatform.00\\UKP*"
-    NOT (
-        ProcessName IN (
-            "*aixhost.exe",
-            "*aihost.exe"
-        )
-    )
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer EventID AccessList ObjectName ProcessName
-
-    | rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_process_accessing_windows_recall_directory_filter`
+search: |
+    `wineventlog_security` EventCode=4663 AccessList="%%4416" ObjectName="*CoreAIPlatform.00\\UKP*" NOT (ProcessName IN ("*aixhost.exe", "*aihost.exe")) | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_accessing_windows_recall_directory_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate system processes and trusted applications may access the Windows Recall directory for AI-related features. Review and allow access for approved software as needed.
 references:
@@ -48,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_process_commandline_discovery.yml b/detections/endpoint/windows_process_commandline_discovery.yml
index 53678c69884..4eb9c4026d1 100644
--- a/detections/endpoint/windows_process_commandline_discovery.yml
+++ b/detections/endpoint/windows_process_commandline_discovery.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_wmic` Processes.process= "* process *" Processes.process= "* get *" Processes.process= "*CommandLine*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_process_commandline_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process="* process *" Processes.process="* get *" Processes.process="*CommandLine*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_commandline_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_process_executed_from_removable_media.yml b/detections/endpoint/windows_process_executed_from_removable_media.yml
index 6e1cad901ab..f9b94f871c0 100644
--- a/detections/endpoint/windows_process_executed_from_removable_media.yml
+++ b/detections/endpoint/windows_process_executed_from_removable_media.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This analytic is used to identify when a removable media device is attached to a machine and then a process is executed from the same drive letter assigned to the removable media device. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 13
-search: |-
+search: |
     | tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
       WHERE Processes.process_current_directory=*
         AND
@@ -53,7 +53,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$" , "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate USB events on $dest$
       search: '| from datamodel:Endpoint.Processes | search dest=$dest$ process_current_directory=$object_handle$*'
       earliest_offset: $info_min_time$
diff --git a/detections/endpoint/windows_process_execution_from_programdata.yml b/detections/endpoint/windows_process_execution_from_programdata.yml
index b854063e079..5f3d60d3a1c 100644
--- a/detections/endpoint/windows_process_execution_from_programdata.yml
+++ b/detections/endpoint/windows_process_execution_from_programdata.yml
@@ -6,36 +6,29 @@ modification_date: '2026-06-08'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
-description: |
-    The following analytic identifies processes running from file paths within
+description: 'The following analytic identifies processes running from file paths within
+
     the ProgramData directory, a common location abused by adversaries for executing
+
     malicious code while evading detection. Threat actors often drop and execute payloads
+
     from this directory to bypass security controls, as it typically has write permissions
+
     for standard users. While this behavior can indicate malware execution or persistence
+
     techniques, it is important to note that some legitimate software, installers, and
+
     update mechanisms also run from ProgramData, leading to potential false positives.
+
     Security teams should validate detections by correlating with other indicators,
-    such as unusual parent processes, unsigned binaries, or anomalous network activity.
+
+    such as unusual parent processes, unsigned binaries, or anomalous network activity.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count values(Processes.process_name)
-    as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-
-    Processes.process_path = "*:\\ProgramData\\*"
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_process_execution_from_programdata_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path="*:\\ProgramData\\*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_execution_from_programdata_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may allow execution of specific binaries in non-standard paths. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_process_execution_from_rdp_share.yml b/detections/endpoint/windows_process_execution_from_rdp_share.yml
index 82beeaa58aa..da6e38df240 100644
--- a/detections/endpoint/windows_process_execution_from_rdp_share.yml
+++ b/detections/endpoint/windows_process_execution_from_rdp_share.yml
@@ -6,49 +6,41 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic identifies process executions originating from RDP shares on Windows endpoints.
+description: 'The following analytic identifies process executions originating from RDP shares on Windows endpoints.
+
     Remote Desktop Protocol (RDP) shares, typically accessed via the "tsclient" path, allow users to share files between their local machine and a remote desktop session. However, threat actors may exploit RDP shares to execute malicious processes or transfer harmful files onto a compromised system.
+
     This detection focuses on identifying any process executions that originate from RDP shares, which could indicate unauthorized access or malicious activity.
-    Security teams should investigate any instances of such process executions, especially if they are found on systems that should not be using RDP shares or if the executed processes are unfamiliar or suspicious.
+
+    Security teams should investigate any instances of such process executions, especially if they are found on systems that should not be using RDP shares or if the executed processes are unfamiliar or suspicious.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-
-      count min(_time) as firstTime
-            max(_time) as lastTime
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\\tsclient\\*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_execution_from_rdp_share_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-    from datamodel=Endpoint.Processes where
-
-    Processes.process = "*\\\\tsclient\\*"
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_process_execution_from_rdp_share_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    Legitimate use of RDP shares by users to transfer and execute files may trigger
+
+    names and speed up the data modeling process.'
+known_false_positives: 'Legitimate use of RDP shares by users to transfer and execute files may trigger
+
     this detection. It is essential to review the context of the process execution
-    to determine if it is authorized activity.
+
+    to determine if it is authorized activity.'
 references:
     - https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_7_hara_shoji_higashi_vickie-su_nick-dai_en.pdf
     - https://thedfirreport.com/2020/04/04/gogoogle-ransomware/
@@ -61,7 +53,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_process_execution_in_temp_dir.yml b/detections/endpoint/windows_process_execution_in_temp_dir.yml
index 3d7554e0a29..efccef52ae3 100644
--- a/detections/endpoint/windows_process_execution_in_temp_dir.yml
+++ b/detections/endpoint/windows_process_execution_in_temp_dir.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path IN("*\\temp\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_execution_in_temp_dir_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path="*\\temp\\*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_execution_in_temp_dir_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may allow execution of specific binaries in non-standard paths. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_process_injection_in_non_service_searchindexer.yml b/detections/endpoint/windows_process_injection_in_non_service_searchindexer.yml
index f99eba7496c..27426dea43d 100644
--- a/detections/endpoint/windows_process_injection_in_non_service_searchindexer.yml
+++ b/detections/endpoint/windows_process_injection_in_non_service_searchindexer.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name != services.exe Processes.process_name=searchindexer.exe
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_process_injection_in_non_service_searchindexer_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.parent_process_name="*services.exe" Processes.process_name="*searchindexer.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_in_non_service_searchindexer_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An uncommon non-service searchindexer.exe process on $dest$
     entity:
diff --git a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml
index 0883c32e6b0..37baa3fe86f 100644
--- a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml
+++ b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml
@@ -6,14 +6,16 @@ modification_date: '2026-09-08'
 author: 0xC0FFEEEE, Github Community
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects potential process injection attempts into executables that are commonly abused leveraging Sysmon EventCode 10.
+description: 'The following analytic detects potential process injection attempts into executables that are commonly abused leveraging Sysmon EventCode 10.
+
     It identifies Access Mask requests (0x40 and 0x1fffff) to processes such as notepad.exe, wordpad.exe and calc.exe, excluding common system paths like System32, Syswow64, and Program Files.
+
     This activity was associated with the SliverC2 framework by BishopFox.
-    Monitoring this activity may indicate an initial payload attempting to execute malicious code.
+
+    Monitoring this activity may indicate an initial payload attempting to execute malicious code.'
 data_source:
     - Sysmon EventID 10
-search: |-
+search: |
     `sysmon`
     EventCode=10
     TargetImage IN (
@@ -81,7 +83,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml
index 3a06b8b7ed5..ba96979c106 100644
--- a/detections/endpoint/windows_process_injection_remote_thread.yml
+++ b/detections/endpoint/windows_process_injection_remote_thread.yml
@@ -6,42 +6,11 @@ modification_date: '2026-08-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects suspicious remote thread execution in processes such as Taskmgr.exe, calc.exe, and notepad.exe, which may indicate process injection by malware like Qakbot. This detection leverages Sysmon EventCode 8 to identify remote thread creation in specific target processes. This activity is significant as it often signifies an attempt by malware to inject malicious code into legitimate processes, potentially leading to unauthorized code execution. If confirmed malicious, this could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence on the compromised host.
+description: The following analytic detects suspicious remote thread execution in processes such as Taskmgr.exe, calc.exe, and notepad.exe, which may indicate process injection by malware like Qakbot. This detection leverages Sysmon EventCode 8 to identify remote thread creation in specific target processes. This activity is significant as it often signifies an attempt by malware to inject malicious code into legitimate processes, potentially leading to unauthorized code execution. If confirmed malicious, this could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence on the compromised host.
 data_source:
     - Sysmon EventID 8
-search: |-
-    `sysmon`
-    EventCode=8
-    TargetImage IN (
-        "*\\calc.exe",
-        "*\\CalculatorApp.exe",
-        "*\\cmd.exe",
-        "*\\dxdiag.exe",
-        "*\\explorer.exe",
-        "*\\mobsync.exe",
-        "*\\msra.exe",
-        "*\\notepad.exe",
-        "*\\OneDriveSetup.exe",
-        "*\\ping.exe",
-        "*\\powershell.exe",
-        "*\\rdpclip.exe",
-        "*\\Taskmgr.exe",
-        "*\\wermgr.exe",
-        "*\\win32calc.exe",
-        "*\\xwizard.exe"
-    )
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-                  values(NewThreadId) as "NewThreadId"
-                  values(StartAddress) as "StartAddress"
-      by dest signature_id signature
-         SourceProcessGuid SourceProcessId SourceImage
-         TargetProcessGuid TargetProcessId TargetImage
-         StartModule StartFunction vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_process_injection_remote_thread_filter`
+search: |
+    `sysmon` EventCode=8 TargetImage IN ("*\\calc.exe", "*\\CalculatorApp.exe", "*\\cmd.exe", "*\\dxdiag.exe", "*\\explorer.exe", "*\\mobsync.exe", "*\\msra.exe", "*\\notepad.exe", "*\\OneDriveSetup.exe", "*\\ping.exe", "*\\powershell.exe", "*\\rdpclip.exe", "*\\Taskmgr.exe", "*\\wermgr.exe", "*\\win32calc.exe", "*\\xwizard.exe") | stats count min(_time) as firstTime max(_time) as lastTime by dest signature_id signature SourceProcessGuid SourceProcessId SourceImage TargetProcessGuid TargetProcessId TargetImage StartModule StartFunction SourceUser TargetUser vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_remote_thread_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts like remote thread EventCode=8 of sysmon. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -55,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: process $SourceImage$ created a remote thread in target process $TargetImage$ on host $dest$
     entity:
diff --git a/detections/endpoint/windows_process_injection_wermgr_child_process.yml b/detections/endpoint/windows_process_injection_wermgr_child_process.yml
index 14dce5c439f..2333d5d06bf 100644
--- a/detections/endpoint/windows_process_injection_wermgr_child_process.yml
+++ b/detections/endpoint/windows_process_injection_wermgr_child_process.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name = "wermgr.exe"
-        AND
-        NOT (Processes.process_name IN ("WerFaultSecure.exe", "wermgr.exe", "WerFault.exe"))
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_process_injection_wermgr_child_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*wermgr.exe" NOT (Processes.process_name IN ("*WerFaultSecure.exe", "*wermgr.exe", "*WerFault.exe")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_wermgr_child_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -39,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml
index 236b6b47f3e..daec5bca8d7 100644
--- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml
+++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml
@@ -6,53 +6,19 @@ modification_date: '2026-07-08'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects processes with command lines containing named pipes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line executions.
+description: 'The following analytic detects processes with command lines containing named pipes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line executions.
+
     This behavior is significant as it is often used by adversaries, such as those behind the Olympic Destroyer malware, for inter-process communication post-injection, aiding in defense evasion and privilege escalation.
-    If confirmed malicious, this activity could allow attackers to maintain persistence, escalate privileges, or evade defenses, potentially leading to further compromise of the system.
+
+    If confirmed malicious, this activity could allow attackers to maintain persistence, escalate privileges, or evade defenses, potentially leading to further compromise of the system.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process = "*\\\\.\\pipe\\*"
-    (
-        NOT Processes.parent_process_path IN (
-            "*:\\Program Files (x86)\\*",
-            "*:\\Program Files\\*",
-            "*:\\Windows\\System32\\*",
-            "*:\\Windows\\SysWOW64\\*"
-        )
-        OR
-        NOT Processes.process_path IN (
-            "*:\\Program Files (x86)\\*",
-            "*:\\Program Files\\*",
-            "*:\\Windows\\System32\\*",
-            "*:\\Windows\\SysWOW64\\*"
-        )
-    )
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process
-       Processes.process_exec Processes.process_guid Processes.process_hash
-       Processes.process_id Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_process_with_namedpipe_commandline_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Normal browser application may use this technique. Please update the filter macros to remove false positives.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\\.\\pipe\\*" NOT (Processes.process_path IN ("*:\\Program Files (x86)\\*", "*:\\Program Files\\*", "*\\system32\\*", "*\\syswow64\\*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_with_namedpipe_commandline_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Normal browser application may use this technique. Please update the filter macros to remove false positives.
 references:
     - https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
 drilldown_searches:
@@ -63,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_process_with_netexec_command_line_parameters.yml b/detections/endpoint/windows_process_with_netexec_command_line_parameters.yml
index 75176e3ac53..dd81daedb11 100644
--- a/detections/endpoint/windows_process_with_netexec_command_line_parameters.yml
+++ b/detections/endpoint/windows_process_with_netexec_command_line_parameters.yml
@@ -11,30 +11,8 @@ data_source:
     - Windows Event Log Security 4688
     - Sysmon EventID 1
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes
-      WHERE NOT Processes.os="Linux" Processes.process_name IN ("nxc.exe")
-        OR
-        Processes.original_file_name IN ("nxc.exe")
-        OR
-        (Processes.process IN ("* smb *","* ssh *","* ldap *","* ftp *","* wmi *","* winrm *","* rdp *","* vnc *","* mssql *","* nfs *")
-        AND
-        ((Processes.process = "* -p *"
-        AND
-        Processes.process = "* -u *")
-        OR
-        Processes.process IN ("* -x *","* -M *","* --*")))
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_process_with_netexec_command_line_parameters_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*nxc.exe" OR (Processes.process IN ("* smb *", "* ssh *", "* ldap *", "* ftp *", "* wmi *", "* winrm *", "* rdp *", "* vnc *", "* mssql *", "* nfs *") Processes.process="* -p *" Processes.process IN ("* -u *", "* -x *", "* -M *", "* --*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_with_netexec_command_line_parameters_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, legitimate applications may use the same command line parameters as NetExec. Filter as needed.
 references:
@@ -49,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate processes on $dest$
       search: '| from datamodel:Endpoint.Processes | search dest=$dest$ process_name = $process_name$'
       earliest_offset: $info_min_time$
diff --git a/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml b/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml
index f0c2545331d..b1eadd19acb 100644
--- a/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml
+++ b/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic identifies a process writing a .txt file to a world writable path. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on file creation events within specific directories. This activity is significant as adversaries often use such techniques to deliver payloads to a system, which is uncommon for legitimate processes. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
 data_source:
     - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name=*.txt Filesystem.file_path IN ("*\\Windows\\Tasks\\*", "*\\Windows\\Temp\\*", "*\\Windows\\tracing\\*", "*\\Windows\\PLA\\Reports\\*", "*\\Windows\\PLA\\Rules\\*", "*\\Windows\\PLA\\Templates\\*", "*\\Windows\\PLA\\Reports\\en-US\\*", "*\\Windows\\PLA\\Rules\\en-US\\*", "*\\Windows\\Registration\\CRMLog\\*", "*\\Windows\\System32\\Tasks\\*", "*\\Windows\\System32\\Com\\dmp\\*", "*\\Windows\\System32\\LogFiles\\WMI\\*", "*\\Windows\\System32\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", "*\\Windows\\System32\\spool\\PRINTERS\\*", "*\\Windows\\System32\\spool\\SERVERS\\*", "*\\Windows\\System32\\spool\\drivers\\color\\*", "*\\Windows\\System32\\Tasks\\Microsoft\\Windows\\RemoteApp and Desktop Connections Update\\*", "*\\Windows\\SysWOW64\\Tasks\\*", "*\\Windows\\SysWOW64\\Com\\dmp\\*", "*\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\PLA\\*", "*\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\RemoteApp and Desktop Connections Update\\*", "*\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\PLA\\System\\*") by Filesystem.dest, Filesystem.user, Filesystem.file_name Filesystem.file_path | `drop_dm_object_name("Filesystem")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_writing_file_to_world_writable_path_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.txt" Filesystem.file_path IN ("*\\Windows\\Tasks\\*", "*\\Windows\\Temp\\*", "*\\Windows\\tracing\\*", "*\\Windows\\PLA\\Reports\\*", "*\\Windows\\PLA\\Rules\\*", "*\\Windows\\PLA\\Templates\\*", "*\\Windows\\PLA\\Reports\\en-US\\*", "*\\Windows\\PLA\\Rules\\en-US\\*", "*\\Windows\\Registration\\CRMLog\\*", "*\\system32\\*", "*\\syswow64\\*") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_writing_file_to_world_writable_path_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file creation event, process name, file path and, file name. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may occur if legitimate software writes to these paths. Modify the search to include additional file name extensions. To enhance it further, adding a join on Processes.process_name may assist with restricting the analytic to specific process names. Investigate the process and file to determine if it is malicious.
 references:
@@ -31,6 +32,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/mshta_tasks_windows-sysmon.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml
index b63dcd7aab5..e116619e6a7 100644
--- a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml
+++ b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects the termination of specific processes by the Industroyer2 malware. It leverages Sysmon EventCode 5 to identify when processes like "PServiceControl.exe" and "PService_PPD.exe" are killed. This activity is significant as it targets processes related to energy facility networks, indicating a potential attack on critical infrastructure. If confirmed malicious, this could lead to disruption of essential services, loss of control over energy systems, and significant operational impact. Immediate investigation is required to determine the cause and mitigate any potential threats.
 data_source:
     - Sysmon EventID 5
-search: |-
-    `sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe")
-      | stats min(_time) as firstTime max(_time) as lastTime count
-        BY dest process process_exec
-           process_guid process_id process_name
-           process_path signature signature_id
-           user_id vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_processes_killed_by_industroyer2_malware_filter`
+search: |
+    `sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe") | stats count min(_time) as firstTime max(_time) as lastTime by dest process process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_processes_killed_by_industroyer2_malware_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
 known_false_positives: False positives are possible if legitimate applications are allowed to terminate this process during testing or updates. Filter as needed based on paths that are used legitimately.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_product_key_registry_query.yml b/detections/endpoint/windows_product_key_registry_query.yml
index ff70f4b0c1f..239e8de9d20 100644
--- a/detections/endpoint/windows_product_key_registry_query.yml
+++ b/detections/endpoint/windows_product_key_registry_query.yml
@@ -6,25 +6,15 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    This Analytic detects the execution of a process attempting to access the registry for product key recovery purposes.
-    This behavior could be significant as it might indicate potential malware activity or attempts to bypass security measures or data exfiltration.
+description: 'This Analytic detects the execution of a process attempting to access the registry for product key recovery purposes.
+
+    This behavior could be significant as it might indicate potential malware activity or attempts to bypass security measures or data exfiltration.'
 data_source:
     - Windows Event Log Security 4663
-search: |-
-    `wineventlog_security`
-    EventCode=4663
-    object_file_path="*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform"
-    | stats count min(_time) as firstTime max(_time) as lastTime
-        by object_file_name object_file_path process_name
-           process_path process_id EventCode dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_product_key_registry_query_filter`
-how_to_implement: |
-    To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." This search may trigger on a browser application that is not included in the browser_app_list lookup file.
-known_false_positives: |
-    Administrator may access this registry for product key recovery purposes.
+search: |
+    `wineventlog_security` EventCode=4663 object_file_path="*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform" | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_product_key_registry_query_filter`
+how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." This search may trigger on a browser application that is not included in the browser_app_list lookup file.
+known_false_positives: Administrator may access this registry for product key recovery purposes.
 references:
     - https://malpedia.caad.fkie.fraunhofer.de/details/py.blankgrabber
 drilldown_searches:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_protocol_tunneling_with_plink.yml b/detections/endpoint/windows_protocol_tunneling_with_plink.yml
index 69a55684cdf..b56f9d2125c 100644
--- a/detections/endpoint/windows_protocol_tunneling_with_plink.yml
+++ b/detections/endpoint/windows_protocol_tunneling_with_plink.yml
@@ -11,27 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=plink.exe
-            OR
-            Processes.process_name=pvhost.exe
-            OR
-            Processes.original_file_name=Plink
-        )
-        AND Processes.process IN ("*-R *", "*-L *", "*-D *", "*-l *", "*-N *", "*-P *", "*-pw *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_protocol_tunneling_with_plink_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*plink.exe", "*pvhost.exe") OR Processes.original_file_name="Plink" Processes.process IN ("*-R *", "*-L *", "*-D *", "*-N *", "*-P *", "*-pw *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_protocol_tunneling_with_plink_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present if the organization allows for SSH tunneling outbound or internally. Filter as needed.
 references:
@@ -49,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to tunnel to a remote destination.
     entity:
diff --git a/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml b/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml
index c8fcafe4e29..04d7ba63142 100644
--- a/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml
+++ b/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml
@@ -6,58 +6,13 @@ modification_date: '2026-10-09'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the launch of common .NET-related utilities—aspnet_compiler.exe, msbuild.exe, regasm.exe, InstallUtil.exe, or vbc.exe when the parent appears to be a script (batch, CMD, PowerShell, JScript, VBScript, or HTML) running from an unusual or user-writable Windows location (for example Public, Temp, Fonts, Debug, Recycle Bin, Prefetch, or similar paths), and the child process shows little or no command-line variation from the image path or name.
-    That pattern is consistent with adversaries using trusted .NET binaries as a proxy to run code while hiding execution behind script parents in low-trust folders, behavior associated with techniques such as signed binary proxy execution.
+description: 'The following analytic detects the launch of common .NET-related utilities—aspnet_compiler.exe, msbuild.exe, regasm.exe, InstallUtil.exe, or vbc.exe when the parent appears to be a script (batch, CMD, PowerShell, JScript, VBScript, or HTML) running from an unusual or user-writable Windows location (for example Public, Temp, Fonts, Debug, Recycle Bin, Prefetch, or similar paths), and the child process shows little or no command-line variation from the image path or name.
+
+    That pattern is consistent with adversaries using trusted .NET binaries as a proxy to run code while hiding execution behind script parents in low-trust folders, behavior associated with techniques such as signed binary proxy execution.'
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_name IN (
-        "aspnet_compiler.exe",
-        "InstallUtil.exe",
-        "msbuild.exe",
-        "regasm.exe",
-        "vbc.exe",
-    )
-    Processes.parent_process IN (
-        "*.bat*",
-        "*.cmd*",
-        "*.html*",
-        "*.js*",
-        "*.ps1*",
-        "*.vbe*",
-        "*.vbs*"
-    )
-    Processes.parent_process IN (
-        ":\\Windows\\repair\\*",
-        "*:\\Microsoft\\Windows\\Libraries\\*",
-        "*:\\Temp\\*",
-        "*:\\Users\\Administrator\\Music\\*",
-        "*:\\Users\\Public\\*",
-        "*:\\Windows\\Cursors\\*",
-        "*:\\Windows\\debug\\*",
-        "*:\\Windows\\Fonts\\*",
-        "*:\\Windows\\INF\\*",
-        "*:\\Windows\\Media\\*",
-        "*:\\Windows\\Prefetch\\*",
-        "*:\\Windows\\Temp\\*",
-        "*\\AppData\\Local\\Temp\\*",
-        "*\\PerfLogs\\*",
-        "*Recycle.bin*"
-      )
-      by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-
-      | where (isnull(Processes.process) OR Processes.process=Processes.process_path OR Processes.process=Processes.process_name)
-
-      | `drop_dm_object_name(Processes)`
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_proxy_execution_of__net_utilities_via_scripts_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*aspnet_compiler.exe", "*InstallUtil.exe", "*msbuild.exe", "*regasm.exe", "*vbc.exe") Processes.parent_process IN ("*.bat*", "*.cmd*", "*.html*", "*.js*", "*.ps1*", "*.vbe*", "*.vbs*") Processes.parent_process IN (":\\Windows\\repair\\*", ":\\Microsoft\\Windows\\Libraries\\*", ":\\Temp\\*", ":\\Users\\Administrator\\Music\\*", ":\\Users\\Public\\*", ":\\Windows\\Cursors\\*", ":\\Windows\\debug\\*", ":\\Windows\\Fonts\\*", ":\\Windows\\INF\\*", ":\\Windows\\Media\\*", ":\\Windows\\Prefetch\\*", ":\\Windows\\Temp\\*", "\\AppData\\Local\\Temp\\*", "\\PerfLogs\\*", "Recycle.bin*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_proxy_execution_of__net_utilities_via_scripts_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/endpoint/windows_proxy_via_netsh.yml b/detections/endpoint/windows_proxy_via_netsh.yml
index 1d1515e80c4..5dd102b1701 100644
--- a/detections/endpoint/windows_proxy_via_netsh.yml
+++ b/detections/endpoint/windows_proxy_via_netsh.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_netsh` Processes.process = "* portproxy *" Processes.process = "* v4tov4 *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_proxy_via_netsh_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*netsh.exe" OR Processes.original_file_name="netsh.exe" Processes.process="* portproxy *" Processes.process="* v4tov4 *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_proxy_via_netsh_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some VPN applications are known to launch netsh.exe. Outside of these instances, it is unusual for an executable to launch netsh.exe and run commands.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_proxy_via_registry.yml b/detections/endpoint/windows_proxy_via_registry.yml
index 11bd729a263..7efecfa886a 100644
--- a/detections/endpoint/windows_proxy_via_registry.yml
+++ b/detections/endpoint/windows_proxy_via_registry.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the modification of registry keys related to the Windows Proxy settings via netsh.exe. It leverages data from the Endpoint.Registry data model, focusing on changes to the registry path "*\\System\\CurrentControlSet\\Services\\PortProxy\\v4tov4\\tcp*". This activity is significant because netsh.exe can be used to establish a persistent proxy, potentially allowing an attacker to execute a helper DLL whenever netsh.exe runs. If confirmed malicious, this could enable the attacker to maintain persistence, manipulate network configurations, and potentially exfiltrate data or further compromise the system.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\System\\CurrentControlSet\\Services\\PortProxy\\v4tov4\\tcp*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_proxy_via_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Services\\PortProxy\\v4tov4\\tcp*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_proxy_via_registry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_pstools_recon_usage.yml b/detections/endpoint/windows_pstools_recon_usage.yml
index b5ccfdad2fe..dcc66711c2e 100644
--- a/detections/endpoint/windows_pstools_recon_usage.yml
+++ b/detections/endpoint/windows_pstools_recon_usage.yml
@@ -6,78 +6,43 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali
 status: production
 type: Anomaly
-description: |
-    The following analytic identifies execution of Sysinternals PsTools and Sysinternals Suit binaries that are commonly used for reconnaissance and information gathering on
+description: 'The following analytic identifies execution of Sysinternals PsTools and Sysinternals Suit binaries that are commonly used for reconnaissance and information gathering on
+
     Windows endpoints.
+
     PsTools (PsExec, PsFile, PsGetSid, PsInfo, PsPing, etc.) or Sysinternals Suit tools, are frequently used by administrators for legitimate maintenance but are also leveraged by threat actors to collect system, account, network and service information during discovery and lateral movement.
+
     This detection focuses on process execution and PE metadata telemetry (OriginalFileName).
-    If confirmed malicious, this activity can indicate targeted reconnaissance and foothold escalation, enabling subsequent lateral movement or credential abuse.
+
+    If confirmed malicious, this activity can indicate targeted reconnaissance and foothold escalation, enabling subsequent lateral movement or credential abuse.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*PsGetsid.exe", "*PsGetsid64.exe", "*PsInfo.exe", "*PsInfo64.exe", "*pslist.exe", "*pslist64.exe", "*PsLoggedon.exe", "*PsLoggedon64.exe", "*psloglist.exe", "*psloglist64.exe", "*PsPing.exe", "*PsPing64.exe", "*PsService.exe", "*PsService64.exe", "*Tcpvcon.exe", "*Tcpvcon64.exe", "*Tcpvcon64a.exe") OR Processes.original_file_name IN ("PsGetSid.exe", "Psinfo.exe", "pslist.exe", "psloggedon.exe", "psloglist.exe", "psping.exe", "psservice.exe", "Tcpvcon.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_pstools_recon_usage_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-      from datamodel=Endpoint.Processes where
-
-      Processes.process_name IN (
-          "PsGetsid.exe",
-          "PsGetsid64.exe",
-          "PsInfo.exe",
-          "PsInfo64.exe",
-          "pslist.exe",
-          "pslist64.exe",
-          "PsLoggedon.exe",
-          "PsLoggedon64.exe",
-          "psloglist.exe",
-          "psloglist64.exe",
-          "PsPing.exe",
-          "PsPing64.exe",
-          "PsService.exe",
-          "PsService64.exe",
-          "Tcpvcon.exe",
-          "Tcpvcon64.exe",
-          "Tcpvcon64a.exe"
-      )
-      OR
-      Processes.original_file_name IN (
-          "PsGetSid.exe",
-          "Psinfo.exe",
-          "pslist.exe",
-          "psloggedon.exe",
-          "psloglist.exe",
-          "psping.exe",
-          "psservice.exe",
-          "Tcpvcon.exe"
-      )
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id
-       Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_pstools_recon_usage_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    Legitimate administrators commonly use PsTools for troubleshooting and management.
+
+    names and speed up the data modeling process.'
+known_false_positives: 'Legitimate administrators commonly use PsTools for troubleshooting and management.
+
     False positives are likely in environments where PsTools are an approved operational toolset, or where automated management systems invoke them.
-    Tune by whitelisting approved management hosts, service accounts, and scheduled maintenance windows.
+
+    Tune by whitelisting approved management hosts, service accounts, and scheduled maintenance windows.'
 references:
     - https://learn.microsoft.com/sysinternals/downloads/pstools
     - https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/raw/master/2015/2015.09.17.Operation_Iron_Tiger/wp-operation-iron-tiger.pdf
@@ -90,7 +55,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_pua_named_pipe.yml b/detections/endpoint/windows_pua_named_pipe.yml
index 68a592e092c..4d87936bab9 100644
--- a/detections/endpoint/windows_pua_named_pipe.yml
+++ b/detections/endpoint/windows_pua_named_pipe.yml
@@ -6,10 +6,11 @@ modification_date: '2026-09-22'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the creation or connection to named pipes  used by potentially unwanted applications (PUAs) like VPNs or utilities like PsExec.
+description: 'The following analytic detects the creation or connection to named pipes  used by potentially unwanted applications (PUAs) like VPNs or utilities like PsExec.
+
     It leverages Sysmon EventCodes 17 and 18.
-    If confirmed malicious, this could allow an attacker to abuse these to potentially gain persistence, command and control, or further system compromise.
+
+    If confirmed malicious, this could allow an attacker to abuse these to potentially gain persistence, command and control, or further system compromise.'
 data_source:
     - Sysmon EventID 17
     - Sysmon EventID 18
@@ -43,13 +44,14 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_pua_named_pipe_filter`
-how_to_implement: |
-    To successfully implement this search, you need to be ingesting
+how_to_implement: 'To successfully implement this search, you need to be ingesting
+
     logs with the process name and pipename from your endpoints. If you are using Sysmon,
-    you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: |
-    PUAs can be used in a legitimate manner. Therefore, some of the named pipes identified and added may cause false positives.
-    Filter by process name or pipe name to reduce false positives.
+
+    you must have at least version 6.0.4 of the Sysmon TA.'
+known_false_positives: 'PUAs can be used in a legitimate manner. Therefore, some of the named pipes identified and added may cause false positives.
+
+    Filter by process name or pipe name to reduce false positives.'
 references:
     - https://attack.mitre.org/techniques/T1218/009/
     - https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes
@@ -61,7 +63,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_putty_suite_utility_execution.yml b/detections/endpoint/windows_putty_suite_utility_execution.yml
index 67e7e6a8f6a..2875c5c15fc 100644
--- a/detections/endpoint/windows_putty_suite_utility_execution.yml
+++ b/detections/endpoint/windows_putty_suite_utility_execution.yml
@@ -6,55 +6,20 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic detects the execution of programs associated with the PuTTY SSH client suite, including putty.exe, pscp.exe, plink.exe, psftp.exe, and puttygen.exe.
+description: 'This analytic detects the execution of programs associated with the PuTTY SSH client suite, including putty.exe, pscp.exe, plink.exe, psftp.exe, and puttygen.exe.
+
     This activity is significant because these tools can be used to establish unauthorized remote connections, transfer files, or execute commands on remote systems.
-    If identified in an unusual context, such as non-administrative accounts or unexpected systems, it may indicate attempts to bypass security controls, perform lateral movement, or exfiltrate data, which could lead to further network compromise.
+
+    If identified in an unusual context, such as non-administrative accounts or unexpected systems, it may indicate attempts to bypass security controls, perform lateral movement, or exfiltrate data, which could lead to further network compromise.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    (
-        Processes.process_name IN (
-            "putty.exe",
-            "pscp.exe",
-            "plink.exe",
-            "psftp.exe",
-            "puttygen.exe"
-        )
-        OR
-        Processes.original_file_name IN (
-            "PuTTY",
-            "PSCP",
-            "Plink",
-            "PSFTP",
-            "PuTTYgen"
-        )
-    )
-
-    by Processes.process Processes.vendor_product Processes.user_id
-       Processes.process_hash Processes.parent_process_name
-       Processes.parent_process_exec Processes.action Processes.dest
-       Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name
-       Processes.parent_process Processes.parent_process_path
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id
-       Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_putty_suite_utility_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*putty.exe", "*pscp.exe", "*plink.exe", "*psftp.exe", "*puttygen.exe") OR Processes.original_file_name IN ("PuTTY", "PSCP", "Plink", "PSFTP", "PuTTYgen") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_putty_suite_utility_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate users may run PuTTY for remote administration or secure file transfers. Filter alerts to exclude approved administrative activities.
+references: []
 drilldown_searches:
     - earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
@@ -63,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_query_registry_browser_list_application.yml b/detections/endpoint/windows_query_registry_browser_list_application.yml
index edd2a2919fa..aefe963af62 100644
--- a/detections/endpoint/windows_query_registry_browser_list_application.yml
+++ b/detections/endpoint/windows_query_registry_browser_list_application.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects a suspicious process accessing the registry entries for default internet browsers. It leverages Windows Security Event logs, specifically event code 4663, to identify access attempts to these registry paths. This activity is significant because adversaries can exploit this registry key to gather information about installed browsers and their settings, potentially leading to the theft of sensitive data such as login credentials and browsing history. If confirmed malicious, this behavior could enable attackers to exfiltrate sensitive information and compromise user accounts.
 data_source:
     - Windows Event Log Security 4663
-search: '`wineventlog_security` EventCode=4663 object_file_path IN ("*\\SOFTWARE\\Clients\\StartMenuInternet\\*", "*\\SOFTWARE\\Clients\\StartMenuInternet\\*") AND NOT process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWow64\\*", *:\\Windows\\WinSxS\\*, "*:\\Program Files\\*", "*:\\Program Files (x86)\\*") | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_query_registry_browser_list_application_filter`'
+search: |
+    `wineventlog_security` EventCode=4663 object_file_path="*\\SOFTWARE\\Clients\\StartMenuInternet\\*" NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*", "*:\\Windows\\WinSxS\\*", "*:\\Program Files\\*", "*:\\Program Files (x86)\\*")) | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_query_registry_browser_list_application_filter`
 how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
 known_false_positives: uninstall application may access this registry to remove the entry of the target application. filter is needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_query_registry_uninstall_program_list.yml b/detections/endpoint/windows_query_registry_uninstall_program_list.yml
index d1ac45a9079..c0a2090d1c1 100644
--- a/detections/endpoint/windows_query_registry_uninstall_program_list.yml
+++ b/detections/endpoint/windows_query_registry_uninstall_program_list.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects an access request on the uninstall registry key. It leverages Windows Security Event logs, specifically event code 4663. This activity is significant because adversaries or malware can exploit this key to gather information about installed applications, aiding in further attacks. If confirmed malicious, this behavior could allow attackers to map out installed software, potentially identifying vulnerabilities or software to exploit, leading to further system compromise.
 data_source:
     - Windows Event Log Security 4663
-search: '`wineventlog_security` EventCode=4663 object_file_path="*\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*" | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_query_registry_uninstall_program_list_filter`'
+search: |
+    `wineventlog_security` EventCode=4663 object_file_path="*\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*" | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_query_registry_uninstall_program_list_filter`
 how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For Event code 4663, enable the "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
 known_false_positives: Uninstallers may access this registry to remove the entry of the target application. Filter as needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
index a22c45c5349..810cc102aaa 100644
--- a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
+++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=schtasks.exe Processes.process="*delete*"
-        AND
-        Processes.process="*Raccine*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_raccine_scheduled_task_deletion_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*schtasks.exe" Processes.process="*delete*" Processes.process="*Raccine*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited, however filter as needed.
 references:
@@ -40,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable Raccines scheduled task.
     entity:
diff --git a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml
index 6fbd01af6f5..5b17166a891 100644
--- a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml
+++ b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects a source computer authenticating to 30 or more remote endpoints within a 5-minute timespan using Event ID 4624. This behavior is identified by analyzing Windows Event Logs for LogonType 3 events and counting unique target computers. Such activity is significant as it may indicate lateral movement or network share enumeration by an adversary. If confirmed malicious, this could lead to unauthorized access to multiple systems, potentially compromising sensitive data and escalating privileges within the network.
 data_source:
     - Windows Event Log Security 4624
-search: |-
+search: |
     `wineventlog_security` EventCode=4624 LogonType=3 TargetUserName!="ANONYMOUS LOGON" TargetUserName!="*$"
       | bucket span=5m _time
       | stats dc(Computer) AS unique_targets values(Computer) as host_targets values(dest) as dest values(src) as src values(user) as user
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$host_targets$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host_targets$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The source computer with ip address $IpAddress$ authenticated to a large number of remote endpoints within 5 minutes.
     entity:
diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml
index d50be1e5a30..af74c854f1c 100644
--- a/detections/endpoint/windows_rasautou_dll_execution.yml
+++ b/detections/endpoint/windows_rasautou_dll_execution.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=rasautou.exe Processes.process="* -d *"AND Processes.process="* -p *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_rasautou_dll_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rasautou.exe" Processes.process="* -d *" Processes.process="* -p *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rasautou_dll_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
 references:
@@ -40,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner.
     entity:
diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml
index 98b31fd3c37..c4d40bc2530 100644
--- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml
+++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects suspicious raw access reads to the device disk partition of a host machine. It leverages Sysmon EventCode 9 logs to identify processes attempting to read or write to the boot sector, excluding legitimate system processes. This activity is significant as it is commonly associated with destructive actions by adversaries, such as wiping, encrypting, or overwriting the boot sector, as seen in attacks involving malware like HermeticWiper. If confirmed malicious, this behavior could lead to severe impacts, including system inoperability, data loss, or compromised boot integrity.
 data_source:
     - Sysmon EventID 9
-search: '`sysmon` EventCode=9 Device = \\Device\\HarddiskVolume* NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product Device Image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_disk_volume_partition_filter`'
+search: |
+    `sysmon` EventCode=9 Device="\\Device\\HarddiskVolume*" NOT (Image IN ("*\\system32\\*", "*\\syswow64\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_disk_volume_partition_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: There are som minimal number of normal applications from system32 folder like svchost.exe accessing the MBR. In this case we used 'system32' and 'syswow64' path as a filter for this detection.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
index 4a46fca4122..acdced9f8a3 100644
--- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
+++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects suspicious raw access reads to the drive containing the Master Boot Record (MBR). It leverages Sysmon EventCode 9 to identify processes attempting to read or write to the MBR sector, excluding legitimate system processes. This activity is significant because adversaries often target the MBR to wipe, encrypt, or overwrite it as part of their impact payload. If confirmed malicious, this could lead to system instability, data loss, or a complete system compromise, severely impacting the organization's operations.
 data_source:
     - Sysmon EventID 9
-search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product Device Image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_master_boot_record_drive_filter`'
+search: |
+    `sysmon` EventCode=9 Device="\\Device\\Harddisk0\\DR0" NOT (Image IN ("*\\system32\\*", "*\\syswow64\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_master_boot_record_drive_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: There are som minimal number of normal applications from system32 folder like svchost.exe accessing the MBR. In this case we used 'system32' and 'syswow64' path as a filter for this detection.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: process accessing MBR $Device$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_rdp_automaticdestinations_deletion.yml b/detections/endpoint/windows_rdp_automaticdestinations_deletion.yml
index 4b125314999..0fbe7cd0a14 100644
--- a/detections/endpoint/windows_rdp_automaticdestinations_deletion.yml
+++ b/detections/endpoint/windows_rdp_automaticdestinations_deletion.yml
@@ -10,21 +10,8 @@ description: This detection identifies the deletion of files within the Automati
 data_source:
     - Sysmon EventID 23
     - Sysmon EventID 26
-search: |-
-    `sysmon`
-    EventCode IN (23, 26)
-    TargetFilename IN ("*\\Recent\\AutomaticDestinations*")
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-
-      by action dest dvc file_path file_hash file_name
-         file_modify_time process_exec process_guid process_id
-         process_name process_path signature
-         signature_id user user_id vendor_product
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_rdp_automaticdestinations_deletion_filter`
+search: |
+    `sysmon` EventCode=23 EventCode="26" TargetFilename="*\\Recent\\AutomaticDestinations*" | stats count min(_time) as firstTime max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rdp_automaticdestinations_deletion_filter`
 how_to_implement: To successfully implement this search, you must ingest logs that include the process name, TargetFilename, and ProcessID executions from your endpoints. If you are utilizing Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed.
 known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter.
 references:
@@ -38,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_rdp_bitmap_cache_file_creation.yml b/detections/endpoint/windows_rdp_bitmap_cache_file_creation.yml
index 45d537490d8..85b39e6fc6c 100644
--- a/detections/endpoint/windows_rdp_bitmap_cache_file_creation.yml
+++ b/detections/endpoint/windows_rdp_bitmap_cache_file_creation.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: This detection identifies the creation of Remote Desktop Protocol (RDP) bitmap cache files on a Windows system, typically located in the user’s profile under the Terminal Server Client cache directory. These files (*.bmc, cache*.bin) are generated when a user initiates an RDP session using the built-in mstsc.exe client. Their presence can indicate interactive remote access activity and may be useful in detecting lateral movement or unauthorized RDP usage. Monitoring this behavior is especially important, as attackers may attempt to delete or suppress these artifacts to evade forensic analysis.
 data_source:
     - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\Terminal Server Client\\Cache\\*.bmc", "*\\Terminal Server Client\\Cache\\cache*.bin") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` |`drop_dm_object_name(Filesystem)` | `windows_rdp_bitmap_cache_file_creation_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("\\Terminal Server Client\\Cache\*.bmc", "\\Terminal Server Client\\Cache\\cache*.bin") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rdp_bitmap_cache_file_creation_filter`
 how_to_implement: To successfully implement this search, you must ingest logs that include the process name, TargetFilename, and ProcessID executions from your endpoints. If you are utilizing Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed.
 known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_rdp_cache_file_deletion.yml b/detections/endpoint/windows_rdp_cache_file_deletion.yml
index dff11ef0e70..6c611503c22 100644
--- a/detections/endpoint/windows_rdp_cache_file_deletion.yml
+++ b/detections/endpoint/windows_rdp_cache_file_deletion.yml
@@ -6,33 +6,20 @@ modification_date: '2026-07-20'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    This detection identifies the deletion of RDP bitmap cache files—specifically .bmc and .bin files—typically stored in the user profile under the Terminal Server Client\Cache directory.
+description: 'This detection identifies the deletion of RDP bitmap cache files—specifically .bmc and .bin files—typically stored in the user profile under the Terminal Server Client\Cache directory.
+
     These files are created by the native Windows Remote Desktop Client (mstsc.exe) and store graphical elements from remote sessions to improve performance.
+
     Deleting these files may indicate an attempt to remove forensic evidence of RDP usage.
+
     While rare in legitimate user behavior, this action is commonly associated with defense evasion techniques used by attackers or red teamers who wish to hide traces of interactive remote access.
-    When observed in conjunction with recent logon activity, RDP session indicators, or script execution, this behavior should be treated as potentially malicious. Monitoring for deletion of these files provides valuable visibility into anti-forensic actions that often follow lateral movement or hands-on-keyboard activity.
+
+    When observed in conjunction with recent logon activity, RDP session indicators, or script execution, this behavior should be treated as potentially malicious. Monitoring for deletion of these files provides valuable visibility into anti-forensic actions that often follow lateral movement or hands-on-keyboard activity.'
 data_source:
     - Sysmon EventID 23
     - Sysmon EventID 26
-search: |-
-    `sysmon`
-    EventCode IN (23, 26)
-    TargetFilename IN (
-        "*\\Terminal Server Client\\Cache\\*.bmc",
-        "*\\Terminal Server Client\\Cache\\cache*.bin"
-    )
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-
-      by action dest dvc file_path file_hash file_name
-         file_modify_time process_exec process_guid process_id
-         process_name process_path signature
-         signature_id user user_id vendor_product
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_rdp_cache_file_deletion_filter`
+search: |
+    `sysmon` EventCode=23 EventCode="26" TargetFilename IN ("\\Terminal Server Client\\Cache\*.bmc", "\\Terminal Server Client\\Cache\\cache*.bin") | stats count min(_time) as firstTime max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rdp_cache_file_deletion_filter`
 how_to_implement: To successfully implement this search, you must ingest logs that include the process name, TargetFilename, and ProcessID executions from your endpoints. If you are utilizing Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed.
 known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter.
 references:
@@ -46,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_rdp_client_launched_with_admin_session.yml b/detections/endpoint/windows_rdp_client_launched_with_admin_session.yml
index c41615a42c0..a2346346e61 100644
--- a/detections/endpoint/windows_rdp_client_launched_with_admin_session.yml
+++ b/detections/endpoint/windows_rdp_client_launched_with_admin_session.yml
@@ -9,20 +9,8 @@ type: Anomaly
 description: This detection identifies the execution of the Windows Remote Desktop Client (mstsc.exe) with the "/v" and /admin command-line arguments. The "/v" flag specifies the remote host to connect to, while the /admin flag initiates a connection to the target system’s console session, often used for administrative purposes. This combination may indicate that a user or attacker is performing privileged remote access, potentially to manage a system without disrupting existing user sessions. While such usage may be legitimate for IT administrators, it is less common in typical user behavior. Threat actors may abuse this capability during lateral movement to maintain stealthy access to high-value systems. Monitoring for this pattern can help detect interactive hands-on-keyboard activity, privilege abuse, or attempts to access critical infrastructure without leaving typical login traces associated with non-admin RDP sessions.
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "mstsc.exe" Processes.process = "*/v:*" Processes.process = "*/admin*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_rdp_client_launched_with_admin_session_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*mstsc.exe" Processes.process="*/v:*" Processes.process="*/admin*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rdp_client_launched_with_admin_session_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter.
 references:
@@ -36,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_rdp_connection_successful.yml b/detections/endpoint/windows_rdp_connection_successful.yml
index 6d6934bc849..fff9d2f9818 100644
--- a/detections/endpoint/windows_rdp_connection_successful.yml
+++ b/detections/endpoint/windows_rdp_connection_successful.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic detects successful Remote Desktop Protocol (RDP) connections by monitoring EventCode 1149 from the Windows TerminalServices RemoteConnectionManager Operational log. This detection is significant as successful RDP connections can indicate remote access to a system, which may be leveraged by attackers to control or exfiltrate data. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further lateral movement within the network. Monitoring successful RDP connections is crucial for identifying potential security breaches and mitigating risks promptly.
 data_source:
     - Windows Event Log RemoteConnectionManager 1149
-search: |-
+search: |
     `remoteconnectionmanager` EventCode=1149
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY Computer, user_id
diff --git a/detections/endpoint/windows_rdp_file_execution.yml b/detections/endpoint/windows_rdp_file_execution.yml
index 82ad84a04ae..94b7661d4a8 100644
--- a/detections/endpoint/windows_rdp_file_execution.yml
+++ b/detections/endpoint/windows_rdp_file_execution.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*\\AppData\\Local\\Temp\\*", "*\\Olk\\Attachments\\*", "*\\AppData\\Local\\Microsoft\\Outlook\\*", "*\\Content.Outlook\\*", "*\\Downloads\\*") AND Processes.process="*.rdp*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval execution_type=case( match(process, "\\\\Temp\\\\.*\\.(zip|7z|rar|cab|tgz|gz|tar|iso|img|vhd|vhdx).*\\.*\\.rdp"), "temp_archive_execution", match(process, "\\\\Downloads\\\\"), "downloads_execution", match(process, "\\\\Temp\\\\"), "temp_execution", match(process, "\\\\Microsoft\\\\Outlook\\\\"), "outlook_execution", match(process, "\\\\Olk\\\\Attachments\\\\"), "outlook_execution", match(process, "\\\\Content.Outlook\\\\"), "outlook_execution", true(), "other" ), risk_score=case( execution_type="temp_archive_execution", "Critical", execution_type IN ("temp_execution", "outlook_execution"), "High", execution_type="downloads_execution", "Medium", true(), "Low" ), risk_reason=case( execution_type="temp_archive_execution", "RDP file executed directly from archive/disk image in Temp directory", execution_type="downloads_execution", "RDP file executed from Downloads directory (Could be legitimate admin activity)", execution_type="temp_execution", "RDP file executed from Temp directory", execution_type="outlook_execution", "RDP file executed from Outlook directories", true(), "Standard RDP file execution" ) | sort - risk_score | rename process_name as "RDP Process", parent_process_name as "Parent Process", process as "Command Line", user as "User", execution_type as "Execution Context", risk_score as "Risk Level", risk_reason as "Risk Details" | fields - parent_process | `windows_rdp_file_execution_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*\\AppData\\Local\\Temp\\*", "*\\Olk\\Attachments\\*", "*\\AppData\\Local\\Microsoft\\Outlook\\*", "*\\Content.Outlook\\*", "*\\Downloads\\*") Processes.process="*.rdp*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rdp_file_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present based on administrators using RDP files for legitimate purposes. Filter as needed.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Windows RDP client attempted to execute an RDP file from a temporary directory, downloads directory, or Outlook directories on the endpoint $dest$.
     entity:
@@ -49,6 +50,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1598.002/rdp/mstsc_rdpfile-windows-sysmon.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_rdp_login_session_was_established.yml b/detections/endpoint/windows_rdp_login_session_was_established.yml
index 3a4caa133b3..1368781304b 100644
--- a/detections/endpoint/windows_rdp_login_session_was_established.yml
+++ b/detections/endpoint/windows_rdp_login_session_was_established.yml
@@ -9,19 +9,8 @@ type: Anomaly
 description: The following analytic detects instances where a successful Remote Desktop Protocol (RDP) login session was established, as indicated by Windows Security Event ID 4624 with Logon Type 10. This event confirms that a user has not only provided valid credentials but has also initiated a full interactive RDP session. It is a key indicator of successful remote access to a Windows system. When correlated with Event ID 1149, which logs RDP authentication success, this analytic helps distinguish between mere credential acceptance and actual session establishment—critical for effective monitoring and threat detection.
 data_source:
     - Windows Event Log Security 4624
-search: |-
-    `wineventlog_security`  EventCode=4624 Logon_Type=10
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY action app authentication_method
-           dest dvc process
-           process_id process_name process_path
-           signature signature_id src
-           src_port status subject
-           user user_group vendor_product
-           Logon_Type
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_rdp_login_session_was_established_filter`
+search: |
+    `wineventlog_security` EventCode=4624 Logon_Type="10" | stats count min(_time) as firstTime max(_time) as lastTime by action app authentication_method dest signature signature_id src user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rdp_login_session_was_established_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
 known_false_positives: This detection can catch for third party application updates or installation. In this scenario false positive filter is needed.
 references:
@@ -35,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_rdp_server_registry_deletion.yml b/detections/endpoint/windows_rdp_server_registry_deletion.yml
index 04cc5a9955c..5fd6c7c54e5 100644
--- a/detections/endpoint/windows_rdp_server_registry_deletion.yml
+++ b/detections/endpoint/windows_rdp_server_registry_deletion.yml
@@ -10,7 +10,8 @@ description: This detection identifies the deletion of registry keys under HKEY_
 data_source:
     - Sysmon EventID 12
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Terminal Server Client\\Servers\\*" Registry.action = deleted by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_rdp_server_registry_deletion_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Terminal Server Client\\Servers\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rdp_server_registry_deletion_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: This detection can catch for third party application updates or installation. In this scenario false positive filter is needed.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_rdp_server_registry_entry_created.yml b/detections/endpoint/windows_rdp_server_registry_entry_created.yml
index 1a26cbdc7d3..6bb9f21c076 100644
--- a/detections/endpoint/windows_rdp_server_registry_entry_created.yml
+++ b/detections/endpoint/windows_rdp_server_registry_entry_created.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: This detection identifies the creation of registry keys under HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers\, which occur when a user initiates a Remote Desktop Protocol (RDP) connection using the built-in Windows RDP client (mstsc.exe). These registry entries store information about previously connected remote hosts, including usernames and display settings. Their creation is a strong indicator that an outbound RDP session was initiated from the system. While the presence of these keys is normal during legitimate RDP use, their appearance can be used to track remote access activity, especially in environments where RDP is tightly controlled. In post-compromise scenarios, these artifacts may be created by threat actors using RDP for lateral movement or command-and-control. Monitoring the creation of these registry entries can help defenders detect initial use of RDP from a compromised host, particularly when correlated with unusual user behavior, logon patterns, or network activity.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Terminal Server Client\\Servers\\*" Registry.action != deleted by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_rdp_server_registry_entry_created_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Terminal Server Client\\Servers\\*" NOT Registry.action="deleted" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rdp_server_registry_entry_created_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_rdpclient_connection_sequence_events.yml b/detections/endpoint/windows_rdpclient_connection_sequence_events.yml
index e5220c69fc7..2375fd48cd5 100644
--- a/detections/endpoint/windows_rdpclient_connection_sequence_events.yml
+++ b/detections/endpoint/windows_rdpclient_connection_sequence_events.yml
@@ -9,15 +9,8 @@ type: Anomaly
 description: This analytic monitors Windows RDP client connection sequence events (EventCode 1024) from the Microsoft-Windows-TerminalServices-RDPClient/Operational log. These events track when RDP ClientActiveX initiates connection attempts to remote servers. The connection sequence is a critical phase of RDP where the client and server exchange settings and establish common parameters for the session. Monitoring these events can help identify unusual RDP connection patterns, potential lateral movement attempts, unauthorized remote access activity, and RDP connection chains that may indicate compromised systems. NOTE the analytic was written for Multi-Line as XML was not properly parsed out.
 data_source:
     - Windows Event Log Microsoft Windows TerminalServices RDPClient 1024
-search: |-
-    `wineventlog_rdp` EventCode=1024
-      | rename host as dest
-      | stats count as "Event Count", min(_time) as firstTime, max(_time) as lastTime, values(Message) as messages
-        BY dest, source, LogName,
-           EventCode, category
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_rdpclient_connection_sequence_events_filter`
+search: |
+    `wineventlog_rdp` EventCode="1024" | eval dest=host | stats count min(_time) as firstTime max(_time) as lastTime by EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rdpclient_connection_sequence_events_filter`
 how_to_implement: To successfully implement this detection, ensure Windows RDP Client Operational logs are being collected and forwarded to Splunk. Enable logging for "Microsoft-Windows-TerminalServices-RDPClient/Operational", via a new inputs.conf input. See references for more details.
 known_false_positives: Legitimate RDP connections from authorized administrators and users will generate these events. To reduce false positives, you should baseline normal RDP connection patterns in your environment, whitelist expected RDP connection chains between known administrative workstations and servers, and track authorized remote support sessions.
 references:
@@ -31,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -54,6 +47,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1133/rdp/terminalservices-rdpclient.log
-          sourcetype: WinEventLog
           source: WinEventLog:Microsoft-Windows-TerminalServices-RDPClient/Operational
+          sourcetype: WinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_registry_bootexecute_modification.yml b/detections/endpoint/windows_registry_bootexecute_modification.yml
index c730c2797a7..f024456fe38 100644
--- a/detections/endpoint/windows_registry_bootexecute_modification.yml
+++ b/detections/endpoint/windows_registry_bootexecute_modification.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the BootExecute registry key, which manages applications and services executed during system boot. It leverages data from the Endpoint.Registry data model, focusing on changes to the registry path "HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\BootExecute". This activity is significant because unauthorized changes to this key can indicate attempts to achieve persistence, load malicious code, or tamper with the boot process. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary code at boot, or disrupt system operations.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path="*\\System\\CurrentControlSet\\Control\\Session Manager\\BootExecute" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_registry_bootexecute_modification_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\Session Manager\\BootExecute" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_bootexecute_modification_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on Windows Registry that include the name of the path and key responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives may be present and will need to be filtered.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The Registry BootExecute value was modified on $dest$ and should be reviewed immediately.
     entity:
diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml
index 5cd9cd3a76f..9b322eeb478 100644
--- a/detections/endpoint/windows_registry_certificate_added.yml
+++ b/detections/endpoint/windows_registry_certificate_added.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the installation of a root CA certificate by monitoring specific registry paths for SetValue events. It leverages data from the Endpoint datamodel, focusing on registry paths containing "certificates" and registry values named "Blob." This activity is significant because unauthorized root CA certificates can compromise the integrity of encrypted communications and facilitate man-in-the-middle attacks. If confirmed malicious, this could allow an attacker to intercept, decrypt, or manipulate sensitive data, leading to severe security breaches.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\certificates\\*") AND Registry.registry_value_name="Blob" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_certificate_added_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\certificates\\*" Registry.registry_value_name="*Blob" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_certificate_added_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives will be limited to a legitimate business applicating consistently adding new root certificates to the endpoint. Filter by user, process, or thumbprint.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_registry_delete_task_sd.yml b/detections/endpoint/windows_registry_delete_task_sd.yml
index 217dfbea23a..97f5a187798 100644
--- a/detections/endpoint/windows_registry_delete_task_sd.yml
+++ b/detections/endpoint/windows_registry_delete_task_sd.yml
@@ -6,43 +6,19 @@ modification_date: '2026-05-13'
 author: Michael Haag, Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects a process attempting to delete a scheduled task's Security Descriptor (SD) from the registry path of that task.
+description: 'The following analytic detects a process attempting to delete a scheduled task''s Security Descriptor (SD) from the registry path of that task.
+
     It leverages the Endpoint.Registry data model to identify registry actions performed by the SYSTEM user, specifically targeting deletions of the SD value.
+
     This activity is significant as it may indicate an attempt to remove evidence of a scheduled task for defense evasion.
-    If confirmed malicious, it suggests an attacker with privileged access trying to hide their tracks, potentially compromising system integrity and security.
+
+    If confirmed malicious, it suggests an attacker with privileged access trying to hide their tracks, potentially compromising system integrity and security.'
 data_source:
     - Sysmon EventID 12
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Registry where
-
-    Registry.registry_path IN ("*\\Schedule\\TaskCache\\Tree\\*")
-    Registry.user="SYSTEM"
-    (
-      Registry.registry_value_name="SD"
-      OR
-      Registry.registry_key_name="SD"
-    )
-    Registry.action=deleted
-
-    by Registry.action Registry.dest Registry.process_guid
-       Registry.process_id Registry.registry_hive
-       Registry.registry_path Registry.registry_key_name
-       Registry.registry_value_data Registry.registry_value_name
-       Registry.registry_value_type Registry.status Registry.user
-       Registry.vendor_product
-
-    | `drop_dm_object_name(Registry)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_registry_delete_task_sd_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Schedule\\TaskCache\\Tree\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_delete_task_sd_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: |
-    False positives should be limited as the activity is not common to delete ONLY the SD from the registry.
+known_false_positives: False positives should be limited as the activity is not common to delete ONLY the SD from the registry.
 references:
     - https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/
     - https://gist.github.com/MHaggis/5f7fd6745915166fc6da863d685e2728
@@ -55,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml
index fb9e911b686..c7cd6b9ef2c 100644
--- a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml
+++ b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml
@@ -6,38 +6,19 @@ modification_date: '2026-10-02'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects a registry modification that disables the ETW for the .NET Framework.
+description: 'The following analytic detects a registry modification that disables the ETW for the .NET Framework.
+
     It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the COMPlus_ETWEnabled registry value under the "Environment" registry key path for both user (HKCU\Environment) and machine (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment) scopes.
+
     This activity is significant because disabling ETW can allow attackers to evade Endpoint Detection and Response (EDR) tools and hide their execution from audit logs.
-    If confirmed malicious, this action could enable attackers to operate undetected, potentially leading to further compromise and persistent access within the environment.
+
+    If confirmed malicious, this action could enable attackers to operate undetected, potentially leading to further compromise and persistent access within the environment.'
 data_source:
     - Sysmon EventID 13
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Registry WHERE
-
-    Registry.registry_path="*\\Environment*"
-    Registry.registry_value_name="COMPlus_ETWEnabled"
-    Registry.registry_value_data IN ("0x00000000", "0")
-
-    by Registry.action Registry.dest Registry.process_guid Registry.process_id
-       Registry.registry_hive Registry.registry_path Registry.registry_key_name
-       Registry.registry_value_data Registry.registry_value_name
-       Registry.registry_value_type Registry.status
-       Registry.user Registry.vendor_product
-
-    | `drop_dm_object_name(Registry)`
-    | where isnotnull(registry_value_data)
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_registry_dotnet_etw_disabled_via_env_variable_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Environment*" Registry.registry_value_name="*COMPlus_ETWEnabled" Registry.registry_value_data IN ("0x00000000", "0") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_dotnet_etw_disabled_via_env_variable_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
-known_false_positives: |-
-    Setting the "COMPlus_ETWEnabled" value as a global environment variable either in user or machine scope should only happen during debugging use cases, hence the false positives rate should be very minimal.
+known_false_positives: Setting the "COMPlus_ETWEnabled" value as a global environment variable either in user or machine scope should only happen during debugging use cases, hence the false positives rate should be very minimal.
 references:
     - https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3
     - https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/
@@ -54,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The registry key [$registry_path$] with the value name [$registry_value_name$] was modified to the value [$registry_value_data$] to disable the ETW for the .NET Framework in [$dest$]
     entity:
diff --git a/detections/endpoint/windows_registry_entries_exported_via_reg.yml b/detections/endpoint/windows_registry_entries_exported_via_reg.yml
index b4f4da4a955..537ae6f7275 100644
--- a/detections/endpoint/windows_registry_entries_exported_via_reg.yml
+++ b/detections/endpoint/windows_registry_entries_exported_via_reg.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_reg`
-        AND
-        Processes.process IN ("* save *", "* export *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_registry_entries_exported_via_reg_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*reg.exe" OR Processes.original_file_name="reg.exe" Processes.process IN ("* save *", "* export *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_entries_exported_via_reg_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network administrator can use this command tool to backup registry before updates or modifying critical registries.
 references:
diff --git a/detections/endpoint/windows_registry_entries_restored_via_reg.yml b/detections/endpoint/windows_registry_entries_restored_via_reg.yml
index b92fc98f2ce..2beb03846e1 100644
--- a/detections/endpoint/windows_registry_entries_restored_via_reg.yml
+++ b/detections/endpoint/windows_registry_entries_restored_via_reg.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_reg`
-        AND
-        Processes.process = "* restore *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_registry_entries_restored_via_reg_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*reg.exe" OR Processes.original_file_name="reg.exe" Processes.process="* restore *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_entries_restored_via_reg_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network administrator can use this command tool to backup registry before updates or modifying critical registries.
 references:
diff --git a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml
index dcafbddd166..c2c9ee98829 100644
--- a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml
+++ b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies modifications to the SafeBoot registry keys, specifically within the Minimal and Network paths. This detection leverages registry activity logs from endpoint data sources like Sysmon or EDR tools. Monitoring these keys is crucial as adversaries can use them to persist drivers or services in Safe Mode, with Network allowing network connections. If confirmed malicious, this activity could enable attackers to maintain persistence even in Safe Mode, potentially bypassing certain security measures and facilitating further malicious actions.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*","*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_modification_for_safe_mode_persistence_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*", "*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_modification_for_safe_mode_persistence_filter`
 how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 known_false_positives: updated windows application needed in safe boot may used this registry
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Safeboot registry $registry_path$ was added or modified with a new value $registry_value_name$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_registry_payload_injection.yml b/detections/endpoint/windows_registry_payload_injection.yml
index 1d754ebc43b..5561c055d0e 100644
--- a/detections/endpoint/windows_registry_payload_injection.yml
+++ b/detections/endpoint/windows_registry_payload_injection.yml
@@ -9,20 +9,8 @@ type: TTP
 description: The following analytic detects suspiciously long data written to the Windows registry, a behavior often linked to fileless malware or persistence techniques. It leverages Endpoint Detection and Response (EDR) telemetry, focusing on registry events with data lengths exceeding 512 characters. This activity is significant as it can indicate an attempt to evade traditional file-based defenses, making it crucial for SOC monitoring. If confirmed malicious, this technique could allow attackers to maintain persistence, execute code, or manipulate system configurations without leaving a conventional file footprint.
 data_source:
     - Sysmon EventID 13
-search: |-
-    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
-      WHERE Registry.registry_value_data=*
-      BY _time span=1h Registry.dest
-         Registry.registry_path Registry.registry_value_name Registry.process_guid
-         Registry.registry_value_data Registry.registry_key_name Registry.registry_hive
-         Registry.status Registry.action Registry.process_id
-         Registry.user Registry.vendor_product
-    | `drop_dm_object_name(Registry)`
-    | eval reg_data_len = len(registry_value_data)
-    | where reg_data_len > 512
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_registry_payload_injection_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_data="*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_payload_injection_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A process added a suspicious length of registry data on $dest$.
     entity:
diff --git a/detections/endpoint/windows_registry_sip_provider_modification.yml b/detections/endpoint/windows_registry_sip_provider_modification.yml
index 0e057700fca..f537a9de764 100644
--- a/detections/endpoint/windows_registry_sip_provider_modification.yml
+++ b/detections/endpoint/windows_registry_sip_provider_modification.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows Registry SIP Provider. It leverages Sysmon EventID 7 to monitor registry changes in paths and values related to Cryptography Providers and OID Encoding Types. This activity is significant as it may indicate an attempt to subvert trust controls, a common tactic for bypassing security measures and maintaining persistence. If confirmed malicious, an attacker could manipulate the system's cryptographic functions, potentially leading to unauthorized access, data theft, or other damaging outcomes. Review the modified registry paths and concurrent processes to identify the attack source.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\SOFTWARE\\Microsoft\\Cryptography\\Providers\\*", "*\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType*", "*\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\Providers\\*", "*\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType*") Registry.registry_value_name IN ("Dll","$DLL") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`| `windows_registry_sip_provider_modification_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\SOFTWARE\\Microsoft\\Cryptography\\Providers\\*", "*\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType*", "*\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\Providers\\*", "*\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType*") Registry.registry_value_name IN ("*Dll", "*$DLL") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_sip_provider_modification_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: Be aware of potential false positives - legitimate applications may cause benign activities to be flagged.
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Registry SIP Provider Modification detected on $dest$.
     entity:
diff --git a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
index 8c448a115ea..7569d8d0da6 100644
--- a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
+++ b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies the loading of four specific Windows DLLs (credui.dll, dbghelp.dll, samcli.dll, winhttp.dll) by a non-standard process. This detection leverages Sysmon EventCode 7 to monitor DLL load events and flags when all four DLLs are loaded within a short time frame. This activity is significant as it may indicate the presence of Brute Ratel C4, a sophisticated remote access tool used for credential dumping and other malicious activities. If confirmed malicious, this behavior could lead to unauthorized access, credential theft, and further compromise of the affected system.
 data_source:
     - Sysmon EventID 7
-search: |-
+search: |
     `sysmon` EventCode=7
       | bin _time span=30s
       | eval BRC4_AnomalyLoadedDll=case(OriginalFileName=="credui.dll", 1, OriginalFileName=="DBGHELP.DLL", 1, OriginalFileName=="SAMCLI.DLL", 1, OriginalFileName=="winhttp.dll", 1, 1=1, 0)
@@ -39,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_remote_access_software_rms_registry.yml b/detections/endpoint/windows_remote_access_software_rms_registry.yml
index 3c672a4f896..aaab909c955 100644
--- a/detections/endpoint/windows_remote_access_software_rms_registry.yml
+++ b/detections/endpoint/windows_remote_access_software_rms_registry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation or modification of Windows registry entries related to the Remote Manipulator System (RMS) Remote Admin tool. It leverages data from the Endpoint.Registry datamodel, focusing on registry paths containing "SYSTEM\\Remote Manipulator System." This activity is significant because RMS, while legitimate, is often abused by adversaries, such as in the Azorult malware campaigns, to gain unauthorized remote access. If confirmed malicious, this could allow attackers to remotely control the targeted host, leading to potential data exfiltration, system manipulation, or further network compromise.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SYSTEM\\Remote Manipulator System*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_access_software_rms_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SYSTEM\\Remote Manipulator System*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_access_software_rms_registry_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: the registry related to RMS tool is created on $dest$
     entity:
diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml
index d86373fb889..f0de3e26fb3 100644
--- a/detections/endpoint/windows_remote_assistance_spawning_process.yml
+++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=msra.exe `windows_shells`
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_remote_assistance_spawning_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*msra.exe" Processes.process_name IN ("*cmd.exe", "*powershell.exe", "*powershell_ise.exe", "*pwsh.exe", "*sh.exe", "*bash.exe", "*wscript.exe", "*cscript.exe", "*wt.exe", "*WindowsTerminal.exe", "*mshta.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_assistance_spawning_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited, filter as needed. Add additional shells as needed.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, generating behavior not common with msra.exe.
     entity:
diff --git a/detections/endpoint/windows_remote_create_service.yml b/detections/endpoint/windows_remote_create_service.yml
index 9feb7c268c2..09dcffe0343 100644
--- a/detections/endpoint/windows_remote_create_service.yml
+++ b/detections/endpoint/windows_remote_create_service.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sc.exe Processes.process IN ("*create*")  Processes.process="*\\\\*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_create_service_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sc.exe" Processes.process="*create*" Processes.process="*\\*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_create_service_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Note that false positives may occur, and filtering may be necessary, especially when it comes to remote service creation by administrators or software management utilities.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_remote_host_computer_management_access.yml b/detections/endpoint/windows_remote_host_computer_management_access.yml
index c8e24a331dc..5b8c09f862b 100644
--- a/detections/endpoint/windows_remote_host_computer_management_access.yml
+++ b/detections/endpoint/windows_remote_host_computer_management_access.yml
@@ -10,24 +10,8 @@ description: The following analytic detects the use of mmc.exe to launch Compute
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name="mmc.exe"
-        AND
-        Processes.process = "*compmgmt.msc *"
-        AND
-        Processes.process = "*/computer:*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_remote_host_computer_management_access_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*mmc.exe" Processes.process="*compmgmt.msc *" Processes.process="*/computer:*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_host_computer_management_access_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: administrator or power user can execute command shell or script to access Windows Remote Management.
 references:
@@ -40,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_remote_image_load.yml b/detections/endpoint/windows_remote_image_load.yml
index 88953280277..bb538dd784a 100644
--- a/detections/endpoint/windows_remote_image_load.yml
+++ b/detections/endpoint/windows_remote_image_load.yml
@@ -6,27 +6,15 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects image load events where a process loads a file from a remote share path.
+description: 'The following analytic detects image load events where a process loads a file from a remote share path.
+
     This activity is significant because remote DLL or image loading can be abused for execution, defense evasion, or lateral movement while leaving the payload hosted on another system.
-    If confirmed malicious, an attacker may be loading code into a local process from attacker-controlled infrastructure.
+
+    If confirmed malicious, an attacker may be loading code into a local process from attacker-controlled infrastructure.'
 data_source:
     - Sysmon EventID 7
-search: |-
-    `sysmon`
-    EventID=7
-    ImageLoaded="\\\\*"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer ImageLoaded EventID dest loaded_file loaded_file_path process_exec
-         process_guid process_hash process_id process_name process_path
-         service_dll_signature_exists service_dll_signature_verified signature_id user_id
-         vendor_product
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_remote_image_load_filter`
+search: |
+    `sysmon` EventCode=7 ImageLoaded="\\*" | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_image_load_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate software updates or remote imaging tools may load images from shared folders. Filter these detections for approved applications to reduce false positives.
 references:
@@ -40,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_remote_management_execute_shell.yml b/detections/endpoint/windows_remote_management_execute_shell.yml
index af42849ad0e..2d557134b89 100644
--- a/detections/endpoint/windows_remote_management_execute_shell.yml
+++ b/detections/endpoint/windows_remote_management_execute_shell.yml
@@ -10,22 +10,8 @@ description: The following analytic detects the execution of winrshost.exe initi
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name="winrshost.exe"
-        AND
-        Processes.process_name IN ("cmd.exe","*powershell*", "pwsh.exe")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_remote_management_execute_shell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*winrshost.exe" Processes.process_name IN ("*cmd.exe", "*powershell", "*pwsh.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_management_execute_shell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: administrator or power user can execute command shell or script remotely using WINRM.
 references:
@@ -38,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml
index 062b6705966..33c9cf48255 100644
--- a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml
+++ b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="RDPWInst.exe"
-            OR
-            Processes.original_file_name="RDPWInst.exe"
-        )
-        AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_remote_service_rdpwinst_tool_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe" Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_service_rdpwinst_tool_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: This tool was designed for home usage and not commonly seen in production environment. Filter as needed.
 references:
@@ -42,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Rdpwinst.exe executed on $dest$.
     entity:
diff --git a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml
index 1177871b092..7cce89653b4 100644
--- a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml
+++ b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name = "netsh.exe"
-            OR
-            Processes.original_file_name= "netsh.exe"
-        )
-        AND Processes.process = "*firewall*" AND Processes.process = "*add*" AND Processes.process = "*protocol=TCP*" AND Processes.process = "*localport=3389*" AND Processes.process = "*action=allow*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_remote_services_allow_rdp_in_firewall_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*netsh.exe" OR Processes.original_file_name="netsh.exe" Processes.process="*firewall*" Processes.process="*add*" Processes.process="*protocol=TCP*" Processes.process="*localport=3389*" Processes.process="*action=allow*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_allow_rdp_in_firewall_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -42,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml
index 43c08e0ae4d..82649e50fd2 100644
--- a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml
+++ b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects modifications in the Windows registry to enable remote desktop assistance on a targeted machine. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the "Control\\Terminal Server\\fAllowToGetHelp" registry path. This activity is significant because enabling remote assistance via registry is uncommon and often associated with adversaries or malware like Azorult. If confirmed malicious, this could allow an attacker to remotely access and control the compromised host, leading to potential data exfiltration or further system compromise.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal Server\\fAllowToGetHelp*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_allow_remote_assistance_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\Terminal Server\\fAllowToGetHelp*" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_allow_remote_assistance_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_remote_services_rdp_enable.yml b/detections/endpoint/windows_remote_services_rdp_enable.yml
index b926b30e9e3..d5c93f80d54 100644
--- a/detections/endpoint/windows_remote_services_rdp_enable.yml
+++ b/detections/endpoint/windows_remote_services_rdp_enable.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications in the Windows registry to enable Remote Desktop Protocol (RDP) on a targeted machine. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the "fDenyTSConnections" registry value. This activity is significant as enabling RDP via registry is uncommon and often associated with adversaries or malware attempting to gain remote access. If confirmed malicious, this could allow attackers to remotely control the compromised host, potentially leading to further exploitation and lateral movement within the network.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_rdp_enable_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\Terminal Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_rdp_enable_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: administrators may enable or disable this feature that may cause some false positive.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: the registry for rdp protocol was modified to enable on $dest$
     entity:
diff --git a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml
index 1a57af52043..26d46e8a8e3 100644
--- a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml
+++ b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml
@@ -6,13 +6,13 @@ modification_date: '2026-09-23'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies a Windows command interpreter process being executed where it's process name does not match it's original file name attribute.
-    Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
+description: 'The following analytic identifies a Windows command interpreter process being executed where it''s process name does not match it''s original file name attribute.
+
+    Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.'
 data_source:
     - Sysmon EventID 1
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) AS firstTime
             max(_time) AS lastTime
@@ -44,16 +44,20 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_renamed_command_interpreter_was_executed_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents
+
     are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement
+
     this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally,
+
     you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk
+
     Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node
+
     of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and
-    speed up the data modeling process.
-known_false_positives: |-
-    3rd party software binaries sharing the same name as Windows command interpreter binaries may trigger false positives.
+
+    speed up the data modeling process.'
+known_false_positives: 3rd party software binaries sharing the same name as Windows command interpreter binaries may trigger false positives.
 references:
     - https://attack.mitre.org/techniques/T1036/
     - https://attack.mitre.org/techniques/T1036/003/
@@ -67,7 +71,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml
index 2a8a53caf77..4e650ab84dc 100644
--- a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml
+++ b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml
@@ -6,14 +6,15 @@ modification_date: '2026-09-23'
 author: Steven Dick, Onur Mustafa Erdogan, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute.
+description: 'The following analytic identifies a LOLBAS process being executed where it''s process name does not match it''s original file name attribute.
+
     Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
-    The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code.
+
+    The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code.'
 data_source:
     - Sysmon EventID 1
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) AS firstTime
             max(_time) AS lastTime
@@ -53,16 +54,20 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_renamed_lolbas_binary_was_executed_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents
+
     are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement
+
     this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally,
+
     you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk
+
     Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node
+
     of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and
-    speed up the data modeling process.
-known_false_positives: |-
-    3rd party software binaries sharing the same name as LOLBAS utilities may trigger false positives.
+
+    speed up the data modeling process.'
+known_false_positives: 3rd party software binaries sharing the same name as LOLBAS utilities may trigger false positives.
 references:
     - https://attack.mitre.org/techniques/T1036/
     - https://attack.mitre.org/techniques/T1036/003/
@@ -75,7 +80,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml
index 640c8aa4ae3..cdaa9738cd1 100644
--- a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml
+++ b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml
@@ -6,13 +6,13 @@ modification_date: '2026-09-23'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies a popular 3rd party software process being executed where it's process name does not match it's original file name attribute.
-    Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
+description: 'The following analytic identifies a popular 3rd party software process being executed where it''s process name does not match it''s original file name attribute.
+
+    Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.'
 data_source:
     - Sysmon EventID 1
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) AS firstTime
             max(_time) AS lastTime
@@ -44,16 +44,20 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_renamed_popular_3rd_party_software_was_executed_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents
+
     are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement
+
     this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally,
+
     you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk
+
     Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node
+
     of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and
-    speed up the data modeling process.
-known_false_positives: |-
-    3rd party software binaries might have overlapping executable names.
+
+    speed up the data modeling process.'
+known_false_positives: 3rd party software binaries might have overlapping executable names.
 references:
     - https://attack.mitre.org/techniques/T1036/
     - https://attack.mitre.org/techniques/T1036/003/
@@ -67,7 +71,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_renamed_python_binary_was_executed.yml b/detections/endpoint/windows_renamed_python_binary_was_executed.yml
index e1b2655e8e2..0bfda38760c 100644
--- a/detections/endpoint/windows_renamed_python_binary_was_executed.yml
+++ b/detections/endpoint/windows_renamed_python_binary_was_executed.yml
@@ -6,14 +6,15 @@ modification_date: '2026-09-23'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies a Python process being executed where it's process name does not match
-    it's original file name attribute. Processes that have been renamed and executed may be an indicator that
-    an adversary is attempting to evade defenses or execute malicious code.
+description: 'The following analytic identifies a Python process being executed where it''s process name does not match
+
+    it''s original file name attribute. Processes that have been renamed and executed may be an indicator that
+
+    an adversary is attempting to evade defenses or execute malicious code.'
 data_source:
     - Sysmon EventID 1
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) AS firstTime
             max(_time) AS lastTime
@@ -47,14 +48,19 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_renamed_python_binary_was_executed_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents
+
     are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement
+
     this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally,
+
     you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk
+
     Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node
+
     of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and
-    speed up the data modeling process.
+
+    speed up the data modeling process.'
 known_false_positives: Various Python implementations might have a different executable name, which could trigger false positives.
 references:
     - https://attack.mitre.org/techniques/T1036/
@@ -69,7 +75,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml
index c4d0172bb79..74638ca4b98 100644
--- a/detections/endpoint/windows_replication_through_removable_media.yml
+++ b/detections/endpoint/windows_replication_through_removable_media.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation or dropping of executable or script files in the root directory of a removable drive. It leverages data from the Endpoint.Filesystem datamodel, focusing on specific file types and their creation paths. This activity is significant as it may indicate an attempt to spread malware, such as ransomware, via removable media. If confirmed malicious, this behavior could lead to unauthorized code execution, lateral movement, or persistence within the network, potentially compromising sensitive data and systems.
 data_source:
     - Sysmon EventID 11
-search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk", "*.url") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | eval dropped_file_path = split(file_path, "\\") | eval dropped_file_path_split_count = mvcount(dropped_file_path) | eval root_drive = mvindex(dropped_file_path,0) | where LIKE(root_drive, "%:") AND dropped_file_path_split_count = 2  AND root_drive!= "C:" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_replication_through_removable_media_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk", "*.url") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product Filesystem.root_drive | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_replication_through_removable_media_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 known_false_positives: Administrators may allow creation of script or exe in the paths specified. Filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: executable or script $file_path$ was dropped in root drive $root_drive$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_rmm_named_pipe.yml b/detections/endpoint/windows_rmm_named_pipe.yml
index fdb9a4bf18e..c548587ca1c 100644
--- a/detections/endpoint/windows_rmm_named_pipe.yml
+++ b/detections/endpoint/windows_rmm_named_pipe.yml
@@ -6,10 +6,11 @@ modification_date: '2026-09-22'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the creation or connection to known suspicious named pipes, which is a technique often used by offensive tools.
+description: 'The following analytic detects the creation or connection to known suspicious named pipes, which is a technique often used by offensive tools.
+
     It leverages Sysmon EventCodes 17 and 18 to identify  known default pipe names used by RMM tools.
-    If confirmed malicious,  this could allow an attacker to abuse these to potentially gain persistence, command and control, or further system compromise.
+
+    If confirmed malicious,  this could allow an attacker to abuse these to potentially gain persistence, command and control, or further system compromise.'
 data_source:
     - Sysmon EventID 17
     - Sysmon EventID 18
@@ -42,13 +43,14 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_rmm_named_pipe_filter`
-how_to_implement: |
-    To successfully implement this search, you need to be ingesting
+how_to_implement: 'To successfully implement this search, you need to be ingesting
+
     logs with the process name and pipename from your endpoints. If you are using Sysmon,
-    you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: |
-    Some false positives may occur from RMM software used in your environment. Apply filters
-    based on known legitimate RMM software in your environment to reduce false positives.
+
+    you must have at least version 6.0.4 of the Sysmon TA.'
+known_false_positives: 'Some false positives may occur from RMM software used in your environment. Apply filters
+
+    based on known legitimate RMM software in your environment to reduce false positives.'
 references:
     - https://attack.mitre.org/techniques/T1218/009/
     - https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes
@@ -60,7 +62,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_rmm_tool_execution.yml b/detections/endpoint/windows_rmm_tool_execution.yml
index d967fa33e49..baa6e9e272d 100644
--- a/detections/endpoint/windows_rmm_tool_execution.yml
+++ b/detections/endpoint/windows_rmm_tool_execution.yml
@@ -6,136 +6,15 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects process creation events of various remote access tools.
+description: 'Detects process creation events of various remote access tools.
+
     Remote management tools, when used for legitimate purposes, can help IT professionals and system administrators remotely access and manage computer systems.
-    However, threat actors may exploit these tools for malicious purposes.
+
+    However, threat actors may exploit these tools for malicious purposes.'
 data_source:
     - Sysmon EventID 1
-search: |-
-    `sysmon`
-    EventID = 1
-    (
-        Company IN (
-            "AmidaWare*",
-            "Ammyy LLC*",
-            "AnyDesk Software*",
-            "ATERA Networks*",
-            "bomgar*",
-            "FleetDeck*",
-            "GoTo, Inc*",
-            "IDrive Inc*",
-            "LogMeIn, Inc*",
-            "MMSOFT Design*",
-            "N-able*",
-            "NetSupport Ltd*",
-            "NinjaRMM*",
-            "Remote Utilities*",
-            "SimpleHelp*",
-            "Servably*",
-            "ScreenConnect*",
-            "Splashtop*",
-            "TeamViewer Germany*",
-            "ZOHO Corporation*"
-        )
-
-        OR Description IN (
-            "Advanced Monitoring Agent*",
-            "AnyDesk*",
-            "Ammyy Admin*",
-            "AteraAgent*",
-            "BeyondTrust Remote Support*",
-            "FleetDeck*",
-            "GoToAssist*",
-            "GoToMyPC*",
-            "Kaseya Live Connect*",
-            "N-able*",
-            "NetSupport Client Application*",
-            "NinjaRMM*",
-            "Pulseway*",
-            "RemotePC*",
-            "Remote Utilities*",
-            "ScreenConnect*",
-            "SimpleHelp Remote*",
-            "Splashtop*",
-            "Tactical RMM Agentz*",
-            "Take Control Agent*",
-            "Zoho Assist*"
-        )
-
-        OR Product IN (
-            "Advanced Monitoring Agent*",
-            "AnyDesk*",
-            "Ammyy Admin*",
-            "AteraAgent*",
-            "BeyondTrust Remote Support*",
-            "FleetDeck*",
-            "GoToAssist*",
-            "GoToMyPC*",
-            "Kaseya Live Connect*",
-            "NetSupport Remote Control*",
-            "NetSupport Manager*",
-            "NinjaRMM*",
-            "Pulseway*",
-            "Remote Access*",
-            "Remote Support*",
-            "Remote Utilities*",
-            "RemotePC*",
-            "Syncro*",
-            "ScreenConnect*",
-            "Splashtop*",
-            "Tactical RMM Agent*",
-            "Take Control Agent*",
-            "TeamViewer*",
-            "Zoho Assist*"
-        )
-
-        OR Image IN (
-            "*AgentPackage*",
-            "*AnyDesk.exe*",
-            "*AteraAgent.exe*",
-            "*BASupSrvc*",
-            "*fleetdeck*",
-            "*level.exe*",
-            "*MeshAgent*",
-            "*MspPlatform\\PME\\Installers*",
-            "*NableCommand*",
-            "*N-able Technologies*",
-            "*NinjaRMM*",
-            "*nxexec.exe*",
-            "*nxserv*",
-            "*nxplayer*",
-            "*PCMonitor*",
-            "*Pulseway*",
-            "*remcmdstub.exe*",
-            "*rustdesk.exe*",
-            "*ScreenConnect*",
-            "*Splashtop*",
-            "*SRAgent.exe*",
-            "*tacticalrmm.exe*",
-            "*TakeControlTechConsole*",
-            "*tailscale*",
-            "*TeamViewer*",
-            "*ZA_Connect*",
-            "*ZMAgent*",
-            "*ZohoMeeting*"
-        )
-    )
-
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer Company Description Product Image action
-         dest original_file_name parent_process
-         parent_process_exec parent_process_guid
-         parent_process_id parent_process_name
-         parent_process_path process_hash
-         process_integrity_level user user_id
-         vendor_product
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_rmm_tool_execution_filter`
+search: |
+    `sysmon` EventCode=1 Company IN ("AmidaWare*", "Ammyy LLC*", "AnyDesk Software*", "ATERA Networks*", "bomgar*", "FleetDeck*", "GoTo, Inc*", "IDrive Inc*", "LogMeIn, Inc*", "MMSOFT Design*", "N-able*", "NetSupport Ltd*", "NinjaRMM*", "Remote Utilities*", "SimpleHelp*", "Servably*", "ScreenConnect*", "Splashtop*", "TeamViewer Germany*", "ZOHO Corporation*") OR Description IN ("Advanced Monitoring Agent*", "AnyDesk*", "Ammyy Admin*", "AteraAgent*", "BeyondTrust Remote Support*", "FleetDeck*", "GoToAssist*", "GoToMyPC*", "Kaseya Live Connect*", "N-able*", "NetSupport Client Application*", "NinjaRMM*", "Pulseway*", "RemotePC*", "Remote Utilities*", "ScreenConnect*", "SimpleHelp Remote*", "Splashtop*", "Tactical RMM Agentz*", "Take Control Agent*", "Zoho Assist*") OR Product IN ("Advanced Monitoring Agent*", "AnyDesk*", "Ammyy Admin*", "AteraAgent*", "BeyondTrust Remote Support*", "FleetDeck*", "GoToAssist*", "GoToMyPC*", "Kaseya Live Connect*", "NetSupport Remote Control*", "NetSupport Manager*", "NinjaRMM*", "Pulseway*", "Remote Access*", "Remote Support*", "Remote Utilities*", "RemotePC*", "Syncro*", "ScreenConnect*", "Splashtop*", "Tactical RMM Agent*", "Take Control Agent*", "TeamViewer*", "Zoho Assist*") OR Image IN ("*AgentPackage*", "*AnyDesk.exe*", "*AteraAgent.exe*", "*BASupSrvc*", "*fleetdeck*", "*level.exe*", "*MeshAgent*", "*MspPlatform\\PME\\Installers*", "*NableCommand*", "*N-able Technologies*", "*NinjaRMM*", "*nxexec.exe*", "*nxserv*", "*nxplayer*", "*PCMonitor*", "*Pulseway*", "*remcmdstub.exe*", "*rustdesk.exe*", "*ScreenConnect*", "*Splashtop*", "*SRAgent.exe*", "*tacticalrmm.exe*", "*TakeControlTechConsole*", "*tailscale*", "*TeamViewer*", "*ZA_Connect*", "*ZMAgent*", "*ZohoMeeting*") | eval src_user=src_user | stats count min(_time) as firstTime max(_time) as lastTime by action dest original_file_name parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process process_exec process_guid process_hash process_id process_integrity_level process_name process_path user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rmm_tool_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate IT staff often use remote management tools for system maintenance and troubleshooting. Filter alerts to exclude trusted administrative activities.
 references:
@@ -150,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml
index 924a74e51c6..1932b84874c 100644
--- a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml
+++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for root domain linked policies. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this activity. This behavior is significant as it may indicate an attempt by adversaries or Red Teams to gain situational awareness and perform Active Directory Discovery. If confirmed malicious, this activity could allow attackers to map out domain policies, potentially aiding in further exploitation or lateral movement within the network.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*.SearchRooT*" ScriptBlockText = "*.gplink*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_root_domain_linked_policies_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*[adsisearcher]*" Processes.process="*.SearchRooT*" Processes.process="*.gplink*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_root_domain_linked_policies_discovery_filter`
 how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -35,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_routing_and_remote_access_service_registry_key_change.yml b/detections/endpoint/windows_routing_and_remote_access_service_registry_key_change.yml
index 56fe920409e..0067a101f49 100644
--- a/detections/endpoint/windows_routing_and_remote_access_service_registry_key_change.yml
+++ b/detections/endpoint/windows_routing_and_remote_access_service_registry_key_change.yml
@@ -6,38 +6,21 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic identifies the modification of the Windows RemoteAccess Registry Entry.
+description: 'This analytic identifies the modification of the Windows RemoteAccess Registry Entry.
+
     This technique can be used by malware, adversaries, threat actors and red teamers to gain persistence on a system by tampering with the key to add a custom DLL to be loaded.
+
     This technique was also observed to be used by Gh0st RAT malware.
-    Upon seeing this behavior, it is recommended to review the system services events especially the remote access services.
+
+    Upon seeing this behavior, it is recommended to review the system services events especially the remote access services.'
 data_source:
     - Sysmon EventID 13
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Registry WHERE
-
-    Registry.registry_path="*\\Services\\RemoteAccess\\RouterManagers\\Ip*"
-    Registry.action=modified
-
-    by Registry.action Registry.dest Registry.process_guid
-       Registry.process_id Registry.registry_hive
-       Registry.registry_path Registry.registry_key_name
-       Registry.registry_value_data Registry.registry_value_name
-       Registry.registry_value_type Registry.status
-       Registry.user Registry.vendor_product
-
-    | `drop_dm_object_name(Registry)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_routing_and_remote_access_service_registry_key_change_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Services\\RemoteAccess\\RouterManagers\\Ip*" Registry.action="modified" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_routing_and_remote_access_service_registry_key_change_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: |
-    There are legitimate reasons for changing this registry key/value.
-    Investigate the change and its source and apply appropriate filters as needed.
+known_false_positives: 'There are legitimate reasons for changing this registry key/value.
+
+    Investigate the change and its source and apply appropriate filters as needed.'
 references:
     - https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_rat
     - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrasm/22ad9f0e-4349-43e0-92b3-37f7a9c7ca41
@@ -51,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_rundll32_apply_user_settings_changes.yml b/detections/endpoint/windows_rundll32_apply_user_settings_changes.yml
index 0a26b8f8211..58d59966238 100644
--- a/detections/endpoint/windows_rundll32_apply_user_settings_changes.yml
+++ b/detections/endpoint/windows_rundll32_apply_user_settings_changes.yml
@@ -6,37 +6,21 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the execution of rundll32 with a call to the user32 DLL, specifically the UpdatePerUserSystemParameters function.
+description: 'The following analytic detects the execution of rundll32 with a call to the user32 DLL, specifically the UpdatePerUserSystemParameters function.
+
     This function is responsible for updating system parameters, such as desktop backgrounds, display settings, and visual themes.
+
     It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions.
+
     This activity can be significant as it is an uncommon way to apply settings. It was also observed as part of Rhysida Ransomware activity.
-    If confirmed malicious, this could allow an attacker to disguise activities or make unauthorized system changes, potentially leading to persistent unauthorized access.
+
+    If confirmed malicious, this could allow an attacker to disguise activities or make unauthorized system changes, potentially leading to persistent unauthorized access.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    `process_rundll32`
-    Processes.process = "*user32.dll*"
-    Processes.process = "*UpdatePerUserSystemParameters*"
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_rundll32_apply_user_settings_changes_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" Processes.process="*user32.dll*" Processes.process="*UpdatePerUserSystemParameters*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rundll32_apply_user_settings_changes_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -51,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_rundll32_execution_with_log_dll.yml b/detections/endpoint/windows_rundll32_execution_with_log_dll.yml
index 88682903aae..16bd2ef7cca 100644
--- a/detections/endpoint/windows_rundll32_execution_with_log_dll.yml
+++ b/detections/endpoint/windows_rundll32_execution_with_log_dll.yml
@@ -6,29 +6,21 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |
-    Identifies the execution of rundll32 with a command line argument of "log.dll", as used in the Lotus Blossom Chrysalis backdoor campaign.
+description: 'Identifies the execution of rundll32 with a command line argument of "log.dll", as used in the Lotus Blossom Chrysalis backdoor campaign.
+
     Attackers placed a malicious "log.dll" in "%AppData%\Bluetooth" and invoked it via rundll32.exe "log.dll,LogInit" to decrypt and execute ShellCode.
-    The legitimate Bitdefender Submission Wizard (BDSubmit.exe, bdsw.exe) also uses log.dll and is vulnerable to DLL sideloading.
+
+    The legitimate Bitdefender Submission Wizard (BDSubmit.exe, bdsw.exe) also uses log.dll and is vulnerable to DLL sideloading.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
-      from datamodel=Endpoint.Processes where
-      `process_rundll32`
-      Processes.process="* log.dll*"
-      by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_rundll32_execution_with_log_dll_filter`
-how_to_implement: |
-    Ingest process creation logs (Sysmon EventID 1 or equivalent) and map them to the Endpoint.Processes data model. Ensure command-line arguments are captured so that "log.dll" appears in the process field. The Splunk Add-on for Microsoft Sysmon and CIM are required.
-known_false_positives: |
-    Legitimate use of rundll32 to load log.dll from trusted locations may trigger this.
-    Allowlist known paths or parent processes as needed.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" Processes.process="* log.dll*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rundll32_execution_with_log_dll_filter`
+how_to_implement: Ingest process creation logs (Sysmon EventID 1 or equivalent) and map them to the Endpoint.Processes data model. Ensure command-line arguments are captured so that "log.dll" appears in the process field. The Splunk Add-on for Microsoft Sysmon and CIM are required.
+known_false_positives: 'Legitimate use of rundll32 to load log.dll from trusted locations may trigger this.
+
+    Allowlist known paths or parent processes as needed.'
 references:
     - https://attack.mitre.org/techniques/T1574/002/
     - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
@@ -41,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -72,6 +64,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/lotus_blossom_chrysalis/windows-sysmon.log
-          sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
       test_type: unit
diff --git a/detections/endpoint/windows_rundll32_load_dll_in_temp_dir.yml b/detections/endpoint/windows_rundll32_load_dll_in_temp_dir.yml
index fa9a8bcc5b2..35c1f6fc67f 100644
--- a/detections/endpoint/windows_rundll32_load_dll_in_temp_dir.yml
+++ b/detections/endpoint/windows_rundll32_load_dll_in_temp_dir.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: This detection identifies instances where rundll32.exe is used to load a DLL from a temporary directory, such as C:\Users\<User>\AppData\Local\Temp\ or C:\Windows\Temp\. While rundll32.exe is a legitimate Windows utility used to execute functions exported from DLLs, its use to load libraries from temporary locations is highly suspicious. These directories are commonly used by malware and red team tools to stage payloads or execute code in-memory without writing it to more persistent locations. This behavior often indicates defense evasion, initial access, or privilege escalation, especially when the DLL is unsigned, recently written, or executed shortly after download. In normal user workflows, DLLs are not typically loaded from Temp paths, making this a high-fidelity indicator of potentially malicious activity. Monitoring this pattern is essential for detecting threats that attempt to blend in with native system processes while bypassing traditional application controls.
 data_source:
     - Sysmon EventID 1
-search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` AND Processes.process IN ("*temp\\*", "*\\tmp\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rundll32_load_dll_in_temp_dir_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" OR Processes.original_file_name="RUNDLL32.EXE" Processes.process IN ("*temp\\*", "*\\tmp\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rundll32_load_dll_in_temp_dir_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_rundll32_webdav_request.yml b/detections/endpoint/windows_rundll32_webdav_request.yml
index 5d47476d8f1..9572aadcbf6 100644
--- a/detections/endpoint/windows_rundll32_webdav_request.yml
+++ b/detections/endpoint/windows_rundll32_webdav_request.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process IN ("*\\windows\\system32\\davclnt.dll,*davsetcookie*","*\\windows\\syswow64\\davclnt.dll,*davsetcookie*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rundll32_webdav_request_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*rundll32.exe" Processes.process IN ("*\\system32\\*", "*\\syswow64\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rundll32_webdav_request_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives will be present based on legitimate software, filtering may need to occur.
 references:
diff --git a/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml b/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml
index 31c9eb6f45d..d40ac64260a 100644
--- a/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml
+++ b/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml
@@ -46,18 +46,24 @@ search: |
       | `drop_dm_object_name(All_Traffic)`
     ]
     | `windows_rundll32_webdav_with_network_connection_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    False positives will be present based on legitimate software, filtering may need to occur.
+
+    names and speed up the data modeling process.'
+known_false_positives: False positives will be present based on legitimate software, filtering may need to occur.
 references:
     - https://strontic.github.io/xcyclopedia/library/davclnt.dll-0EA3050E7CC710526E330C413C165DA0.html
     - https://twitter.com/ACEResponder/status/1636116096506818562?s=20
@@ -72,7 +78,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to contact a remote WebDav server.
     entity:
diff --git a/detections/endpoint/windows_rundll32_with_non_standard_file_extension.yml b/detections/endpoint/windows_rundll32_with_non_standard_file_extension.yml
index 8dfa8943a42..2eb76580aea 100644
--- a/detections/endpoint/windows_rundll32_with_non_standard_file_extension.yml
+++ b/detections/endpoint/windows_rundll32_with_non_standard_file_extension.yml
@@ -6,14 +6,14 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic identifies the instance of rundll32.exe process loading a non-standard Windows modules file extension.
-    This behavior is not common and can be associated with malicious activities, such as the Gh0st RAT backdoor. This technique is to evade possible detection by security tools that monitors a suspicious dll loading activity.
+description: 'This analytic identifies the instance of rundll32.exe process loading a non-standard Windows modules file extension.
+
+    This behavior is not common and can be associated with malicious activities, such as the Gh0st RAT backdoor. This technique is to evade possible detection by security tools that monitors a suspicious dll loading activity.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -96,11 +96,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_rundll32_with_non_standard_file_extension_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Certain legitimate Windows components, third-party applications, or administrative scripts may use rundll32.exe with non-standard or extensionless inputs during normal operation.
-    Filtering and contextual analysis are required, focus on command-line arguments, parent process, file location, and prevalence across the environment before determining malicious intent.
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: 'Certain legitimate Windows components, third-party applications, or administrative scripts may use rundll32.exe with non-standard or extensionless inputs during normal operation.
+
+    Filtering and contextual analysis are required, focus on command-line arguments, parent process, file location, and prevalence across the environment before determining malicious intent.'
 references:
     - https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_rat
     - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrasm/22ad9f0e-4349-43e0-92b3-37f7a9c7ca41
@@ -114,7 +113,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_runmru_command_execution.yml b/detections/endpoint/windows_runmru_command_execution.yml
index 035fa471453..829eaf1a848 100644
--- a/detections/endpoint/windows_runmru_command_execution.yml
+++ b/detections/endpoint/windows_runmru_command_execution.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects modifications to the Windows RunMRU registry key, which stores a history of commands executed through the Run dialog box (Windows+R). It leverages Endpoint Detection and Response (EDR) telemetry to monitor registry events targeting this key. This activity is significant as malware often uses the Run dialog to execute malicious commands while attempting to appear legitimate. If confirmed malicious, this could indicate an attacker using indirect command execution techniques for defense evasion or persistence. The detection excludes MRUList value changes to focus on actual command entries.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" NOT Registry.registry_value_name="MRUList" NOT Registry.registry_value_data="unknown" by Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_hive Registry.registry_value_name Registry.status Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_runmru_command_execution_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" NOT Registry.registry_value_name="*MRUList" NOT Registry.registry_value_data="unknown" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_runmru_command_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Registry` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: This detection may generate a few false positives, such as legitimate software updates or legitimate system maintenance activities that modify the RunMRU key. However, the exclusion of MRUList value changes helps reduce the number of false positives by focusing only on actual command entries. Add any specific false positives to the built in filter to reduce findings as needed.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_runmru_registry_key_or_value_deleted.yml b/detections/endpoint/windows_runmru_registry_key_or_value_deleted.yml
index dae23017d88..e3ddc61557d 100644
--- a/detections/endpoint/windows_runmru_registry_key_or_value_deleted.yml
+++ b/detections/endpoint/windows_runmru_registry_key_or_value_deleted.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the deletion or modification of Most Recently Used (MRU) command entries stored within the Windows Registry. Adversaries often clear these registry keys, such as HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU, to remove forensic evidence of commands executed via the Windows Run dialog or other system utilities. This activity aims to obscure their actions, hinder incident response efforts, and evade detection. Detection focuses on monitoring for changes (deletion of values or modification of the MRUList value) to these specific registry paths, particularly when performed by unusual processes or outside of typical user behavior. Anomalous deletion events can indicate an attempt at defense evasion or post-exploitation cleanup by a malicious actor.
 data_source:
     - Sysmon EventID 12
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" Registry.action = deleted by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_runmru_registry_key_or_value_deleted_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_runmru_registry_key_or_value_deleted_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: This event can be seen when administrator delete a history manually or uninstall/reinstall a software that creates MRU registry entry. It is recommended to check this alert with high priority.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml b/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml
index dff7ccf275d..b233235dea7 100644
--- a/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml
+++ b/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml
@@ -6,42 +6,23 @@ modification_date: '2026-08-20'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects the creation or modification of adsource.dll or other staging files with the name adsource_*.dll within the SCCM SMS Provider bin directory, consistent with exploitation of CVE-2026-47301.
+description: 'The following analytic detects the creation or modification of adsource.dll or other staging files with the name adsource_*.dll within the SCCM SMS Provider bin directory, consistent with exploitation of CVE-2026-47301.
+
     This abuses a DLL side-loading vulnerability in the Microsoft Configuration Manager SMS Provider component.
+
     An attacker can plant a malicious adsource.dll in the SCCMProvider bin\X64 path, causing the SMS Provider service to load the attacker-controlled library in a privileged context.
+
     The presence of renamed dlls alongside adsource.dll is a strong indicator of the classic DLL hijacking pattern where the legitimate library has been renamed so the malicious replacement can proxy calls to it.
-    If confirmed malicious, this activity represents a privilege escalation vector that can result in SYSTEM-level code execution on any host running the SCCM SMS Provider role.
+
+    If confirmed malicious, this activity represents a privilege escalation vector that can result in SYSTEM-level code execution on any host running the SCCM SMS Provider role.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.action IN ("created", "modified")
-    Filesystem.file_name IN (
-        "adsource.dll",
-        "adsource_*.dll"
-    )
-    Filesystem.file_path="*Microsoft Configuration Manager\\bin\\X64\\*"
-
-    BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-        Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-        Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-        Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-        Filesystem.user Filesystem.vendor_product
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_sccm_adsource_dll_was_planted_in_sms_provider_directory_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("adsource.dll", "adsource_*.dll") Filesystem.file_path="*Microsoft Configuration Manager\\bin\\X64\\*" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sccm_adsource_dll_was_planted_in_sms_provider_directory_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .dll or "Microsoft Configuration Manager\bin\X64\" folder.
-known_false_positives: |-
-    Legitimate SCCM upgrades or hotfix installations may create or replace adsource.dll in the bin\X64 directory.
-    Validate the file hash and digital signature of any detected adsource.dll against the expected version for the installed SCCM build before tuning.
+known_false_positives: 'Legitimate SCCM upgrades or hotfix installations may create or replace adsource.dll in the bin\X64 directory.
+
+    Validate the file hash and digital signature of any detected adsource.dll against the expected version for the installed SCCM build before tuning.'
 references:
     - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca
     - https://nvd.nist.gov/vuln/detail/cve-2026-47301
@@ -54,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious SCCM adsource DLL [$file_name$] detected at [$file_path$] on [$dest$]
     entity:
diff --git a/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml b/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml
index e93cc7f6930..abb60b44d80 100644
--- a/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml
+++ b/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml
@@ -6,61 +6,23 @@ modification_date: '2026-08-24'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects shells, scripting engines, and common post-exploitation utilities spawned as child processes of smsexec.exe.
+description: 'The following analytic detects shells, scripting engines, and common post-exploitation utilities spawned as child processes of smsexec.exe.
+
     smsexec.exe is the core SCCM SMS Executive service process and has no legitimate reason to launch interactive shells or scripting interpreters.
+
     An attacker who plants a malicious adsource.dll in the SCCMProvider bin\X64 directory will obtain code execution in the SCCM service context, typically resulting in a SYSTEM-level child process being spawned under smsexec.exe.
-    If confirmed malicious, this activity represents successful exploitation of the SCCM SMS Executive service and should be treated as a full host compromise.
+
+    If confirmed malicious, this activity represents successful exploitation of the SCCM SMS Executive service and should be treated as a full host compromise.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.parent_process_name="smsexec.exe"
-    Processes.process_name IN (
-        "bitsadmin.exe",
-        "certutil.exe",
-        "cmd.exe",
-        "conhost.exe",
-        "cscript.exe",
-        "curl.exe",
-        "mshta.exe",
-        "net.exe",
-        "net1.exe",
-        "powershell.exe",
-        "pwsh.exe",
-        "reg.exe",
-        "regsvr32.exe",
-        "rundll32.exe",
-        "wmic.exe",
-        "wscript.exe"
-    )
-
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name
-       Processes.process_path Processes.user Processes.user_id
-       Processes.vendor_product
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*smsexec.exe" Processes.process_name IN ("*bitsadmin.exe", "*certutil.exe", "*cmd.exe", "*conhost.exe", "*cscript.exe", "*curl.exe", "*mshta.exe", "*net.exe", "*net1.exe", "*powershell.exe", "*pwsh.exe", "*reg.exe", "*regsvr32.exe", "*rundll32.exe", "*wmic.exe", "*wscript.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sccm_smsexec_spawned_a_suspicious_child_process_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: 'smsexec.exe is not expected to spawn interactive shells or scripting engines under normal operating conditions.
 
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_sccm_smsexec_spawned_a_suspicious_child_process_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    smsexec.exe is not expected to spawn interactive shells or scripting engines under normal operating conditions.
-    False positives are unlikely. Validate the full command line and file hash of any match before tuning.
+    False positives are unlikely. Validate the full command line and file hash of any match before tuning.'
 references:
     - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca
     - https://attack.mitre.org/techniques/T1574/001/
@@ -75,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_scheduled_task_created_in_a_group_policy_object.yml b/detections/endpoint/windows_scheduled_task_created_in_a_group_policy_object.yml
index 39b1acfaaea..51fe85eadc8 100644
--- a/detections/endpoint/windows_scheduled_task_created_in_a_group_policy_object.yml
+++ b/detections/endpoint/windows_scheduled_task_created_in_a_group_policy_object.yml
@@ -6,30 +6,13 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    When a scheduled task is created within a Group Policy, a characteristic file ScheduledTasks.xml with its definition is created in the respective subfolder of the SYSVOL share.
-    This rule can hit on legitimate GPO scheduled task creation, but this does not happen often and is therefore an effective way to monitor for malicious scheduled tasks.
+description: 'When a scheduled task is created within a Group Policy, a characteristic file ScheduledTasks.xml with its definition is created in the respective subfolder of the SYSVOL share.
+
+    This rule can hit on legitimate GPO scheduled task creation, but this does not happen often and is therefore an effective way to monitor for malicious scheduled tasks.'
 data_source:
     - Windows Event Log Security 5145
-search: |-
-    `wineventlog_security`
-    EventID=5145
-    ShareName="\\*\\SYSVOL"
-    RelativeTargetName="*\\ScheduledTasks\\ScheduledTasks.xml"
-    RelativeTargetName="*\\Policies\\*"
-    AccessList IN (
-        "*%%4417*",
-        "*%%4418*"
-    )
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer ShareName RelativeTargetName AccessList
-
-    | rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_scheduled_task_created_in_a_group_policy_object_filter`
+search: |
+    `wineventlog_security` EventCode=5145 ShareName="\*\\SYSVOL" RelativeTargetName="*\\ScheduledTasks\\ScheduledTasks.xml" RelativeTargetName="*\\Policies\\*" AccessList IN ("*%%4417*", "*%%4418*") | eval src_user=src_user, AccessMask=AccessMask | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_created_in_a_group_policy_object_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate scheduled tasks are occasionally created via Group Policy Objects in managed environments. Filter alerts for approved GPO deployments to reduce false positives.
 references:
@@ -42,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential Scheduled task created in a Group Policy Object activity observed on $dest$.
     entity:
diff --git a/detections/endpoint/windows_scheduled_task_created_via_xml.yml b/detections/endpoint/windows_scheduled_task_created_via_xml.yml
index 96dc284c836..f7b96abd8b8 100644
--- a/detections/endpoint/windows_scheduled_task_created_via_xml.yml
+++ b/detections/endpoint/windows_scheduled_task_created_via_xml.yml
@@ -6,35 +6,17 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the creation of scheduled tasks in Windows using schtasks.exe with the "XML" parameter.
+description: 'The following analytic detects the creation of scheduled tasks in Windows using schtasks.exe with the "XML" parameter.
+
     This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details.
-    This activity is significant as it is a common technique for establishing persistence or achieving privilege escalation, often used by malware like Trickbot and Winter-Vivern. While creating a scheduled task via XML may be legitimate, it can also be abused by attackers. If confirmed malicious, this could allow attackers to maintain access, execute additional payloads, and potentially lead to data theft or ransomware deployment.
+
+    This activity is significant as it is a common technique for establishing persistence or achieving privilege escalation, often used by malware like Trickbot and Winter-Vivern. While creating a scheduled task via XML may be legitimate, it can also be abused by attackers. If confirmed malicious, this could allow attackers to maintain access, execute additional payloads, and potentially lead to data theft or ransomware deployment.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    (Processes.process_name=schtasks.exe OR Processes.original_file_name=schtasks.exe)
-    Processes.process IN ("* /create *", "* -create *")
-    Processes.process IN ("* /xml *", "* -xml *")
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_scheduled_task_created_via_xml_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*schtasks.exe" OR Processes.original_file_name="schtasks.exe" Processes.process IN ("* /create *", "* -create *") Processes.process IN ("* /xml *", "* -xml *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_created_via_xml_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Installers are known to create scheduled tasks via XML. Apply additional filters as needed.
 references:
@@ -48,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_scheduled_task_dll_module_loaded.yml b/detections/endpoint/windows_scheduled_task_dll_module_loaded.yml
index 68c16fff84a..45c9e911b06 100644
--- a/detections/endpoint/windows_scheduled_task_dll_module_loaded.yml
+++ b/detections/endpoint/windows_scheduled_task_dll_module_loaded.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects instances where the taskschd.dll is loaded by processes running in suspicious or writable directories. This activity is unusual, as legitimate processes that load taskschd.dll typically reside in protected system locations. Malware or threat actors may attempt to load this DLL from writable or non-standard directories to manipulate the Task Scheduler and execute malicious tasks. By identifying processes that load taskschd.dll in these unsafe locations, this detection helps security analysts flag potentially malicious activity and investigate further to prevent unauthorized system modifications.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7 Image IN ("*\\windows\\fonts\\*", "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", "*\\temp\\*", "*\\PerfLogs\\*") ImageLoaded = "*\\taskschd.dll" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_dll_module_loaded_filter`'
+search: |
+    `sysmon` EventCode=7 Image IN ("*\\windows\\fonts\\*", "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "*\\Windows\\repair\\*", "*\\temp\\*", "*\\PerfLogs\\*") ImageLoaded="*\\taskschd.dll" | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_dll_module_loaded_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: Third party Legitimate application may load this task schedule dll module.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A taskschd.dll was loaded by a process - [$Image$] on [$dest$]
     entity:
diff --git a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml
index 2da9f7d1039..940608d3842 100644
--- a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml
+++ b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml
@@ -6,57 +6,21 @@ modification_date: '2026-10-09'
 author: Steven Dick
 status: production
 type: TTP
-description: |
-    The following analytic detects when the Task Scheduler service ("svchost.exe -k netsvcs -p -s Schedule") spawns common command line, scripting, or shell execution binaries such as "powershell.exe" or "cmd.exe".
+description: 'The following analytic detects when the Task Scheduler service ("svchost.exe -k netsvcs -p -s Schedule") spawns common command line, scripting, or shell execution binaries such as "powershell.exe" or "cmd.exe".
+
     This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships.
+
     This activity is significant as attackers often abuse the Task Scheduler for execution and persistence, blending in with legitimate Windows operations.
-    If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, or escalate privileges within the environment.
+
+    If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, or escalate privileges within the environment.'
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-    count min(_time) as firstTime
-          max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.parent_process_name="svchost.exe"
-    Processes.parent_process="*-k*"
-    Processes.parent_process= "*netsvcs*"
-    Processes.parent_process="*-p*"
-    Processes.parent_process="*-s*"
-    Processes.parent_process="*Schedule*"
-    Processes.process_name IN(
-        "bash.exe",
-        "cmd.exe",
-        "cscript.exe",
-        "ksh.exe",
-        "powershell.exe",
-        "pwsh.exe",
-        "scrcons.exe",
-        "sh.exe",
-        "wscript.exe",
-        "zsh.exe"
-    )
-
-    by Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*svchost.exe" Processes.parent_process="*-k*" Processes.parent_process="*netsvcs*" Processes.parent_process="*-p*" Processes.parent_process="*-s*" Processes.parent_process="*Schedule*" Processes.process_name IN ("*bash.exe", "*cmd.exe", "*cscript.exe", "*ksh.exe", "*powershell.exe", "*pwsh.exe", "*scrcons.exe", "*sh.exe", "*wscript.exe", "*zsh.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_service_spawned_shell_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: 'Certain scheduled tasks will intentionally call a script via PowerShell or Cmd for example.
 
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_scheduled_task_service_spawned_shell_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    Certain scheduled tasks will intentionally call a script via PowerShell or Cmd for example.
-    These will trigger this detection. Evaluate if they are legitimate and apply filters as needed.
+    These will trigger this detection. Evaluate if they are legitimate and apply filters as needed.'
 references:
     - https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations
     - https://nasbench.medium.com/a-deep-dive-into-windows-scheduled-tasks-and-the-processes-running-them-218d1eed4cce
@@ -69,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A windows scheduled task spawned the shell application $process_name$ on $dest$.
     entity:
diff --git a/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml
index 34a5a5e7090..0552e5ec87a 100644
--- a/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml
+++ b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime  from datamodel=Endpoint.Processes where Processes.process_name = "schtasks.exe" Processes.process = "*/rl *" Processes.process = "* highest *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_with_highest_privileges_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*schtasks.exe" Processes.process="*/rl *" Processes.process="* highest *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_with_highest_privileges_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may arise from legitimate applications that create tasks to run as SYSTEM. Therefore, it's recommended to adjust filters based on parent process or modify the query to include world writable paths for restriction.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A $process_name$ process created a scheduled task $process$ with highest run level privilege on $dest$
     entity:
diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml
index 876973cadb7..6dc20038e5f 100644
--- a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml
+++ b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml
@@ -11,7 +11,7 @@ data_source:
     - Windows Event Log Security 4698
     - Windows Event Log Security 4700
     - Windows Event Log Security 4702
-search: "`wineventlog_security` EventCode IN (4698,4700,4702)\n| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)\n| xmlkv TaskContent\n| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode\n| lookup local=t windows_suspicious_tasks task_command as Command \n| where tool == \"shell command use\" OR tool == \"suspicious paths\"\n| eval command=TaskName, process=Command+if(isnotnull(Arguments),\" \".Arguments,\"\"), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode \n| `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)`\n| `windows_scheduled_task_with_suspicious_command_filter` "
+search: "`wineventlog_security` EventCode IN (4698,4700,4702)\n| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)\n| xmlkv TaskContent\n| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode\n| lookup local=t windows_suspicious_tasks task_command as Command \n| where tool == \"shell command use\" OR tool == \"suspicious paths\"\n| eval command=TaskName, process=Command+if(isnotnull(Arguments),\" \".Arguments,\"\"), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode \n| `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)`\n| `windows_scheduled_task_with_suspicious_command_filter`\n"
 how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
 known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. Windows Defender, Google Chrome, and MS Edge updates may trigger this detection.
 references:
@@ -27,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate schedule tasks on $dest$
       search: '`wineventlog_security` EventCode IN (4698,4700,4702) Computer="$dest$" Caller_User_Name="$user$"'
       earliest_offset: $info_min_time$
diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml
index e4e43f175d1..6854dc7b047 100644
--- a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml
+++ b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml
@@ -11,7 +11,7 @@ data_source:
     - Windows Event Log Security 4698
     - Windows Event Log Security 4700
     - Windows Event Log Security 4702
-search: |-
+search: |
     `wineventlog_security` EventCode IN (4698,4700,4702)
     | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)
     | xmlkv TaskContent
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate schedule tasks on $dest$
       search: '`wineventlog_security` EventCode IN (4698,4700,4702) | xmlkv TaskContent | search dest="$dest$" AND TaskName = "$TaskName$"'
       earliest_offset: $info_min_time$
diff --git a/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml b/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml
index 3575e03c08c..a3d7dc8cd22 100644
--- a/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml
+++ b/detections/endpoint/windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation or modification of Windows Scheduled Tasks related to CompMgmtLauncher or Eventvwr. These legitimate system utilities, used for launching the Computer Management Console and Event Viewer, can be abused by attackers to execute malicious payloads under the guise of normal system processes. By leveraging these tasks, adversaries can establish persistence or elevate privileges without raising suspicion. This detection helps security analysts identify unusual or unauthorized scheduled tasks involving these executables, allowing for timely investigation and remediation of potential threats.
 data_source:
     - Windows Event Log Security 4698
-search: '`wineventlog_security` EventCode=4698 TaskContent = "*&lt;Command&gt;C:\\Windows\\System32\\CompMgmtLauncher.exe&lt;/Command&gt;*" OR TaskContent = "*&lt;Command&gt;C:\\Windows\\System32\\zh-CN\\eventvwr.msc&lt;/Command&gt;*" OR TaskContent = "*&lt;Command&gt;C:\\Windows\\System32\\eventvwr.msc&lt;/Command&gt;*" | stats count min(_time) as firstTime max(_time) as lastTime by dest action EventData_Xml TaskContent TaskName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr_filter`'
+search: |
+    `wineventlog_security` EventCode=4698 TaskContent="*\\system32\\*" | eval TaskName=TaskName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA as well as the URL ToolBox application are also required.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A schedule task created for CompMgmtLauncher or Eventvwr on [$dest$].
     entity:
diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml
index 78b16365ea4..fb6c64d776c 100644
--- a/detections/endpoint/windows_schtasks_create_run_as_system.yml
+++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=schtasks.exe OR Processes.original_file_name=schtasks.exe) Processes.process="*/create *" Processes.process="*/ru *" Processes.process="*system*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_schtasks_create_run_as_system_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*schtasks.exe" OR Processes.original_file_name="schtasks.exe" Processes.process="*/create *" Processes.process="*/ru *" Processes.process="*system*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_schtasks_create_run_as_system_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives will be limited to legitimate applications creating a task to run as SYSTEM. Filter as needed based on parent process, or modify the query to have world writeable paths to restrict it.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An $process_name$ was created on endpoint $dest$ attempting to spawn as SYSTEM.
     entity:
diff --git a/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml b/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml
index 6f28e045505..3711c39e96e 100644
--- a/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml
+++ b/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=sc.exe
-            OR
-            Processes.original_file_name=sc.exe
-        )
-        Processes.process="*sdset *" Processes.process="*scmanager*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_scmanager_security_descriptor_tampering_via_sc_exe_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sc.exe" OR Processes.original_file_name="sc.exe" Processes.process="*sdset *" Processes.process="*scmanager*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scmanager_security_descriptor_tampering_via_sc_exe_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time. descriptor settings of the scmanager service should be immediately investigated and understood.
 references:
@@ -45,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/windows_screen_capture_in_temp_folder.yml b/detections/endpoint/windows_screen_capture_in_temp_folder.yml
index c9aa8093d14..d609dd1a527 100644
--- a/detections/endpoint/windows_screen_capture_in_temp_folder.yml
+++ b/detections/endpoint/windows_screen_capture_in_temp_folder.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation of screen capture files by the Braodo stealer malware. This stealer is known to capture screenshots of the victim's desktop as part of its data theft activities. The detection focuses on identifying unusual screen capture activity, especially when images are saved in directories often used by malware, such as temporary or hidden folders. Monitoring for these files helps to quickly identify malicious screen capture attempts, allowing security teams to respond and mitigate potential information exposure before sensitive data is compromised.
 data_source:
     - Sysmon EventID 11
-search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("screenshot.png", "screenshot.jpg","screenshot.bmp") Filesystem.file_path = "*\\temp\\*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_screen_capture_in_temp_folder_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*screenshot.png", "*screenshot.jpg", "*screenshot.bmp") Filesystem.file_path="*\\temp\\*" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_screen_capture_in_temp_folder_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A screen capture named as $file_name$ was created on $dest$.
     entity:
diff --git a/detections/endpoint/windows_screen_capture_via_powershell.yml b/detections/endpoint/windows_screen_capture_via_powershell.yml
index e920960e6fb..bed025f4c28 100644
--- a/detections/endpoint/windows_screen_capture_via_powershell.yml
+++ b/detections/endpoint/windows_screen_capture_via_powershell.yml
@@ -9,25 +9,8 @@ type: TTP
 description: The following analytic detects the execution of a PowerShell script designed to capture screen images on a host. It leverages PowerShell Script Block Logging to identify specific script block text patterns associated with screen capture activities. This behavior is significant as it may indicate an attempt to exfiltrate sensitive information by capturing desktop screenshots. If confirmed malicious, this activity could allow an attacker to gather visual data from the compromised system, potentially leading to data breaches or further exploitation.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventCode=4104
-    ScriptBlockText IN (
-        "*[Drawing.Graphics]::FromImage*",
-        "*Drawing.Bitmap*",
-        "*Graphics.FromImage*"
-    )
-    ScriptBlockText = "*.CopyFromScreen*"
-    | fillnull
-    | stats count min(_time) as firstTime max(_time) as lastTime
-      BY dest signature signature_id
-         user_id vendor_product EventID
-         Guid Opcode Name
-         Path ProcessID ScriptBlockId
-         ScriptBlockText
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_screen_capture_via_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*[Drawing.Graphics]::FromImage*", "*Drawing.Bitmap*", "*Graphics.FromImage*") Processes.process="*.CopyFromScreen*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_screen_capture_via_powershell_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -41,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A PowerShell script was identified possibly performing screen captures on $dest$.
     entity:
diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml
index b35892faca4..a56489ab06a 100644
--- a/detections/endpoint/windows_security_account_manager_stopped.yml
+++ b/detections/endpoint/windows_security_account_manager_stopped.yml
@@ -11,7 +11,7 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
       WHERE (
             "Processes.process_name"="net*.exe" "Processes.process"="*stop \"samss\"*"
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: 'The Windows Security Account Manager (SAM) was stopped via cli by $user$ on $dest$ by this command: $process$'
     entity:
diff --git a/detections/endpoint/windows_security_and_backup_services_stop.yml b/detections/endpoint/windows_security_and_backup_services_stop.yml
index 80924debe91..531189d378c 100644
--- a/detections/endpoint/windows_security_and_backup_services_stop.yml
+++ b/detections/endpoint/windows_security_and_backup_services_stop.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the suspicious termination of known services commonly targeted by ransomware before file encryption. It leverages Windows System Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow Copy, backup, and antivirus services are stopped. This activity is significant because ransomware often disables these services to avoid errors and ensure successful file encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering files inaccessible and potentially causing significant operational disruption and data loss.
 data_source:
     - Windows Event Log System 7036
-search: |-
+search: |
     `wineventlog_system`
     `normalized_service_binary_field`
     | rename param1 as display_name
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Known services $display_name$ terminated by a potential ransomware on $dest$
     entity:
diff --git a/detections/endpoint/windows_security_support_provider_reg_query.yml b/detections/endpoint/windows_security_support_provider_reg_query.yml
index 05312d2d3ed..f1a40ee2748 100644
--- a/detections/endpoint/windows_security_support_provider_reg_query.yml
+++ b/detections/endpoint/windows_security_support_provider_reg_query.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process = "* query *" AND Processes.process = "*\\SYSTEM\\CurrentControlSet\\Control\\LSA*" Processes.process IN ("*RunAsPPL*" , "*LsaCfgFlags*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_security_support_provider_reg_query_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*reg.exe" OR Processes.original_file_name="reg.exe" Processes.process="* query *" Processes.process="*\\SYSTEM\\CurrentControlSet\\Control\\LSA*" Processes.process IN ("*RunAsPPL*", "*LsaCfgFlags*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_security_support_provider_reg_query_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml
index 0628f561ccf..bb1b336eff4 100644
--- a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml
+++ b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_net` Processes.process="*group*" Processes.process IN ("*Domain Admins*", "*Enterprise Admins*", "*Schema Admins*", "*Account Operators*", "*Server Operators*", "*Protected Users*", "*Dns Admins*", "*Domain Computers*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_sensitive_group_discovery_with_net_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*net1.exe" OR Processes.original_file_name="net1.exe" Processes.process="*group*" Processes.process IN ("*Domain Admins*", "*Enterprise Admins*", "*Schema Admins*", "*Account Operators*", "*Server Operators*", "*Protected Users*", "*Dns Admins*", "*Domain Computers*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_group_discovery_with_net_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -42,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml
index 37af44ada55..af25261ac93 100644
--- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml
+++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml
@@ -12,37 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    (
-      (
-        (Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)
-        Processes.process IN ("*save*", "*export*")
-      )
-      OR
-      (
-        (Processes.process_name=regedit.exe OR Processes.original_file_name=REGEDIT.exe)
-        Processes.process IN ("*/E *", "*-E *")
-      )
-    )
-    Processes.process IN (
-      "*HKEY_LOCAL_MACHINE\\SAM*",
-      "*HKEY_LOCAL_MACHINE\\Security*",
-      "*HKEY_LOCAL_MACHINE\\System*",
-      "*HKLM\\SAM*",
-      "*HKLM\\Security*",
-      "*HKLM\\System*",
-    )
-    by Processes.action Processes.dest Processes.original_file_name
-    Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-    Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-    Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
-    Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
-    Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_sensitive_registry_hive_dump_via_commandline_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.process_name="*reg.exe" OR Processes.original_file_name="reg.exe" Processes.process IN ("*save*", "*export*")) OR (Processes.process_name="*regedit.exe" OR Processes.original_file_name="REGEDIT.exe" Processes.process IN ("*/E *", "*-E *")) Processes.process IN ("*HKEY_LOCAL_MACHINE\\SAM*", "*HKEY_LOCAL_MACHINE\\Security*", "*HKEY_LOCAL_MACHINE\\System*", "*HKLM\\SAM*", "*HKLM\\Security*", "*HKLM\\System*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_registry_hive_dump_via_commandline_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: It is possible some agent based products will generate false positives. Filter as needed.
 references:
@@ -59,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$
     entity:
diff --git a/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml b/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml
index db5f9816e42..109336e1b06 100644
--- a/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml
+++ b/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=gacutil.exe Processes.process IN ("*-i *","*/i *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_server_software_component_gacutil_install_to_gac_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*gacutil.exe" Processes.process IN ("*-i *", "*/i *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_server_software_component_gacutil_install_to_gac_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present if gacutil.exe is utilized day to day by developers. Filter as needed.
 references:
@@ -40,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a module to the global assembly cache.
     entity:
diff --git a/detections/endpoint/windows_service_create_kernel_mode_driver.yml b/detections/endpoint/windows_service_create_kernel_mode_driver.yml
index f67d945a730..727fd6143b4 100644
--- a/detections/endpoint/windows_service_create_kernel_mode_driver.yml
+++ b/detections/endpoint/windows_service_create_kernel_mode_driver.yml
@@ -12,18 +12,7 @@ data_source:
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-      where (Processes.process_name=sc.exe OR Processes.original_file_name=sc.exe) Processes.process="*create*" Processes.process IN ("*kernel*", "*filesys*") Processes.process="*type*"
-    by Processes.action Processes.dest Processes.original_file_name
-    Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-    Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-    Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
-    Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
-    Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_service_create_kernel_mode_driver_filter`
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sc.exe" OR Processes.original_file_name="sc.exe" Processes.process="*create*" Processes.process IN ("*kernel*", "*filesys*") Processes.process="*type*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_create_kernel_mode_driver_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present based on common applications adding new drivers, however, filter as needed.
 references:
@@ -38,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Service control, $process_name$, loaded a new kernel mode driver on $dest$ by $user$.
     entity:
diff --git a/detections/endpoint/windows_service_create_remcomsvc.yml b/detections/endpoint/windows_service_create_remcomsvc.yml
index fe59675ed37..90daf840be7 100644
--- a/detections/endpoint/windows_service_create_remcomsvc.yml
+++ b/detections/endpoint/windows_service_create_remcomsvc.yml
@@ -9,14 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of the RemComSvc service on a Windows endpoint, typically indicating lateral movement using RemCom.exe. It leverages Windows EventCode 7045 from the System event log, specifically looking for the "RemCom Service" name. This activity is significant as it often signifies unauthorized lateral movement within the network, which is a common tactic used by attackers to spread malware or gain further access. If confirmed malicious, this could lead to unauthorized access to sensitive systems, data exfiltration, or further compromise of the network.
 data_source:
     - Windows Event Log System 7045
-search: |-
-    `wineventlog_system` EventCode=7045 ServiceName="RemCom Service"
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest ImagePath ServiceName
-           ServiceType
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_service_create_remcomsvc_filter`
+search: |
+    `wineventlog_system` EventCode=7045 ServiceName="RemCom Service" | eval ServiceName=ServiceName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_create_remcomsvc_filter`
 how_to_implement: To implement this analytic, the Windows EventCode 7045 will need to be logged. The Windows TA for Splunk is also recommended.
 known_false_positives: False positives may be present, filter as needed based on administrative activity.
 references:
@@ -30,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_service_create_sliverc2.yml b/detections/endpoint/windows_service_create_sliverc2.yml
index 77ebe551377..b3baae36960 100644
--- a/detections/endpoint/windows_service_create_sliverc2.yml
+++ b/detections/endpoint/windows_service_create_sliverc2.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic detects the creation of a Windows service named "Sliver" with the description "Sliver Implant," indicative of SliverC2 lateral movement using the PsExec module. It leverages Windows EventCode 7045 from the System Event log to identify this activity. This behavior is significant as it may indicate an adversary's attempt to establish persistence or execute commands remotely. If confirmed malicious, this activity could allow attackers to maintain control over the compromised system, execute arbitrary code, and further infiltrate the network.
 data_source:
     - Windows Event Log System 7045
-search: |-
-    `wineventlog_system` EventCode=7045 ServiceName="sliver"
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY Computer EventCode ImagePath
-           ServiceName ServiceType
-      | rename Computer as dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_service_create_sliverc2_filter`
+search: |
+    `wineventlog_system` EventCode=7045 ServiceName="sliver" | eval ServiceName=ServiceName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_create_sliverc2_filter`
 how_to_implement: To implement this analytic, the Windows EventCode 7045 will need to be logged from the System Event log. The Windows TA for Splunk is also recommended.
 known_false_positives: False positives should be limited, but if another service out there is named Sliver, filtering may be needed.
 references:
@@ -32,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A user mode service was created on $dest$ related to SliverC2.
     entity:
diff --git a/detections/endpoint/windows_service_create_with_tscon.yml b/detections/endpoint/windows_service_create_with_tscon.yml
index 7702b9a3d68..1cb2e345770 100644
--- a/detections/endpoint/windows_service_create_with_tscon.yml
+++ b/detections/endpoint/windows_service_create_with_tscon.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=sc.exe Processes.process="*/dest:rdp-tcp*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_service_create_with_tscon_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sc.exe" Processes.process="*/dest:rdp-tcp*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_create_with_tscon_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may arise in the RDP Hijacking analytic when legitimate administrators access remote sessions for maintenance or troubleshooting purposes. These activities might resemble an attacker''s attempt to hijack a disconnected session, leading to false alarms. To mitigate the risk of false positives and improve the overall security posture, organizations can implement Group Policy to automatically disconnect RDP sessions when they are complete. By enforcing this policy, administrators ensure that disconnected sessions are promptly terminated, reducing the window of opportunity for an attacker to hijack a session. Additionally, organizations can also implement access control mechanisms and monitor the behavior of privileged accounts to further enhance security and reduce the chances of false positives in RDP Hijacking detection.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to hijack a RDP session.
     entity:
diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_name.yml b/detections/endpoint/windows_service_created_with_suspicious_service_name.yml
index 99789981a91..c4b73a223a6 100644
--- a/detections/endpoint/windows_service_created_with_suspicious_service_name.yml
+++ b/detections/endpoint/windows_service_created_with_suspicious_service_name.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the creation of a Windows Service with a known suspicious or malicious name using Windows Event ID 7045. It leverages logs from the `wineventlog_system` to identify these services installations. This activity is significant as adversaries, including those deploying Clop ransomware, often create malicious services for lateral movement, remote code execution, persistence, and execution. If confirmed malicious, this could allow attackers to maintain persistence, execute arbitrary code, and potentially escalate privileges, posing a severe threat to the environment.
 data_source:
     - Windows Event Log System 7045
-search: |-
+search: |
     `wineventlog_system` EventCode=7045
     | stats values(ImagePath) as process, count, min(_time) as firstTime, max(_time) as lastTime values(EventCode) as signature by Computer, ServiceName, StartType, ServiceType, UserID
     | eval process_name = replace(mvindex(split(process,"\\"),-1), "\"", "")
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate service events on $dest$
       search: '`wineventlog_system` EventCode=7045 ServiceName = "$object_name$" dest = "$dest$"'
       earliest_offset: $info_min_time$
diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml
index 849f4f315eb..9db37c51244 100644
--- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml
+++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation of a Windows Service with a binary path located in uncommon directories, using Windows Event ID 7045. It leverages logs from the `wineventlog_system` to identify services installed outside typical system directories. This activity is significant as adversaries, including those deploying Clop ransomware, often create malicious services for lateral movement, remote code execution, persistence, and execution. If confirmed malicious, this could allow attackers to maintain persistence, execute arbitrary code, and potentially escalate privileges, posing a severe threat to the environment.
 data_source:
     - Windows Event Log System 7045
-search: '`wineventlog_system` EventCode=7045 ImagePath = "*.exe" NOT (ImagePath IN ("*:\\Windows\\*", "*:\\Program File*", "*:\\Programdata\\*", "*%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ImagePath ServiceName ServiceType StartType Computer UserID | rename Computer as dest| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`'
+search: |
+    `wineventlog_system` EventCode=7045 ImagePath="*.exe" NOT (ImagePath IN ("*:\\Windows\\*", "*:\\Program File*", "*:\\Programdata\\*", "*%systemroot%\\*")) | eval ServiceName=ServiceName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
 known_false_positives: Legitimate applications may install services with uncommon services paths.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A service $ImagePath$ was created from a non-standard path using $ServiceName$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
index 0a4235b9494..40a1061356e 100644
--- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
+++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*create* AND Processes.process=*binpath*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_creation_on_remote_endpoint_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sc.exe" OR Processes.original_file_name="sc.exe" Processes.process="*\\\\*" Processes.process="*create*" Processes.process="*binpath*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_creation_on_remote_endpoint_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may create Windows Services on remote systems, but this activity is usually limited to a small set of hosts or users.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Windows Service was created on a remote endpoint from $dest$
     entity:
diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml
index 6a955fbe973..0d380eae5af 100644
--- a/detections/endpoint/windows_service_creation_using_registry_entry.yml
+++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the modification of registry keys that define Windows services using reg.exe. This detection leverages Splunk to search for specific keywords in the registry path, value name, and value data fields. This activity is significant because it indicates potential unauthorized changes to service configurations, a common persistence technique used by attackers. If confirmed malicious, this could allow an attacker to maintain access, escalate privileges, or move laterally within the network, leading to data theft, ransomware, or other damaging outcomes.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name = ImagePath) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_creation_using_registry_entry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name="*ImagePath" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_creation_using_registry_entry_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
 known_false_positives: Third party tools may used this technique to create services but not so common.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_service_deletion_in_registry.yml b/detections/endpoint/windows_service_deletion_in_registry.yml
index 5520a94bc9e..8a63a755c16 100644
--- a/detections/endpoint/windows_service_deletion_in_registry.yml
+++ b/detections/endpoint/windows_service_deletion_in_registry.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the deletion of a service from the Windows Registry under CurrentControlSet\Services. It leverages data from the Endpoint.Registry datamodel, specifically monitoring registry paths and actions related to service deletion. This activity is significant as adversaries may delete services to evade detection and hinder incident response efforts. If confirmed malicious, this action could disrupt legitimate services, impair system functionality, and potentially allow attackers to maintain a lower profile within the environment, complicating detection and remediation efforts.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SYSTEM\\CurrentControlSet\\Services*" AND (Registry.action = deleted OR (Registry.registry_value_name = DeleteFlag AND Registry.registry_value_data = 0x00000001 AND Registry.action=modified)) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_deletion_in_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name="*DeleteFlag" Registry.registry_value_data="0x00000001" Registry.action IN ("deleted", "modified") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_deletion_in_registry_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: This event can be seen when administrator delete a service or uninstall/reinstall a software that creates service entry, but it is still recommended to check this alert with high priority.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_service_execution_remcom.yml b/detections/endpoint/windows_service_execution_remcom.yml
index a98b4246e48..d1f4710244f 100644
--- a/detections/endpoint/windows_service_execution_remcom.yml
+++ b/detections/endpoint/windows_service_execution_remcom.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=remcom.exe OR Processes.original_file_name=RemCom.exe) Processes.process="*\\*" Processes.process IN ("*/user:*", "*/pwd:*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_execution_remcom_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*remcom.exe" OR Processes.original_file_name="RemCom.exe" Processes.process="*\\*" Processes.process IN ("*/user:*", "*/pwd:*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_execution_remcom_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present based on Administrative use. Filter as needed.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to move laterally.
     entity:
diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
index 42b11f63496..d1823072386 100644
--- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
+++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*start*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_initiation_on_remote_endpoint_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sc.exe" OR Processes.original_file_name="sc.exe" Processes.process="*\\\\*" Processes.process="*start*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_initiation_on_remote_endpoint_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may start Windows Services on remote systems, but this activity is usually limited to a small set of hosts or users.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Windows Service was started on a remote endpoint from $dest$
     entity:
diff --git a/detections/endpoint/windows_service_stop_attempt.yml b/detections/endpoint/windows_service_stop_attempt.yml
index 800a48499cb..a6c48f4d032 100644
--- a/detections/endpoint/windows_service_stop_attempt.yml
+++ b/detections/endpoint/windows_service_stop_attempt.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            (`process_net`
-            OR
-            `process_sc`) Processes.process="* stop *"
-        )
-        OR Processes.process="*Stop-Service *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_service_stop_attempt_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*net1.exe", "*sc.exe") OR Processes.original_file_name IN ("net1.exe", "sc.exe") Processes.process IN ("* stop *", "*Stop-Service *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_attempt_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Windows OS or software may stop and restart services due to some critical update.
 references:
@@ -43,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 analytic_story:
     - Prestige Ransomware
     - Graceful Wipe Out Attack
diff --git a/detections/endpoint/windows_service_stop_by_deletion.yml b/detections/endpoint/windows_service_stop_by_deletion.yml
index 24c7335a1f7..ee088b60a6a 100644
--- a/detections/endpoint/windows_service_stop_by_deletion.yml
+++ b/detections/endpoint/windows_service_stop_by_deletion.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name = sc.exe
-            OR
-            Processes.original_file_name = sc.exe
-        )
-        Processes.process="* delete *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_service_stop_by_deletion_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sc.exe" OR Processes.original_file_name="sc.exe" Processes.process="* delete *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_by_deletion_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_service_stop_win_updates.yml b/detections/endpoint/windows_service_stop_win_updates.yml
index 293b98d037a..ab0e3900480 100644
--- a/detections/endpoint/windows_service_stop_win_updates.yml
+++ b/detections/endpoint/windows_service_stop_win_updates.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects the disabling of Windows Update services, such as "Update Orchestrator Service for Windows Update," "WaaSMedicSvc," and "Windows Update." It leverages Windows System Event ID 7040 logs to identify changes in service start modes to 'disabled.' This activity is significant as it can indicate an adversary's attempt to evade defenses by preventing critical updates, leaving the system vulnerable to exploits. If confirmed malicious, this could allow attackers to maintain persistence and exploit unpatched vulnerabilities, compromising the integrity and security of the affected host.
 data_source:
     - Windows Event Log System 7040
-search: |-
-    `wineventlog_system` EventCode=7040 (service_name IN ("Update Orchestrator Service for Windows Update", "WaaSMedicSvc", "Windows Update") OR param1 IN ("UsoSvc", "WaaSMedicSvc", "wuauserv")) AND (param3=disabled OR start_mode = disabled)
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY Computer Error_Code service_name
-           start_mode param1 param2
-           param3 param4
-      | rename Computer as dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_service_stop_win_updates_filter`
+search: |
+    `wineventlog_system` EventCode=7040 service_name IN ("Update Orchestrator Service for Windows Update", "WaaSMedicSvc", "Windows Update") OR param1 IN ("UsoSvc", "WaaSMedicSvc", "wuauserv") param3="disabled" OR start_mode="disabled" | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_win_updates_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints (like Windows system.log Event ID 7040)
 known_false_positives: Network administrator may disable this services as part of its audit process within the network. Filter is needed.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml
index 1c849a2aa44..3e62a56938d 100644
--- a/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml
+++ b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml
@@ -6,42 +6,23 @@ modification_date: '2026-08-11'
 author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the use of net.exe or net1.exe to configure the Windows maximum password age policy as unlimited.
+description: 'The following analytic detects the use of net.exe or net1.exe to configure the Windows maximum password age policy as unlimited.
+
     It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and identifies executions of the `net accounts` command using the `/maxpwage:unlimited` option.
+
     When specified, Windows configures the maximum password age with an unlimited value, effectively preventing passwords governed by the affected password policy from expiring.
+
     This behavior is significant because an adversary may modify password expiration settings to weaken credential security controls and maintain access to compromised accounts for an extended period.
-    If confirmed malicious, this activity may indicate an attempt to establish or maintain persistence by preventing expected password rotation from invalidating credentials under the affected password policy.
+
+    If confirmed malicious, this activity may indicate an attempt to establish or maintain persistence by preventing expected password rotation from invalidating credentials under the affected password policy.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    `process_net`
-    Processes.process="* accounts *"
-    Processes.process IN ("* /maxpwage:unlimited*")
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_set_account_password_policy_to_unlimited_via_net_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    This behavior is not commonly seen in production environment and not advisable, investigate the activity and determine if it is malicious. Apply additional filters to reduce false positives as needed.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*net1.exe" OR Processes.original_file_name="net1.exe" Processes.process="* accounts *" Processes.process="* /maxpwage:unlimited*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_set_account_password_policy_to_unlimited_via_net_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: This behavior is not commonly seen in production environment and not advisable, investigate the activity and determine if it is malicious. Apply additional filters to reduce false positives as needed.
 references:
     - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
     - https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/net-commands-on-operating-systems
@@ -53,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_set_custom_dns_serverlevelplugin_via_dnscmd.yml b/detections/endpoint/windows_set_custom_dns_serverlevelplugin_via_dnscmd.yml
index 28ee3154c9e..e98682fc39d 100644
--- a/detections/endpoint/windows_set_custom_dns_serverlevelplugin_via_dnscmd.yml
+++ b/detections/endpoint/windows_set_custom_dns_serverlevelplugin_via_dnscmd.yml
@@ -6,36 +6,17 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects command-line usage of dnscmd.exe to configure the Microsoft DNS ServerLevelPluginDll setting.
+description: 'The following analytic detects command-line usage of dnscmd.exe to configure the Microsoft DNS ServerLevelPluginDll setting.
+
     This setting allows the DNS service to load an arbitrary DLL, which can be abused by attackers with DNS administrative privileges to execute code in the context of the DNS service.
-    If confirmed malicious, this activity could enable persistence, privilege escalation, or domain controller compromise through malicious DLL loading.
+
+    If confirmed malicious, this activity could enable persistence, privilege escalation, or domain controller compromise through malicious DLL loading.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_name="dnscmd.exe"
-    Processes.process="*/config *"
-    Processes.process="*/serverlevelplugindll *"
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_set_custom_dns_serverlevelplugin_via_dnscmd_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*dnscmd.exe" Processes.process="*/config *" Processes.process="*/serverlevelplugindll *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_set_custom_dns_serverlevelplugin_via_dnscmd_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate administrative activities may involve dnscmd.exe usage or registry changes for DLL management in DNS servers. Filter alerts to exclude authorized administrative actions.
 references:
@@ -49,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_set_network_profile_category_to_private_via_registry.yml b/detections/endpoint/windows_set_network_profile_category_to_private_via_registry.yml
index 218f97e78c7..59640d735c6 100644
--- a/detections/endpoint/windows_set_network_profile_category_to_private_via_registry.yml
+++ b/detections/endpoint/windows_set_network_profile_category_to_private_via_registry.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects attempts to modify the Windows Registry to change a network profile's category to "Private", which may indicate an adversary is preparing the environment for lateral movement or reducing firewall restrictions. Specifically, this activity involves changes to the Category value within the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID} registry path. A value of 1 corresponds to a private network profile, which typically enables less restrictive firewall policies. While this action can occur during legitimate network configuration, it may also be a sign of malicious behavior when combined with other indicators such as suspicious account activity, unexpected administrative privilege usage, or execution of unsigned binaries. Monitoring for this registry modification—especially outside standard IT processes or correlated with persistence mechanisms—can help identify stealthy post-exploitation activity.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\*" Registry.registry_value_name = "Category" Registry.registry_value_data = 0x00000001 by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_set_network_profile_category_to_private_via_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\*" Registry.registry_value_name="*Category" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_set_network_profile_category_to_private_via_registry_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_sharepoint_spinstall0_webshell_file_creation.yml b/detections/endpoint/windows_sharepoint_spinstall0_webshell_file_creation.yml
index c57a09b0dab..31fa2b80021 100644
--- a/detections/endpoint/windows_sharepoint_spinstall0_webshell_file_creation.yml
+++ b/detections/endpoint/windows_sharepoint_spinstall0_webshell_file_creation.yml
@@ -9,7 +9,8 @@ type: TTP
 description: This detection identifies the creation or modification of the "spinstall0.aspx" webshell file in Microsoft SharePoint directories. This file is a known indicator of compromise associated with the exploitation of CVE-2025-53770 (ToolShell vulnerability). Attackers exploit the vulnerability to drop webshells that provide persistent access to compromised SharePoint servers, allowing them to execute arbitrary commands, access sensitive data, and move laterally within the network.
 data_source:
     - Sysmon EventID 11
-search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name="spinstall0.aspx" AND (Filesystem.file_path="*\\microsoft shared\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS*" OR Filesystem.file_path="*\\microsoft shared\\Web Server Extensions\\15\\TEMPLATE\\LAYOUTS*") by Filesystem.dest Filesystem.user Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.action Filesystem.process_guid Filesystem.process_id Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sharepoint_spinstall0_webshell_file_creation_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*spinstall0.aspx" Filesystem.file_path IN ("*\\microsoft shared\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS*", "*\\microsoft shared\\Web Server Extensions\\15\\TEMPLATE\\LAYOUTS*") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sharepoint_spinstall0_webshell_file_creation_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process information from your endpoints. If you are using Sysmon, you must have at least Sysmon version 6.0.4 with Event Code 11 enabled. You can also use other EDR products or Windows Event Logs that capture file creation events. The detection requires the Endpoint data model, populated with file creation events in the SharePoint directories.
 known_false_positives: Limited false positives are expected as the spinstall0.aspx file is not a legitimate SharePoint component. However, there might be rare cases where legitimate files with similar names are created during SharePoint updates or maintenance. Verify the process that created the file and the file content to confirm malicious intent.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential SharePoint webshell (spinstall0.aspx) detected on $dest$ related to CVE-2025-53770.
     entity:
diff --git a/detections/endpoint/windows_shell_or_script_execution_from_iis_directory.yml b/detections/endpoint/windows_shell_or_script_execution_from_iis_directory.yml
index c44c7f425f7..83ba5081540 100644
--- a/detections/endpoint/windows_shell_or_script_execution_from_iis_directory.yml
+++ b/detections/endpoint/windows_shell_or_script_execution_from_iis_directory.yml
@@ -6,39 +6,17 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects Windows command tools such as cmd, PowerShell, or pwsh being executed from the IIS installation directory.
-    This can be indicative of exploitation of software reliant on IIS such as Exchange.
+description: 'Detects Windows command tools such as cmd, PowerShell, or pwsh being executed from the IIS installation directory.
+
+    This can be indicative of exploitation of software reliant on IIS such as Exchange.'
 data_source:
     - Sysmon EventID 1
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_current_directory="*:\\Windows\\System32\\inetsrv\\*"
-    Processes.parent_process_name IN (
-        "cmd.exe",
-        "powershell.exe",
-        "pwsh.exe"
-    )
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_shell_or_script_execution_from_iis_directory_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_current_directory="*\\system32\\*" Processes.parent_process_name IN ("*cmd.exe", "*powershell.exe", "*pwsh.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_shell_or_script_execution_from_iis_directory_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Occasional administrative scripts or automated tasks might execute commands in the IIS directory. These instances are rare but should be verified before raising alerts.
+references: []
 drilldown_searches:
     - earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
@@ -47,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_shell_process_from_crushftp.yml b/detections/endpoint/windows_shell_process_from_crushftp.yml
index 51992a59968..17f2b6534ac 100644
--- a/detections/endpoint/windows_shell_process_from_crushftp.yml
+++ b/detections/endpoint/windows_shell_process_from_crushftp.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=crushftpservice.exe
-        AND
-        `process_cmd`
-        OR
-        `process_powershell`
-      BY Processes.dest Processes.parent_process Processes.original_file_name
-         Processes.user Processes.action Processes.parent_process_exec
-         Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_path
-         Processes.process_exec Processes.process_guid Processes.process_hash
-         Processes.process_id Processes.process_integrity_level Processes.process_path
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_shell_process_from_crushftp_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.parent_process_name="*crushftpservice.exe" Processes.process_name="*cmd.exe" OR Processes.original_file_name="Cmd.Exe") OR Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_shell_process_from_crushftp_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -42,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible CrushFTP exploitation detected on $dest$ related to CVE-2025-31161.
     entity:
diff --git a/detections/endpoint/windows_short_lived_dns_record.yml b/detections/endpoint/windows_short_lived_dns_record.yml
index 05f539a7b72..73092d6c832 100644
--- a/detections/endpoint/windows_short_lived_dns_record.yml
+++ b/detections/endpoint/windows_short_lived_dns_record.yml
@@ -10,17 +10,8 @@ description: The following analytic identifies the creation and quick deletion o
 data_source:
     - Windows Event Log Security 5136
     - Windows Event Log Security 5137
-search: |-
-    `wineventlog_security` ((EventCode=5137  ObjectClass="dnsNode") OR (EventCode=5136 ObjectClass="dnsNode" AttributeLDAPDisplayName="dNSTombstoned" AttributeValue="TRUE"))
-      | stats min(_time) as firstTime max(_time) as lastTime values(EventCode) as event_codes values(ObjectDN) as dns_record values(SubjectUserName) as user values(Computer) as dest
-        BY ObjectGUID
-      | where mvcount(event_codes)=2
-      | eval time_diff=lastTime - firstTime
-      | where time_diff <= 300
-      | table firstTime, lastTime, dns_record, user, dest, time_diff, ObjectGUID
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_short_lived_dns_record_filter`
+search: |
+    `wineventlog_security` EventCode=5136 (EventCode="5137" ObjectClass="dnsNode") OR (ObjectClass="dnsNode" AttributeLDAPDisplayName="dNSTombstoned" AttributeValue="TRUE") | eval ObjectDN=ObjectDN, SubjectUserName=SubjectUserName, SubjectUserSid=SubjectUserSid, Computer=Computer, User=SubjectUserSid, user=SubjectUserName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_short_lived_dns_record_filter`
 how_to_implement: To successfully implement this search, you ned to be ingesting Event codes `5136` and `5137`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. For these event codes to be generated, specific SACLs are required.
 known_false_positives: Creating and deleting a DNS server object within 30 seconds or less is unusual but not impossible in a production environment. Filter as needed.
 references:
@@ -35,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A short-lived DNS object was created and deleted on $dest$
     entity:
diff --git a/detections/endpoint/windows_sip_provider_inventory.yml b/detections/endpoint/windows_sip_provider_inventory.yml
index a1f739ad55b..94ba2ede26f 100644
--- a/detections/endpoint/windows_sip_provider_inventory.yml
+++ b/detections/endpoint/windows_sip_provider_inventory.yml
@@ -8,7 +8,8 @@ status: production
 type: Hunting
 description: The following analytic identifies all SIP (Subject Interface Package) providers on a Windows system using PowerShell scripted inputs. It detects SIP providers by capturing DLL paths from relevant events. This activity is significant because malicious SIP providers can be used to bypass trust controls, potentially allowing unauthorized code execution. If confirmed malicious, this activity could enable attackers to subvert system integrity, leading to unauthorized access or persistent threats within the environment. Analysts should review for new and non-standard paths to identify potential threats.
 data_source: []
-search: '`subjectinterfacepackage` Dll=*\\*.dll | stats count min(_time) as firstTime max(_time) as lastTime values(Dll) by Path host| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_sip_provider_inventory_filter`'
+search: |
+    `subjectinterfacepackage` Dll=*\\*.dll | stats count min(_time) as firstTime max(_time) as lastTime values(Dll) by Path host| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_sip_provider_inventory_filter`
 how_to_implement: To implement this analytic, one must first perform inventory using a scripted inputs. Review the following Gist - https://gist.github.com/MHaggis/75dd5db546c143ea67703d0e86cdbbd1
 known_false_positives: False positives are limited as this is a hunting query for inventory.
 references:
diff --git a/detections/endpoint/windows_sip_winverifytrust_failed_trust_validation.yml b/detections/endpoint/windows_sip_winverifytrust_failed_trust_validation.yml
index f55820b188d..3af9839e1ec 100644
--- a/detections/endpoint/windows_sip_winverifytrust_failed_trust_validation.yml
+++ b/detections/endpoint/windows_sip_winverifytrust_failed_trust_validation.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects failed trust validation attempts using Windows Event Log - CAPI2 (CryptoAPI 2). It specifically triggers on EventID 81, which indicates that "The digital signature of the object did not verify." This detection leverages the CAPI2 Operational log to identify instances where digital signatures fail to validate. Monitoring this activity is crucial as it can indicate attempts to execute untrusted or potentially malicious binaries. If confirmed malicious, this activity could allow attackers to bypass security controls and execute unauthorized code, leading to potential system compromise.
 data_source:
     - Windows Event Log CAPI2 81
-search: |-
+search: |
     `capi2_operational` EventID=81 "The digital signature of the object did not verify."
       | xmlkv UserData_Xml
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml
index 7f30fc9011f..7864d7bfd50 100644
--- a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml
+++ b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies the creation of a .crmlog file within the %windows%\Registration directory, typically with a format of <RANDOM_GUID>.<RANDOM_GUID>.crmlog. This detection leverages the Endpoint.Filesystem datamodel to monitor file creation events in the specified directory. This activity is significant as it is associated with the Snake malware, which uses this file for its operations. If confirmed malicious, this could indicate the presence of Snake malware, leading to potential data exfiltration, system compromise, and further malicious activities. Immediate investigation is required to mitigate the threat.
 data_source:
     - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\windows\\registration\\*" AND  Filesystem.file_name="*.crmlog" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_snake_malware_file_modification_crmlog_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\windows\\registration\\*" Filesystem.file_name="*.crmlog" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_snake_malware_file_modification_crmlog_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives may be present as the file pattern does match legitimate files on disk. It is possible other native tools write the same file name scheme.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A file related to Snake Malware has been identified on $dest$.
     entity:
diff --git a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml
index 58cf6a4b3c8..47af2206a90 100644
--- a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml
+++ b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation of the comadmin.dat file in the %windows%\system32\Com directory, which is associated with Snake Malware. This detection leverages the Endpoint.Filesystem data model to identify file creation events matching the specified path and filename. This activity is significant because the comadmin.dat file is part of Snake Malware's installation process, which includes dropping a kernel driver and a custom DLL. If confirmed malicious, this activity could allow an attacker to load a malicious driver, potentially leading to privilege escalation and persistent access to the compromised system.
 data_source:
     - Sysmon EventID 11
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\windows\\system32\\com\\*" AND Filesystem.file_name="comadmin.dat" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_snake_malware_kernel_driver_comadmin_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\system32\\*" Filesystem.file_name="*comadmin.dat" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_snake_malware_kernel_driver_comadmin_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives may be present, filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A kernel driver comadmin.dat related to Snake Malware was written to disk on $dest$.
     entity:
diff --git a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml
index 8b662a65d1a..d04148ed56b 100644
--- a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml
+++ b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic identifies modifications to the registry path .wav\\OpenWithProgIds, associated with the Snake Malware campaign. It leverages data from the Endpoint.Registry datamodel to detect changes in this specific registry location. This activity is significant because Snake's WerFault.exe uses this registry path to decrypt an encrypted blob containing critical components like the AES key, IV, and paths for its kernel driver and loader. If confirmed malicious, this could allow the attacker to load and execute Snake's kernel driver, leading to potential system compromise and persistent access.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\.wav\\OpenWithProgIds\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_snake_malware_registry_modification_wav_openwithprogids_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\.wav\\OpenWithProgIds\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_snake_malware_registry_modification_wav_openwithprogids_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives may be present and will require tuning based on program Ids in large organizations.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A registry modification related to Snake Malware has been identified on $dest$.
     entity:
diff --git a/detections/endpoint/windows_snake_malware_service_create.yml b/detections/endpoint/windows_snake_malware_service_create.yml
index 9417bdc3bd3..cbcf7352d3f 100644
--- a/detections/endpoint/windows_snake_malware_service_create.yml
+++ b/detections/endpoint/windows_snake_malware_service_create.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the creation of a new service named WerFaultSvc with a binary path in the Windows WinSxS directory. It leverages Windows System logs, specifically EventCode 7045, to identify this activity. This behavior is significant because it indicates the presence of Snake malware, which uses this service to maintain persistence by blending in with legitimate Windows services. If confirmed malicious, this activity could allow an attacker to execute Snake malware components, leading to potential data exfiltration, system compromise, and long-term persistence within the environment.
 data_source:
     - Windows Event Log System 7045
-search: '`wineventlog_system` EventCode=7045  ImagePath="*\\windows\\winSxS\\*" ImagePath="*\Werfault.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_snake_malware_service_create_filter`'
+search: |
+    `wineventlog_system` EventCode=7045 ImagePath="*\\windows\\winSxS\\*" ImagePath="*Werfault.exe" | eval ServiceName=ServiceName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_snake_malware_service_create_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Windows System logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
 known_false_positives: False positives should be limited as this is a strict primary indicator used by Snake Malware.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A service, WerFaultSvc, was created on $dest$ and is related to Snake Malware.
     entity:
diff --git a/detections/endpoint/windows_snappybee_create_test_registry.yml b/detections/endpoint/windows_snappybee_create_test_registry.yml
index 09e419305cd..25698f40317 100644
--- a/detections/endpoint/windows_snappybee_create_test_registry.yml
+++ b/detections/endpoint/windows_snappybee_create_test_registry.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects modifications to the Windows registry under `SOFTWARE\Microsoft\Test`, a location rarely used by legitimate applications in a production environment. Monitoring this key is crucial, as adversaries may create or alter values here for monitoring update of itself file path, updated configuration file, or system mark compromised. The detection leverages **Sysmon Event ID 13** (Registry Value Set) to identify unauthorized changes. Analysts should investigate processes associated with these modifications, particularly unsigned executables or suspicious command-line activity, as they may indicate malware or unauthorized software behavior.
 data_source:
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Test\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_snappybee_create_test_registry_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Test\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_snappybee_create_test_registry_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: Administrators and third party software may create this registry entry.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: a Test registry Entry [$registry_path$] was created on [$dest$].
     entity:
diff --git a/detections/endpoint/windows_soaphound_binary_execution.yml b/detections/endpoint/windows_soaphound_binary_execution.yml
index 9c81ec750cf..f8a4183dc77 100644
--- a/detections/endpoint/windows_soaphound_binary_execution.yml
+++ b/detections/endpoint/windows_soaphound_binary_execution.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name="soaphound.exe"
-        OR
-        Processes.original_file_name="soaphound.exe"
-        AND
-        Processes.process IN ("*--buildcache *", "*--bhdump *", "*--certdump *", "*--dnsdump *", "*-c *", "*--cachefilename *", "*-o *", "*--outputdirectory *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_soaphound_binary_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.original_file_name="soaphound.exe" Processes.process IN ("*--buildcache *", "*--bhdump *", "*--certdump *", "*--dnsdump *", "*-c *", "*--cachefilename *", "*-o *", "*--outputdirectory *")) OR Processes.process_name="*soaphound.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_soaphound_binary_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited as the command-line arguments are specific to SOAPHound. Filter as needed.
 references:
@@ -41,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The process $process_name$ was executed on $dest$ related to SOAPHound.
     entity:
diff --git a/detections/endpoint/windows_softether_vpn_masquerading_as_legitimate_binary.yml b/detections/endpoint/windows_softether_vpn_masquerading_as_legitimate_binary.yml
index 9d913e5cd7a..0f667b2d94d 100644
--- a/detections/endpoint/windows_softether_vpn_masquerading_as_legitimate_binary.yml
+++ b/detections/endpoint/windows_softether_vpn_masquerading_as_legitimate_binary.yml
@@ -6,35 +6,13 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Flax Typhoon actors have been identified downloading and using SoftEther VPN software to obfuscate their activity.
-    This searches for the SoftEther VPN binary running with the obfuscated binary names they use for the process.
+description: 'Flax Typhoon actors have been identified downloading and using SoftEther VPN software to obfuscate their activity.
+
+    This searches for the SoftEther VPN binary running with the obfuscated binary names they use for the process.'
 data_source:
     - Sysmon EventID 1
-search: |-
-    `sysmon`
-    EventID=1
-    process IN (
-        "*conhost.exe*",
-        "*dllhost.exe*"
-    )
-    AND
-    (
-        Company="*SoftEther*"
-        OR
-        OriginalFileName="vpnbridge*.exe"
-    )
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer EventID Company process action dest original_file_name
-         parent_process parent_process_exec parent_process_guid parent_process_id
-         parent_process_name parent_process_path process_hash process_integrity_level user
-         user_id vendor_product
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_softether_vpn_masquerading_as_legitimate_binary_filter`
+search: |
+    `sysmon` EventCode=1 CommandLine IN ("*conhost.exe*", "*dllhost.exe*") Company="*SoftEther*" OR OriginalFileName="vpnbridge*.exe" | eval src_user=src_user | stats count min(_time) as firstTime max(_time) as lastTime by action dest original_file_name parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process process_exec process_guid process_hash process_id process_integrity_level process_name process_path user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_softether_vpn_masquerading_as_legitimate_binary_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate users may run SoftEther VPN for remote access or privacy purposes. Exclude known approved VPN usage to reduce false alerts.
 references:
@@ -47,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential SoftEther VPN Masquerading as Legitimate Binary activity observed on $dest$.
     entity:
diff --git a/detections/endpoint/windows_software_discovery_via_powershell.yml b/detections/endpoint/windows_software_discovery_via_powershell.yml
index 49babf409fa..dc2e54a6e99 100644
--- a/detections/endpoint/windows_software_discovery_via_powershell.yml
+++ b/detections/endpoint/windows_software_discovery_via_powershell.yml
@@ -6,29 +6,18 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects the use of PowerShell based registry queries to pull installed software information from the Uninstall key.
+description: 'Detects the use of PowerShell based registry queries to pull installed software information from the Uninstall key.
+
     This will give an attacker version information on installed software which could be used to identify further vulnerabilities.
-    False positives are unlikely as this is an unusual key to query with PowerShell.
+
+    False positives are unlikely as this is an unusual key to query with PowerShell.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventID="4104"
-    ScriptBlockText="*Get-ItemProperty *"
-    ScriptBlockText="*Windows\\CurrentVersion\\Uninstall*"
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer EventID ScriptBlockText signature signature_id user_id vendor_product Guid
-         Opcode Name Path ProcessID ScriptBlockId
-
-    | rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_software_discovery_via_powershell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*Get-ItemProperty *" Processes.process="*Windows\\CurrentVersion\\Uninstall*" by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_software_discovery_via_powershell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate system administrators or security tools may query the Uninstall key via PowerShell for software inventory or compliance checks. Filter as needed to allow authorized management scripts.
+references: []
 drilldown_searches:
     - earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
@@ -37,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml b/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml
index 83a9efc8816..e4729fd2101 100644
--- a/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml
+++ b/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name IN ("onenote.exe", "onenotem.exe") `process_mshta`
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_spearphishing_attachment_onenote_spawn_mshta_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*onenote.exe", "*onenotem.exe") Processes.process_name="*mshta.exe" OR Processes.original_file_name="MSHTA.EXE" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_spearphishing_attachment_onenote_spawn_mshta_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives known. Filter as needed.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Office process $parent_process_name$ observed executing a suspicious child process $process_name$ with process ID $process_id$ on host $dest$
     entity:
diff --git a/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml b/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml
index b855be1693c..2aa559d7302 100644
--- a/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml
+++ b/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects a user authenticating with special privileges on 30 or more remote endpoints within a 5-minute window. It leverages Event ID 4672 from Windows Security logs to identify this behavior. This activity is significant as it may indicate lateral movement or remote code execution by an adversary. If confirmed malicious, the attacker could gain extensive control over the network, potentially leading to privilege escalation, data exfiltration, or further compromise of the environment. Security teams should adjust detection thresholds based on their specific environment.
 data_source:
     - Windows Event Log Security 4672
-search: |-
+search: |
     `wineventlog_security` EventCode=4672 AND NOT(Caller_User_Name IN ("DWM-1","DWM-2","DWM-3","LOCAL SERVICE","NETWORK SERVICE","SYSTEM","*$"))
       | bucket span=5m _time
       | stats dc(Computer) AS unique_targets values(Computer) as dest values(PrivilegeList) as privileges
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: 'A user $user$ obtained special privileges on a large number of endpoints (Count: $unique_targets$) within 5 minutes.'
     entity:
diff --git a/detections/endpoint/windows_speechruntime_com_hijacking_dll_load.yml b/detections/endpoint/windows_speechruntime_com_hijacking_dll_load.yml
index 4363489415f..5f3d8df0cac 100644
--- a/detections/endpoint/windows_speechruntime_com_hijacking_dll_load.yml
+++ b/detections/endpoint/windows_speechruntime_com_hijacking_dll_load.yml
@@ -9,22 +9,8 @@ type: TTP
 description: SpeechRuntime is vulnerable to an attack that allows a user to run code on another user's session remotely and stealthily by exploiting a Windows COM class. When this class is invoked, it launches SpeechRuntime.exe in the context of the currently logged-on user. Because this COM class is susceptible to COM Hijacking, the attacker can alter the registry remotely to point to a malicious DLL. By dropping that DLL on the target system (e.g., via SMB) and triggering the COM object, the attacker causes the malicious DLL to load into SpeechRuntime.exe and executing under the user's context. This detection identifies suspicious DLL loads by SpeechRuntime.exe from outside the expected locations.
 data_source:
     - Sysmon EventID 7
-search: |-
-    `sysmon` EventCode=7 Image="*SpeechRuntime.exe"
-      | eval image_loaded_lower = lower(ImageLoaded)
-      | search NOT image_loaded_lower="*system32*"
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY Image ImageLoaded dest
-           loaded_file loaded_file_path original_file_name
-           parent_process_name parent_process_guid process_exec
-           process_guid process_hash process_id
-           process_name process_path service_dll_signature_exists
-           service_dll_signature_verified signature signature_id
-           user_id vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_speechruntime_com_hijacking_dll_load_filter`
+search: |
+    `sysmon` EventCode=7 Image="*SpeechRuntime.exe" NOT image_loaded_lower="*system32*" | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_speechruntime_com_hijacking_dll_load_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config.
 known_false_positives: This process should normally never be loading dlls from outside the Windows system directory.
 references:
@@ -37,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible Lateral Movement abusing Speech Runtime on $dest$
     entity:
diff --git a/detections/endpoint/windows_speechruntime_suspicious_child_process.yml b/detections/endpoint/windows_speechruntime_suspicious_child_process.yml
index 769900e1ad4..27b7ac68119 100644
--- a/detections/endpoint/windows_speechruntime_suspicious_child_process.yml
+++ b/detections/endpoint/windows_speechruntime_suspicious_child_process.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.parent_process_name="*SpeechRuntime.exe*"
-        )
-        Processes.process IN ("*cmd.exe*","*powershell.exe*","*rundll32.exe*","*bitsadmin.exe*","*wmic.exe*","*cscript.exe*")
-      BY Processes.dest Processes.user Processes.original_file_name
-         Processes.parent_process Processes.process_name Processes.process
-         Processes.process_id Processes.parent_process_id Processes.parent_process_name
-         action parent_process_exec parent_process_guid
-         parent_process_path process_exec process_guid
-         process_hash process_integrity_level process_path
-         user_id vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_speechruntime_suspicious_child_process_filter`
+search: |
+    `sysmon` EventCode=1 ParentImage="*SpeechRuntime.exe*" CommandLine IN ("*cmd.exe*", "*powershell.exe*", "*rundll32.exe*", "*bitsadmin.exe*", "*wmic.exe*", "*cscript.exe*") | eval src_user=src_user | stats count min(_time) as firstTime max(_time) as lastTime by action dest original_file_name parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process process_exec process_guid process_hash process_id process_integrity_level process_name process_path user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_speechruntime_suspicious_child_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: This process should normally never be spawning these child processes.
 references:
@@ -40,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible Lateral Movement on $dest$ by abusing SpeechRuntime.
     entity:
diff --git a/detections/endpoint/windows_sql_server_configuration_option_hunt.yml b/detections/endpoint/windows_sql_server_configuration_option_hunt.yml
index 01fb43937cc..4c8d6ed4e15 100644
--- a/detections/endpoint/windows_sql_server_configuration_option_hunt.yml
+++ b/detections/endpoint/windows_sql_server_configuration_option_hunt.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: This detection helps hunt for changes to SQL Server configuration options that could indicate malicious activity. It monitors for modifications to any SQL Server configuration settings, allowing analysts to identify potentially suspicious changes that may be part of an attack, such as enabling dangerous features or modifying security-relevant settings.
 data_source:
     - Windows Event Log Application 15457
-search: |-
+search: |
     `wineventlog_application` EventCode=15457
       | rex field=EventData_Xml "<Data>(?<config_name>[^<]+)</Data><Data>(?<old_value>[^<]+)</Data><Data>(?<new_value>[^<]+)</Data>"
       | rename host as dest
@@ -43,6 +43,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.001/simulation/windows-application.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Application
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_sql_server_critical_procedures_enabled.yml b/detections/endpoint/windows_sql_server_critical_procedures_enabled.yml
index c300a27be0b..a18c14f3035 100644
--- a/detections/endpoint/windows_sql_server_critical_procedures_enabled.yml
+++ b/detections/endpoint/windows_sql_server_critical_procedures_enabled.yml
@@ -9,7 +9,7 @@ type: TTP
 description: This detection identifies when critical SQL Server configuration options are modified, including "Ad Hoc Distributed Queries", "external scripts enabled", "Ole Automation Procedures", "clr enabled", and "clr strict security". These features can be abused by attackers for various malicious purposes - Ad Hoc Distributed Queries enables Active Directory reconnaissance through ADSI provider, external scripts and Ole Automation allow execution of arbitrary code, and CLR features can be used to run custom assemblies. Enabling these features could indicate attempts to gain code execution or perform reconnaissance through SQL Server.
 data_source:
     - Windows Event Log Application 15457
-search: |-
+search: |
     `wineventlog_application` EventCode=15457
       | rex field=EventData_Xml "<Data>(?<config_name>[^<]+)</Data><Data>(?<old_value>[^<]+)</Data><Data>(?<new_value>[^<]+)</Data>"
       | where config_name IN ("Ad Hoc Distributed Queries", "external scripts enabled", "Ole Automation Procedures", "clr enabled", "clr strict security")
@@ -41,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: SQL Server critical procedure "$config_name$" was $change_type$ on host $dest$, which could indicate an attempt to gain code execution or perform reconnaissance
     entity:
@@ -63,7 +63,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.001/simulation/adhocdq_windows_application.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Application
+          sourcetype: XmlWinEventLog
       description: PORTED MANUAL TEST - The risk message is dynamically generated in the SPL and it needs to be manually tested for integration testing.
       test_type: experimental
diff --git a/detections/endpoint/windows_sql_server_extended_procedure_dll_loading_hunt.yml b/detections/endpoint/windows_sql_server_extended_procedure_dll_loading_hunt.yml
index ec0832df2f7..b3f9bc07867 100644
--- a/detections/endpoint/windows_sql_server_extended_procedure_dll_loading_hunt.yml
+++ b/detections/endpoint/windows_sql_server_extended_procedure_dll_loading_hunt.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: This analytic detects when SQL Server loads DLLs to execute extended stored procedures. This is particularly important for security monitoring as it indicates the first-time use or version changes of potentially dangerous procedures like xp_cmdshell, sp_OACreate, and others. While this is a legitimate operation, adversaries may abuse these procedures for execution, discovery, or privilege escalation.
 data_source:
     - Windows Event Log Application 8128
-search: |-
+search: |
     `wineventlog_application` EventCode=8128
       | rex field=EventData_Xml "<Data>(?<dll_name>[^<]+)</Data><Data>(?<dll_version>[^<]+)</Data><Data>(?<procedure_name>[^<]+)</Data>"
       | rename host as dest
@@ -41,6 +41,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.001/simulation/dllprocedureload_windows-application.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Application
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_sql_server_startup_procedure.yml b/detections/endpoint/windows_sql_server_startup_procedure.yml
index c8864c8c696..c7034bcf334 100644
--- a/detections/endpoint/windows_sql_server_startup_procedure.yml
+++ b/detections/endpoint/windows_sql_server_startup_procedure.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: This detection identifies when a startup procedure is registered or executed in SQL Server. Startup procedures automatically execute when SQL Server starts, making them an attractive persistence mechanism for attackers. The detection monitors for suspicious stored procedure names and patterns that may indicate malicious activity, such as attempts to execute operating system commands or gain elevated privileges.
 data_source:
     - Windows Event Log Application 17135
-search: '`wineventlog_application` EventCode=17135 | rex field=EventData_Xml "<Data>(?<startup_procedure>[^<]+)</Data>" | rename host as dest | eval risk_score=case( match(lower(startup_procedure), "xp_|sp_|cmdshell|shell|exec"), 90, true(), 70 ) | eval risk_message="SQL Server startup procedure ''".startup_procedure."'' was launched on host ".dest | stats count min(_time) as firstTime max(_time) as lastTime by dest EventCode startup_procedure risk_message risk_score | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sql_server_startup_procedure_filter`'
+search: |
+    `wineventlog_application` EventCode=17135 | rex field=EventData_Xml "<Data>(?<startup_procedure>[^<]+)</Data>" | rename host as dest | eval risk_score=case( match(lower(startup_procedure), "xp_|sp_|cmdshell|shell|exec"), 90, true(), 70 ) | eval risk_message="SQL Server startup procedure '".startup_procedure."' was launched on host ".dest | stats count min(_time) as firstTime max(_time) as lastTime by dest EventCode startup_procedure risk_message risk_score | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sql_server_startup_procedure_filter`
 how_to_implement: To successfully implement this detection, you need to be ingesting Windows Application Event Logs from SQL Server instances. The detection specifically looks for EventID 17135 which indicates startup procedure execution. Ensure proper logging is enabled for SQL Server startup events and that the logs are being forwarded to your SIEM.
 known_false_positives: Legitimate startup procedures may be used by database administrators for maintenance, monitoring, or application functionality. Common legitimate uses include database maintenance and cleanup jobs, performance monitoring and statistics collection, application initialization procedures, and system health checks. To reduce false positives, organizations should document approved startup procedures, maintain an inventory of expected startup procedures, monitor for changes to startup procedure configurations, and create exceptions for known good procedures.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -51,7 +52,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.001/simulation/sql_startupprocedure_widows-application.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Application
+          sourcetype: XmlWinEventLog
       description: PORTED MANUAL TEST - The risk message is dynamically generated in the SPL and it needs to be manually tested for integration testing.
       test_type: experimental
diff --git a/detections/endpoint/windows_sql_server_xp_cmdshell_config_change.yml b/detections/endpoint/windows_sql_server_xp_cmdshell_config_change.yml
index 7e1717ce849..8aa2cac5027 100644
--- a/detections/endpoint/windows_sql_server_xp_cmdshell_config_change.yml
+++ b/detections/endpoint/windows_sql_server_xp_cmdshell_config_change.yml
@@ -9,7 +9,7 @@ type: TTP
 description: This detection identifies when the xp_cmdshell configuration is modified in SQL Server. The xp_cmdshell extended stored procedure allows execution of operating system commands and programs from SQL Server, making it a high-risk feature commonly abused by attackers for privilege escalation and lateral movement.
 data_source:
     - Windows Event Log Application 15457
-search: |-
+search: |
     `wineventlog_application` EventCode=15457
       | rex field=EventData_Xml "<Data>(?<config_name>[^<]+)</Data><Data>(?<old_value>[^<]+)</Data><Data>(?<new_value>[^<]+)</Data>"
       | rename host as dest
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: View all SQL Server configuration changes on this host in the last 7 days
       search: '`wineventlog_application` EventCode=15457 host="$dest$" | rex field=EventData_Xml "<Data>(?<config_name>[^<]+)</Data><Data>(?<old_value>[^<]+)</Data><Data>(?<new_value>[^<]+)</Data>" | stats count values(config_name) as "Changed Settings" values(new_value) as "New Values" by _time dest'
       earliest_offset: -7d
diff --git a/detections/endpoint/windows_sql_spawning_certutil.yml b/detections/endpoint/windows_sql_spawning_certutil.yml
index 6de25147d0e..cdc77286027 100644
--- a/detections/endpoint/windows_sql_spawning_certutil.yml
+++ b/detections/endpoint/windows_sql_spawning_certutil.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name IN ("sqlservr.exe", "sqlagent.exe", "sqlps.exe", "launchpad.exe", "sqldumper.exe") `process_certutil` (Processes.process="*urlcache*"
-        OR
-        Processes.process="*verifyctl*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_sql_spawning_certutil_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*sqlservr.exe", "*sqlagent.exe", "*sqlps.exe", "*launchpad.exe", "*sqldumper.exe") Processes.process_name="*certutil.exe" OR Processes.original_file_name="CertUtil.exe" Processes.process IN ("*urlcache*", "*verifyctl*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sql_spawning_certutil_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: The occurrence of false positives should be minimal, given that the SQL agent does not typically download software using CertUtil.
 references:
diff --git a/detections/endpoint/windows_sqlcmd_execution.yml b/detections/endpoint/windows_sqlcmd_execution.yml
index 05f388a9050..46136efb491 100644
--- a/detections/endpoint/windows_sqlcmd_execution.yml
+++ b/detections/endpoint/windows_sqlcmd_execution.yml
@@ -11,17 +11,12 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sqlcmd.exe OR Processes.original_file_name=sqlcmd.exe) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | eval process_lower=lower(process) | eval is_help_check=case( match(process, "(?i)-[?]"), 1, match(process_lower, "(?i)--help"), 1, match(process_lower, "(?i)--version"), 1, true(), 0 ), has_parameters=if(match(process, "-[A-Za-z]"), 1, 0), has_query=case( match(process, "-[Qq]\\s+"), 1, match(process_lower, "--query\\s+"), 1, match(process_lower, "--initial-query\\s+"), 1, true(), 0 ), has_output=case( match(process, "-[oO]\\s+"), 1, match(process_lower, "--output-file\\s+"), 1, true(), 0 ), has_input=case( match(process, "-[iI]\\s+"), 1, match(process_lower, "--input-file\\s+"), 1, true(), 0 ), has_url_input=case( match(process, "-[iI]\\s+https?://"), 1, match(process_lower, "--input-file\\s+https?://"), 1, match(process, "-[iI]\\s+ftp://"), 1, match(process_lower, "--input-file\\s+ftp://"), 1, true(), 0 ), has_admin_conn=case( match(process, "-A"), 1, match(process_lower, "--dedicated-admin-connection"), 1, true(), 0 ), has_suspicious_auth=case( match(process, "-U\\s+sa\\b"), 1, match(process_lower, "--user-name\\s+sa\\b"), 1, match(process, "-U\\s+admin\\b"), 1, match(process_lower, "--user-name\\s+admin\\b"), 1, match(process, "-E\\b"), 1, match(process_lower, "--use-trusted-connection"), 1, true(), 0 ), has_local_server=case( match(process, "-S\\s+127\\.0\\.0\\.1"), 1, match(process_lower, "--server\\s+127\\.0\\.0\\.1"), 1, match(process, "-S\\s+localhost"), 1, match(process_lower, "--server\\s+localhost"), 1, true(), 0 ), has_suspicious_output=case( match(process_lower, "-o\\s+.*\\.(txt|csv|dat)"), 1, match(process_lower, "--output-file\\s+.*\\.(txt|csv|dat)"), 1, true(), 0 ), has_cert_bypass=case( match(process, "-C"), 1, match(process_lower, "--trust-server-certificate"), 1, true(), 0 ), has_suspicious_query=case( match(process_lower, "(xp_cmdshell|sp_oacreate|sp_execute_external|openrowset|bulk\\s+insert)"), 1, match(process_lower, "(master\\.\\.\\.sysdatabases|msdb\\.\\.\\.backuphistory|sysadmin|securityadmin)"), 1, match(process_lower, "(select.*from.*sys\\.|select.*password|dump\\s+database)"), 1, match(process_lower, "(sp_addextendedproc|sp_makewebtask|sp_addsrvrolemember)"), 1, match(process_lower, "(sp_configure.*show\\s+advanced|reconfigure|enable_xp_cmdshell)"), 1, match(process_lower, "(exec.*master\\.dbo\\.|exec.*msdb\\.dbo\\.)"), 1, match(process_lower, "(sp_password|sp_control_dbmasterkey_password|sp_dropextendedproc)"), 1, match(process_lower, "(powershell|cmd\\.exe|rundll32|regsvr32|certutil)"), 1, true(), 0 ), has_suspicious_path=case( match(process_lower, "(\\\\temp\\\\|\\\\windows\\\\|\\\\public\\\\|\\\\users\\\\public\\\\|\\\\programdata\\\\)"), 1, match(process_lower, "(\\\\desktop\\\\.*\\.(zip|rar|7z|tar|gz))"), 1, match(process_lower, "(\\\\downloads\\\\.*\\.(dat|bin|tmp))"), 1, match(process_lower, "(\\\\appdata\\\\local\\\\temp\\\\|\\\\windows\\\\tasks\\\\)"), 1, match(process_lower, "(\\\\recycler\\\\|\\\\system32\\\\|\\\\system volume information\\\\)"), 1, match(process_lower, "(\\.vbs|\\.ps1|\\.bat|\\.cmd|\\.exe)$"), 1, true(), 0 ), has_suspicious_combo=case( match(process, "-E") AND match(process_lower, "(?i)xp_cmdshell"), 1, match(process, "-Q") AND match(process_lower, "(?i)exec\\s+master"), 1, has_local_server=1 AND has_suspicious_query=1, 1, true(), 0 ), has_obfuscation=case( match(process_lower, "(char\\(|convert\\(|cast\\(|declare\\s+@)"), 1, match(process_lower, "(exec\\s+\\(|exec\\s+@|;\\s*exec)"), 1, match(process, "\\^|\\%|\\+\\+|\\-\\-"), 1, len(process) > 500, 1, true(), 0 ), has_data_exfil=case( match(process_lower, "(for\\s+xml|for\\s+json)"), 1, match(process_lower, "(bulk\\s+insert.*from)"), 1, match(process_lower, "(bcp.*queryout|bcp.*out)"), 1, match(process_lower, "(select.*into.*from|select.*into.*outfile)"), 1, true(), 0 )
-
-    | eval risk_score=0 | eval risk_score=case( is_help_check=1, 0, has_parameters=0, 0, has_suspicious_combo=1, risk_score + 90, has_suspicious_query=1, risk_score + 60, has_suspicious_path=1, risk_score + 40, has_url_input=1 AND has_output=1, risk_score + 80, has_query=1 AND has_output=1, risk_score + 30, has_query=1 AND has_suspicious_output=1, risk_score + 40, has_admin_conn=1, risk_score + 50, has_suspicious_auth=1, risk_score + 40, has_local_server=1 AND has_query=1, risk_score + 30, has_cert_bypass=1, risk_score + 20, has_obfuscation=1, risk_score + 70, has_data_exfil=1, risk_score + 60, true(), risk_score )
-
-    | eval risk_factors=mvappend( if((is_help_check=0 AND has_parameters=0), null(), if(has_suspicious_combo=1, "High-risk command combination detected", null())), if((is_help_check=0 AND has_parameters=0), null(), if(has_suspicious_query=1, "Suspicious SQL query pattern", null())), if(has_suspicious_path=1, "Suspicious output path", null()), if(has_url_input=1 AND has_output=1, "File download attempt", null()), if(has_query=1 AND has_output=1, "Query output to file", null()), if(has_admin_conn=1, "Admin connection", null()), if(has_suspicious_auth=1, "Suspicious authentication", null()), if(has_local_server=1, "Local server connection", null()), if(has_cert_bypass=1, "Certificate validation bypass", null()), if(has_obfuscation=1, "Command obfuscation detected", null()), if(has_data_exfil=1, "Potential data exfiltration", null()) ) | eval risk_message="SQLCMD execution with risk factors: ".mvjoin(risk_factors, ", ")
-
-    | where is_help_check=0 AND (risk_score >= 30 OR (has_parameters=1 AND has_suspicious_query=1)) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sqlcmd_execution_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*sqlcmd.exe" OR Processes.original_file_name="sqlcmd.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sqlcmd_execution_filter`
 how_to_implement: The analytic will need to be tuned based on organization specific data. Currently, set to hunting to allow for tuning. SQLCmd is a legitimate tool for database management and scripting tasks within enterprise environments. The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    Database administrators and developers commonly use sqlcmd.exe legitimately for database management and scripting tasks within enterprise environments. These legitimate activities often include database backups and restores, schema deployment scripts, automated database maintenance, and ETL processes. However, it's important to note that some organizations may have no sqlcmd.exe usage at all, making any detection highly suspicious. To effectively manage false positives, organizations should whitelist known administrator accounts, create exceptions for approved script paths and output locations, and add legitimate usage patterns to the filter macro as needed.
-    Recommend running this detection first as a hunt to review usage patterns. Following, modify the risk score and false positive list as needed.
+known_false_positives: 'Database administrators and developers commonly use sqlcmd.exe legitimately for database management and scripting tasks within enterprise environments. These legitimate activities often include database backups and restores, schema deployment scripts, automated database maintenance, and ETL processes. However, it''s important to note that some organizations may have no sqlcmd.exe usage at all, making any detection highly suspicious. To effectively manage false positives, organizations should whitelist known administrator accounts, create exceptions for approved script paths and output locations, and add legitimate usage patterns to the filter macro as needed.
+
+    Recommend running this detection first as a hunt to review usage patterns. Following, modify the risk score and false positive list as needed.'
 references:
     - https://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility
     - https://attack.mitre.org/techniques/T1078/
diff --git a/detections/endpoint/windows_sqlservr_spawning_shell.yml b/detections/endpoint/windows_sqlservr_spawning_shell.yml
index d4691a0d03e..2671ae6a168 100644
--- a/detections/endpoint/windows_sqlservr_spawning_shell.yml
+++ b/detections/endpoint/windows_sqlservr_spawning_shell.yml
@@ -10,22 +10,8 @@ description: This analytic detects instances where the sqlservr.exe process spaw
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name="sqlservr.exe" `process_cmd`
-        OR
-        `process_powershell`
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_sqlservr_spawning_shell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.parent_process_name="*sqlservr.exe" Processes.process_name="*cmd.exe" OR Processes.original_file_name="Cmd.Exe") OR Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sqlservr_spawning_shell_filter`
 how_to_implement: To implement this detection, you need to be ingesting endpoint data that captures process creation events, specifically the parent-child process relationships. Ensure that you are collecting Sysmon Event ID 1 or Windows Event Log Security 4688 events. The data should be mapped to the Endpoint data model in Splunk.
 known_false_positives: Legitimate administrative activities or monitoring tools might occasionally spawn command shells from sqlservr.exe. Review the process command-line arguments and consider filtering out known legitimate processes or users.
 references:
@@ -46,6 +32,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.001/simulation/sqlservr-windows_sysmon.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml b/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml
index 51507fca6d3..ccf543f9884 100644
--- a/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml
+++ b/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the abuse of SqlWriter and SQLDumper executables to sideload the vcruntime140.dll library. It leverages Sysmon EventCode 7 logs, focusing on instances where SQLDumper.exe or SQLWriter.exe load vcruntime140.dll, excluding legitimate loads from the System32 directory. This activity is significant as it indicates potential DLL sideloading, a technique used by adversaries to execute malicious code within trusted processes. If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, and evade detection by blending with legitimate processes.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7 (Image="*\\SQLDumper.exe" OR Image="*\\SQLWriter.exe") ImageLoaded="*\\vcruntime140.dll" NOT ImageLoaded="C:\\Windows\\System32\\*" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_sqlwriter_sqldumper_dll_sideload_filter`'
+search: |
+    `sysmon` EventCode=7 Image IN ("*\\SQLDumper.exe", "*\\SQLWriter.exe") ImageLoaded="*\\vcruntime140.dll" NOT ImageLoaded="C:\\Windows\\System32\\*" | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sqlwriter_sqldumper_dll_sideload_filter`
 how_to_implement: The analytic is designed to be run against Sysmon event logs collected from endpoints. The analytic requires the Sysmon event logs to be ingested into Splunk. The analytic searches for EventCode 7 where the Image is either SQLDumper.exe or SQLWriter.exe and the ImageLoaded is vcruntime140.dll. The search also filters out the legitimate loading of vcruntime140.dll from the System32 directory to reduce false positives. The analytic can be modified to include additional known good paths for vcruntime140.dll to further reduce false positives.
 known_false_positives: False positives are possible if legitimate processes are loading vcruntime140.dll from non-standard directories. It is recommended to investigate the context of the process loading vcruntime140.dll to determine if it is malicious or not. Modify the search to include additional known good paths for vcruntime140.dll to reduce false positives.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $Image$ loading $ImageLoaded$ was detected on $dest$.
     entity:
@@ -52,6 +53,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/wineloader/sqlwriter_sqldumper_sideload_windows-sysmon.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_ssh_proxy_command.yml b/detections/endpoint/windows_ssh_proxy_command.yml
index 02812d7a620..591b1d760ba 100644
--- a/detections/endpoint/windows_ssh_proxy_command.yml
+++ b/detections/endpoint/windows_ssh_proxy_command.yml
@@ -6,54 +6,19 @@ modification_date: '2026-10-09'
 author: Michael Haag, AJ King, Nasreddine Bencherchali, Splunk, Jesse Hunter, Splunk Community Contributor
 status: production
 type: Anomaly
-description: |
-    This detection identifies potential abuse of SSH "ProxyCommand" or "LocalCommand" by monitoring for suspicious process execution patterns.
+description: 'This detection identifies potential abuse of SSH "ProxyCommand" or "LocalCommand" by monitoring for suspicious process execution patterns.
+
     Specifically, it looks for instances where ssh.exe (as a parent process) containing "ProxyCommand" or "LocalCommand" in its arguments spawns potentially malicious child processes like mshta, powershell, wscript, or cscript, or processes containing "http" in their command line.
-    This technique can be used by attackers to execute arbitrary commands through SSH proxy configurations, potentially enabling command & control activities or remote code execution. The detection focuses on commonly abused Windows scripting engines and web requests that may indicate malicious activity when spawned through SSH proxy commands.
+
+    This technique can be used by attackers to execute arbitrary commands through SSH proxy configurations, potentially enabling command & control activities or remote code execution. The detection focuses on commonly abused Windows scripting engines and web requests that may indicate malicious activity when spawned through SSH proxy commands.'
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.parent_process_name="ssh.exe"
-    (
-      Processes.parent_process = "*ProxyCommand=*"
-      OR
-      (
-        Processes.parent_process = "* PermitLocalCommand=yes*"
-        Processes.parent_process = "* LocalCommand=*"
-      )
-    )
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*ssh.exe" Processes.parent_process="* PermitLocalCommand=yes*" Processes.parent_process IN ("*ProxyCommand=*", "* LocalCommand=*") Processes.process IN ("*cscript*", "*http*", "*mshta*", "*powershell*", "*pwsh*", "*wmic*", "*wscript*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ssh_proxy_command_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: 'Legitimate use of SSH ProxyCommand or LocalCommand with scripting engines may trigger this detection.
 
-    Processes.process IN (
-      "*cscript*",
-      "*http*",
-      "*mshta*",
-      "*powershell*",
-      "*pwsh*",
-      "*wmic*",
-      "*wscript*"
-    )
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id
-       Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_ssh_proxy_command_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    Legitimate use of SSH ProxyCommand or LocalCommand with scripting engines may trigger this detection.
-    Filter as needed based on your environment's normal SSH usage patterns and authorized scripting activities.
+    Filter as needed based on your environment''s normal SSH usage patterns and authorized scripting activities.'
 references:
     - https://www.virustotal.com/gui/file/c33f82868dbbfc3ab03918f430b1a348499f5baf047b136ff0a4fc3e8addaa9b/detection
     - https://attack.mitre.org/techniques/T1572/
@@ -68,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -103,6 +68,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/ssh_proxy_command/sshproxycommand_windows-sysmon.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml
index 114cc97b1e8..9c93eb7c9f3 100644
--- a/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml
+++ b/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml
@@ -10,7 +10,8 @@ description: The following analytic detects when a new certificate is requested
 data_source:
     - Windows Event Log Security 4886
     - Windows Event Log Security 4887
-search: "`wineventlog_security` EventCode IN (4886,4887) Attributes=\"*SAN:*upn*\" Attributes=\"*CertificateTemplate:*\" | stats count min(_time) as firstTime max(_time) as lastTime values(name) as name values(status) as status values(Subject) as ssl_subject values(SubjectKeyIdentifier) as ssl_hash by Computer, EventCode, Requester, Attributes, RequestId | `security_content_ctime(firstTime)`  | `security_content_ctime(lastTime)`| fillnull | rex field=Attributes \"(?i)CertificateTemplate:(?<object>[^\\r\\n]+)\" | rex field=Attributes \"(?i)ccm:(?<req_src>[^\\r\\n]+)\" | rex max_match=10 field=Attributes \"(?i)(upn=(?<req_user_1>[^\\r\\n&]+))\" | rex max_match=10 field=Attributes \"(?i)(dns=(?<req_dest_1>[^\\r\\n&]+))\" | rex field=Requester \"(.+\\\\\\\\)?(?<src_user>[^\\r\\n]+)\" | eval flavor_text = case(EventCode==\"4886\",\"A suspicious certificate was requested using request ID: \".'RequestId',EventCode==\"4887\", \"A suspicious certificate was issued using request ID: \".'RequestId'.\". To revoke this certifacte use this request ID or the SSL fingerprint [\".'ssl_hash'.\"]\"), dest = upper(coalesce(req_dest_1,req_dest_2)), src = upper(coalesce(req_src,Computer)) | fields - req_* | rename Attributes as object_attrs, EventCode as signature_id, name as signature, RequestId as ssl_serial, Requester as ssl_subject_common_name| `windows_steal_authentication_certificates___esc1_abuse_filter`"
+search: |
+    `wineventlog_security` EventCode IN (4886,4887) Attributes="*SAN:*upn*" Attributes="*CertificateTemplate:*" | stats count min(_time) as firstTime max(_time) as lastTime values(name) as name values(status) as status values(Subject) as ssl_subject values(SubjectKeyIdentifier) as ssl_hash by Computer, EventCode, Requester, Attributes, RequestId | `security_content_ctime(firstTime)`  | `security_content_ctime(lastTime)`| fillnull | rex field=Attributes "(?i)CertificateTemplate:(?<object>[^\r\n]+)" | rex field=Attributes "(?i)ccm:(?<req_src>[^\r\n]+)" | rex max_match=10 field=Attributes "(?i)(upn=(?<req_user_1>[^\r\n&]+))" | rex max_match=10 field=Attributes "(?i)(dns=(?<req_dest_1>[^\r\n&]+))" | rex field=Requester "(.+\\\\)?(?<src_user>[^\r\n]+)" | eval flavor_text = case(EventCode=="4886","A suspicious certificate was requested using request ID: ".'RequestId',EventCode=="4887", "A suspicious certificate was issued using request ID: ".'RequestId'.". To revoke this certifacte use this request ID or the SSL fingerprint [".'ssl_hash'."]"), dest = upper(coalesce(req_dest_1,req_dest_2)), src = upper(coalesce(req_src,Computer)) | fields - req_* | rename Attributes as object_attrs, EventCode as signature_id, name as signature, RequestId as ssl_serial, Requester as ssl_subject_common_name| `windows_steal_authentication_certificates___esc1_abuse_filter`
 how_to_implement: To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 115 of first reference. Recommend throttle correlation by RequestId/ssl_serial at minimum.
 known_false_positives: False positives may be generated in environments where administrative users or processes are allowed to generate certificates with Subject Alternative Names. Sources or templates used in these processes may need to be tuned out for accurate function.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible AD CS ESC1 activity by $src_user$ - $flavor_text$
     entity:
diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml
index 8686a907b3f..46ab48ff4df 100644
--- a/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml
+++ b/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml
@@ -10,7 +10,7 @@ description: The following analytic detects when a suspicious certificate with a
 data_source:
     - Windows Event Log Security 4887
     - Windows Event Log Security 4768
-search: |-
+search: |
     `wineventlog_security`
     EventCode IN (4887)
     Attributes="*SAN:*upn*"
@@ -72,7 +72,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$dest$", "$src_user$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible AD CS ESC1 authentication on $dest$
     entity:
diff --git a/detections/endpoint/windows_steal_authentication_certificates_certificate_issued.yml b/detections/endpoint/windows_steal_authentication_certificates_certificate_issued.yml
index 79ba5d6fc67..e13aa512a05 100644
--- a/detections/endpoint/windows_steal_authentication_certificates_certificate_issued.yml
+++ b/detections/endpoint/windows_steal_authentication_certificates_certificate_issued.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies the issuance of a new certificate by Certificate Services - AD CS, detected via Event ID 4887. This event logs the requester user context, DNS hostname of the requesting machine, and the request time. Monitoring this activity is crucial as it can indicate potential misuse of authentication certificates. If confirmed malicious, an attacker could use the issued certificate to impersonate users, escalate privileges, or maintain persistence within the environment. This detection helps in identifying and correlating suspicious certificate-related activities for further investigation.
 data_source:
     - Windows Event Log Security 4887
-search: |-
+search: |
     `wineventlog_security`  EventCode=4887
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY dest, name, Requester,
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_steal_authentication_certificates_certificate_request.yml b/detections/endpoint/windows_steal_authentication_certificates_certificate_request.yml
index ddcc313e731..0ee50db0de9 100644
--- a/detections/endpoint/windows_steal_authentication_certificates_certificate_request.yml
+++ b/detections/endpoint/windows_steal_authentication_certificates_certificate_request.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects when a new certificate is requested from Certificate Services - AD CS. It leverages Event ID 4886, which indicates that a certificate request has been received. This activity is significant because unauthorized certificate requests can be part of credential theft or lateral movement tactics. If confirmed malicious, an attacker could use the certificate to impersonate users, gain unauthorized access to resources, or establish persistent access within the environment. Monitoring and correlating this event with other suspicious activities is crucial for identifying potential security incidents.
 data_source:
     - Windows Event Log Security 4886
-search: |-
+search: |
     `wineventlog_security` EventCode=4886
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY dest, name, Requester,
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml b/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml
index c8858cc70e1..0048b878879 100644
--- a/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml
+++ b/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_certutil` Processes.process IN ("*-backupdb *", "*-backup *")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_steal_authentication_certificates_certutil_backup_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*certutil.exe" OR Processes.original_file_name="CertUtil.exe" Processes.process IN ("*-backupdb *", "*-backup *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_certutil_backup_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives will be generated based on normal certificate store backups. Leave enabled to generate Risk, as this is meant to be an anomaly analytic. If CS backups are not normal, enable as TTP.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml
index 88962307ce9..e4a786527b8 100644
--- a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml
+++ b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects the extraction of authentication certificates using Windows Event Log - CAPI2 (CryptoAPI 2). It leverages EventID 70, which is generated when a certificate's private key is acquired. This detection is significant because it can identify potential misuse of certificates, such as those extracted by tools like Mimikatz or Cobalt Strike. If confirmed malicious, this activity could allow attackers to impersonate users, escalate privileges, or access sensitive information, posing a severe risk to the organization's security.
 data_source:
     - Windows Event Log CAPI2 70
-search: |-
+search: |
     `capi2_operational` EventCode=70
       | xmlkv UserData_Xml
       | stats count min(_time) as firstTime max(_time) as lastTime
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_steal_authentication_certificates_cs_backup.yml b/detections/endpoint/windows_steal_authentication_certificates_cs_backup.yml
index ebdafed3cfb..7b0e8d1b3b1 100644
--- a/detections/endpoint/windows_steal_authentication_certificates_cs_backup.yml
+++ b/detections/endpoint/windows_steal_authentication_certificates_cs_backup.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies the backup of the Active Directory Certificate Services (AD CS) store, detected via Event ID 4876. This event is logged when a backup is performed using the CertSrv.msc UI or the CertUtil.exe -BackupDB command. Monitoring this activity is crucial as unauthorized backups can indicate an attempt to steal authentication certificates, which are critical for secure communications. If confirmed malicious, this activity could allow an attacker to impersonate users, escalate privileges, or access sensitive information, severely compromising the security of the environment.
 data_source:
     - Windows Event Log Security 4876
-search: |-
+search: |
     `wineventlog_security` EventCode=4876
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY dest, name, action,
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml
index c1ba66028d4..8abbe6c32eb 100644
--- a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml
+++ b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*export-certificate*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_steal_authentication_certificates_export_certificate_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*export-certificate*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_export_certificate_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Filtering may be requried based on automated utilities and third party applications that may export certificates.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml
index 703769f961c..c1ff9d3a5f0 100644
--- a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml
+++ b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process="*export-pfxcertificate*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_steal_authentication_certificates_export_pfxcertificate_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*export-pfxcertificate*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_export_pfxcertificate_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Filtering may be requried based on automated utilities and third party applications that may export certificates.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml b/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml
index 275ecc4c4a8..d1341920e79 100644
--- a/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml
+++ b/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name="klist.exe"
-        OR
-        Processes.original_file_name = "klist.exe" Processes.parent_process_name IN ("cmd.exe", "powershell*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_steal_or_forge_kerberos_tickets_klist_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.original_file_name="klist.exe" Processes.parent_process_name IN ("*cmd.exe", "*powershell")) OR Processes.process_name="*klist.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_or_forge_kerberos_tickets_klist_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/endpoint/windows_subinacl_execution.yml b/detections/endpoint/windows_subinacl_execution.yml
index 26d5dd45645..39ca30f9c83 100644
--- a/detections/endpoint/windows_subinacl_execution.yml
+++ b/detections/endpoint/windows_subinacl_execution.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name=subinacl.exe
-            OR
-            Processes.original_file_name=SubInAcl.exe
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_subinacl_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*subinacl.exe" OR Processes.original_file_name="SubInAcl.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_subinacl_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time. should be identified and understood.
 references:
@@ -43,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml
index 0a9380a2245..25361a024d4 100644
--- a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml
+++ b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects executables running from public or temporary locations that are communicating over Windows domain authentication ports/protocols such as LDAP (389), LDAPS (636), and Kerberos (88). It leverages network traffic data to identify processes originating from user-controlled directories. This activity is significant because legitimate applications rarely run from these locations and attempt domain authentication, making it a potential indicator of compromise. If confirmed malicious, attackers could leverage this to access domain resources, potentially leading to further exploitation and lateral movement within the network.
 data_source:
     - Sysmon EventID 3
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.process_id) as process_id  from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port IN ("88","389","636")  AND All_Traffic.app IN ("*\\users\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*") by All_Traffic.action All_Traffic.app All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product | `drop_dm_object_name(All_Traffic)`  | rex field=app ".*\\\(?<process_name>.*)$" | `security_content_ctime(firstTime)`  | `security_content_ctime(lastTime)` | `windows_suspect_process_with_authentication_traffic_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.process_id) as process_id  from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port IN ("88","389","636")  AND All_Traffic.app IN ("*\\users\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*") by All_Traffic.action All_Traffic.app All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product | `drop_dm_object_name(All_Traffic)`  | rex field=app ".*\\\(?<process_name>.*)$" | `security_content_ctime(firstTime)`  | `security_content_ctime(lastTime)` | `windows_suspect_process_with_authentication_traffic_filter`
 how_to_implement: To implement this analytic, Sysmon should be installed in the environment and generating network events for  userland and/or known public writable locations.
 known_false_positives: Known applications running from these locations for legitimate purposes. Targeting only kerberos (port 88) may significantly reduce noise.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/windows_suspicious_burst_of_password_changes.yml b/detections/endpoint/windows_suspicious_burst_of_password_changes.yml
index d8d495550ef..7e2ac870f03 100644
--- a/detections/endpoint/windows_suspicious_burst_of_password_changes.yml
+++ b/detections/endpoint/windows_suspicious_burst_of_password_changes.yml
@@ -6,50 +6,16 @@ modification_date: '2026-04-29'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    A regular user account performed rapid, repeated password changes across multiple local accounts within a 2-second window.
-    This pattern is consistent with automated credential manipulation tools that cycle account passwords to deny access to defenders or escalate privileges The speed and volume of changes indicates scripted or tooled activity rather than manual administration, as legitimate password resets do not occur at machine speed across multiple accounts simultaneously.
+description: 'A regular user account performed rapid, repeated password changes across multiple local accounts within a 2-second window.
+
+    This pattern is consistent with automated credential manipulation tools that cycle account passwords to deny access to defenders or escalate privileges The speed and volume of changes indicates scripted or tooled activity rather than manual administration, as legitimate password resets do not occur at machine speed across multiple accounts simultaneously.'
 data_source:
     - Windows Event Log Security 4723
     - Windows Event Log Security 4724
-search: |-
-    `wineventlog_security`
-    (
-        EventCode=4723
-        OR
-        EventCode=4724
-    )
-    | eval log_time = strptime(SystemTime, "%Y-%m-%dT%H:%M:%S.%6NZ")
-    | eval log_time = coalesce(log_time, _time)
-    | eval time_bucket = floor(log_time / 2) * 2
-    | eval SubjectRID = tonumber(replace(SubjectUserSid, ".*-(\d+)$", "\1"))
-    | where SubjectRID >= 1000
-    | stats count AS EventsForAccount
-            min(log_time) AS firstTime
-            max(log_time) AS lastTime
-      by Computer TargetUserName SubjectUserName time_bucket
-
-    | where EventsForAccount >= 4
-    | eval DurationSecs = round(lastTime - firstTime, 3), DurationSecs = if(DurationSecs = 0, 0.001, DurationSecs), ChangeRatePerSec = round(EventsForAccount / DurationSecs, 2)
-    | rename Computer as dest
-
-    | stats dc(TargetUserName) AS AffectedAccounts
-            values(TargetUserName) AS Accounts
-            values(SubjectUserName) AS InitiatingAccounts
-            sum(EventsForAccount) AS TotalEvents
-            max(ChangeRatePerSec) AS PeakChangeRatePerSec
-            min(DurationSecs) AS FastestBurstSecs
-            min(firstTime) AS firstTime
-            max(lastTime) AS lastTime
-      by dest time_bucket
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_suspicious_burst_of_password_changes_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting EventID 4723 and EventID 4724 events with the Windows TA.
-known_false_positives: |-
-    Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
+search: |
+    `wineventlog_security` EventCode=4723 EventCode="4724" | eval InitiatingAccounts=SubjectUserName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_burst_of_password_changes_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting EventID 4723 and EventID 4724 events with the Windows TA.
+known_false_positives: Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
 references:
     - https://github.com/Nightmare-Eclipse/BlueHammer
 drilldown_searches:
diff --git a/detections/endpoint/windows_suspicious_c2_named_pipe.yml b/detections/endpoint/windows_suspicious_c2_named_pipe.yml
index 1654dfc0f83..3bbd35f0652 100644
--- a/detections/endpoint/windows_suspicious_c2_named_pipe.yml
+++ b/detections/endpoint/windows_suspicious_c2_named_pipe.yml
@@ -6,10 +6,11 @@ modification_date: '2026-09-22'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects the creation or connection to known suspicious C2 named pipes.
+description: 'The following analytic detects the creation or connection to known suspicious C2 named pipes.
+
     It leverages Sysmon EventCodes 17 and 18 to identify known default pipe names used by C2 tools.
-    If confirmed malicious, this could allow an attacker to abuse these to potentially gain persistence, command and control, or further system compromise.
+
+    If confirmed malicious, this could allow an attacker to abuse these to potentially gain persistence, command and control, or further system compromise.'
 data_source:
     - Sysmon EventID 17
     - Sysmon EventID 18
@@ -43,8 +44,7 @@ search: |
     | `security_content_ctime(lastTime)`
     | `windows_suspicious_c2_named_pipe_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: |
-    False positives should be rare, investigate matches and apply additional filters as needed.
+known_false_positives: False positives should be rare, investigate matches and apply additional filters as needed.
 references:
     - https://attack.mitre.org/techniques/T1218/009/
     - https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes
@@ -56,7 +56,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $process_name$ located in $process_path$ was identified on endpoint $dest$ accessing known suspicious C2 named pipe $pipe_name$.
     entity:
diff --git a/detections/endpoint/windows_suspicious_child_process_of_consent_exe.yml b/detections/endpoint/windows_suspicious_child_process_of_consent_exe.yml
index dcf82d7b706..7485e098078 100644
--- a/detections/endpoint/windows_suspicious_child_process_of_consent_exe.yml
+++ b/detections/endpoint/windows_suspicious_child_process_of_consent_exe.yml
@@ -6,43 +6,23 @@ modification_date: '2026-07-30'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects unexpected child processes spawned by consent.exe, the Windows UAC consent dialog binary.
+description: 'The following analytic detects unexpected child processes spawned by consent.exe, the Windows UAC consent dialog binary.
+
     Consent.exe is responsible solely for rendering the UAC elevation prompt and should not spawn child processes under normal operating conditions; child process creation from this parent is a known indicator of UAC bypass and privilege escalation techniques.
+
     The detection identifies any executable launched as a child of consent.exe, excluding the expected WerFault.exe error reporting process, which may legitimately appear in crash scenarios.
-    This behavior is associated with UAC bypass exploits and has been observed in multiple post-exploitation frameworks as a means of obtaining elevated privileges without triggering a visible UAC prompt.
+
+    This behavior is associated with UAC bypass exploits and has been observed in multiple post-exploitation frameworks as a means of obtaining elevated privileges without triggering a visible UAC prompt.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*consent.exe" Processes.process_name="*.exe" NOT Processes.process_name="*WerFault.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_child_process_of_consent_exe_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: 'Legitimate software installations or system updates may occasionally trigger child processes under consent.exe but these should be rare.
 
-    Processes.parent_process_name="consent.exe"
-    Processes.process_name="*.exe"
-    NOT Processes.process_name="WerFault.exe"
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process
-       Processes.process_exec Processes.process_guid Processes.process_hash
-       Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_suspicious_child_process_of_consent_exe_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Legitimate software installations or system updates may occasionally trigger child processes under consent.exe but these should be rare.
-    Verify any flagged activity against known administrative actions or recent software changes.
+    Verify any flagged activity against known administrative actions or recent software changes.'
 references:
     - https://securelist.com/cve-2024-30051/112618/
 drilldown_searches:
@@ -81,8 +61,8 @@ category: endpoint
 security_domain: endpoint
 tests:
     - name: True Positive Test
-      test_type: unit
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/windows_suspicious_child_of_consent_exe/snapattack_windows.log
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
+      test_type: unit
diff --git a/detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml b/detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml
index 7cf0819d97d..431aeeddb9d 100644
--- a/detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml
+++ b/detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml
@@ -6,68 +6,17 @@ modification_date: '2026-05-01'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker's session.
-    RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
+description: 'Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker''s session.
+
+    RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker''s active session.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    Processes.parent_process_name="TieringEngineService.exe"
-    (
-        Processes.process IN (
-            "*bitsadmin.exe*",
-            "*cmd.exe*",
-            "*conhost.exe*",
-            "*cscript.exe*",
-            "*curl.exe*",
-            "*powershell.exe*",
-            "*pwsh.exe*",
-            "*rundll32.exe*",
-            "*wmic.exe*"
-        )
-        OR
-        Processes.process_name IN (
-            "bitsadmin.exe",
-            "cmd.exe",
-            "conhost.exe",
-            "cscript.exe",
-            "curl.exe",
-            "powershell.exe",
-            "pwsh.exe",
-            "rundll32.exe",
-            "wmic.exe"
-        )
-    )
-    Processes.user IN (
-        "*AUTHORITY*",
-        "*System*"
-    )
-
-    BY Processes.dest Processes.user Processes.original_file_name
-       Processes.parent_process Processes.process_name Processes.process
-       Processes.process_id Processes.parent_process_id
-       Processes.parent_process_name action
-       parent_process_exec parent_process_guid
-       parent_process_path process_exec process_guid
-       process_hash process_integrity_level
-       process_path user_id vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_suspicious_child_process_of_tieringengineservice_exe_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    No false positives have been identified at this time.
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*TieringEngineService.exe" Processes.process IN ("*bitsadmin.exe*", "*cmd.exe*", "*conhost.exe*", "*cscript.exe*", "*curl.exe*", "*powershell.exe*", "*pwsh.exe*", "*rundll32.exe*", "*wmic.exe*") OR Processes.process_name IN ("*bitsadmin.exe", "*cmd.exe", "*conhost.exe", "*cscript.exe", "*curl.exe", "*powershell.exe", "*pwsh.exe", "*rundll32.exe", "*wmic.exe") Processes.user IN ("*AUTHORITY*", "*System*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_child_process_of_tieringengineservice_exe_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://github.com/Nightmare-Eclipse/RedSun
     - https://www.huntress.com/blog/nightmare-eclipse-intrusion
@@ -79,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible suspicious child process $process_path$ spawned from $parent_process_path$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml b/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml
index ce06cb68350..766f1e80fa2 100644
--- a/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml
+++ b/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name IN ("arp.exe","at.exe","bash.exe","bitsadmin.exe","certutil.exe","cmd.exe","cscript.exe", "dsget.exe","dsquery.exe","find.exe","findstr.exe","fsutil.exe","hostname.exe","ipconfig.exe","ksh.exe","nbstat.exe", "net.exe","net1.exe","netdom.exe","netsh.exe","netstat.exe","nltest.exe","nslookup.exe","ntdsutil.exe","pathping.exe", "ping.exe","powershell.exe","pwsh.exe","qprocess.exe","query.exe","qwinsta.exe","reg.exe","rundll32.exe","sc.exe", "scrcons.exe","schtasks.exe","sh.exe","systeminfo.exe","tasklist.exe","tracert.exe","ver.exe","vssadmin.exe", "wevtutil.exe","whoami.exe","wmic.exe","wscript.exe","wusa.exe","zsh.exe")
-            AND
-            Processes.parent_process_name IN ("w3wp.exe", "http*.exe", "nginx*.exe", "php*.exe", "php-cgi*.exe","tomcat*.exe")
-        )
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_suspicious_child_process_spawned_from_webserver_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*arp.exe", "*at.exe", "*bash.exe", "*bitsadmin.exe", "*certutil.exe", "*cmd.exe", "*cscript.exe", "*dsget.exe", "*dsquery.exe", "*find.exe", "*findstr.exe", "*fsutil.exe", "*hostname.exe", "*ipconfig.exe", "*ksh.exe", "*nbstat.exe", "*net.exe", "*net1.exe", "*netdom.exe", "*netsh.exe", "*netstat.exe", "*nltest.exe", "*nslookup.exe", "*ntdsutil.exe", "*pathping.exe", "*ping.exe", "*powershell.exe", "*pwsh.exe", "*qprocess.exe", "*query.exe", "*qwinsta.exe", "*reg.exe", "*rundll32.exe", "*sc.exe", "*scrcons.exe", "*schtasks.exe", "*sh.exe", "*systeminfo.exe", "*tasklist.exe", "*tracert.exe", "*ver.exe", "*vssadmin.exe", "*wevtutil.exe", "*whoami.exe", "*wmic.exe", "*wscript.exe", "*wusa.exe", "*zsh.exe") Processes.parent_process_name IN ("w3wp.exe", "http*.exe", "nginx*.exe", "php*.exe", "php-cgi*.exe", "tomcat*.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_child_process_spawned_from_webserver_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate OS functions called by vendor applications, baseline the environment and filter before enabling. Recommend throttle by dest/process_name
 references:
@@ -43,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml b/detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml
index 6f5b06b99cf..9b4fe08d2fe 100644
--- a/detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml
+++ b/detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml
@@ -6,38 +6,17 @@ modification_date: '2026-04-27'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects Windows Defender engine (mpengine.dll) or signature database files (*.vdm) being created by any process that is not a Windows Defender component.
-    BlueHammer extracts these files from the downloaded mpam-fe update package into a UUID-named subdirectory of %TEMP% as part of staging the TOCTOU privilege escalation.
+description: 'Detects Windows Defender engine (mpengine.dll) or signature database files (*.vdm) being created by any process that is not a Windows Defender component.
+
+    BlueHammer extracts these files from the downloaded mpam-fe update package into a UUID-named subdirectory of %TEMP% as part of staging the TOCTOU privilege escalation.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    `sysmon` EventID="11"
-    TargetFilename IN (
-        "*\\mpasbase.vdm*",
-        "*\\mpasdlta.vdm*",
-        "*\\mpavbase.vdm*",
-        "*\\mpavdlta.vdm*",
-        "*\\mpengine.dll*"
-    )
-    NOT Image IN (
-        "*:\\ProgramData\\Microsoft\\Windows Defender\\*",
-        "*:\\Program Files\\Windows Defender\\*"
-    )
-    | fillnull
-    | rename Computer as dest
-    | stats count by dest TargetFilename Image EventID
-                     action file_name file_path process_guid
-                     process_id user vendor_product
+search: |
+    `sysmon` EventCode=11 TargetFilename IN ("*\\mpasbase.vdm*", "*\\mpasdlta.vdm*", "*\\mpavbase.vdm*", "*\\mpavdlta.vdm*", "*\\mpengine.dll*") NOT (Image IN ("*:\\ProgramData\\Microsoft\\Windows Defender\\*", "*:\\Program Files\\Windows Defender\\*")) | eval process_name=process_name, root_drive=root_drive | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name file_path process_guid process_id user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_defender_engine_or_signature_files_created_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: 'Some legitimate software updates or security tools may create Windows Defender engine or signature files in user temp folders during scanning or updating processes.
 
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_suspicious_defender_engine_or_signature_files_created_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Some legitimate software updates or security tools may create Windows Defender engine or signature files in user temp folders during scanning or updating processes.
-    Filter detections for trusted update utilities and system maintenance tasks.
+    Filter detections for trusted update utilities and system maintenance tasks.'
 references:
     - https://github.com/Nightmare-Eclipse/BlueHammer
 drilldown_searches:
diff --git a/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml b/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml
index 27fd49a2158..f193955995b 100644
--- a/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml
+++ b/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml
@@ -6,35 +6,18 @@ modification_date: '2026-07-20'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects a non-Defender process writing mpam-fe*.exe to the Windows Internet Cache (INetCache).
+description: 'Detects a non-Defender process writing mpam-fe*.exe to the Windows Internet Cache (INetCache).
+
     BlueHammer downloads the WD signature update package directly using WinINet as a low-privileged user.
-    The [1].exe naming suffix is produced by Windows HTTP caching and is a reliable artifact of this download method.
+
+    The [1].exe naming suffix is produced by Windows HTTP caching and is a reliable artifact of this download method.'
 data_source:
     - Sysmon EventID 11
     - Sysmon EventID 23
-search: |-
-    `sysmon`
-    EventID IN (11, 23, 26)
-    TargetFilename="*\\INetCache*"
-    TargetFilename="*\\mpam-fe[1].exe*"
-    NOT Image IN (
-        "*:\\Program Files\\Windows Defender*",
-        "*:\\ProgramData\\Microsoft\\Windows Defender*",
-        "*:\\Windows\\System32\\MpSigStub.exe*"
-    )
-    | fillnull
-    | rename Computer as dest
-    | stats count by dest TargetFilename Image EventID
-                     action file_name file_path process_guid
-                     process_id user vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_suspicious_defender_update_activity_in_inetcache_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Some legitimate system maintenance tools or security scanners may download updates using WinINet and write to INetCache with similar naming patterns. Filter alerts when these tools are verified and approved.
+search: |
+    `sysmon` EventCode=11 EventID IN ("23", "26") TargetFilename="*\\INetCache*" TargetFilename="*\\mpam-fe[1].exe*" NOT (Image IN ("*:\\Program Files\\Windows Defender*", "*:\\ProgramData\\Microsoft\\Windows Defender*", "*\\system32\\*")) | eval process_name=process_name, root_drive=root_drive | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name file_path process_guid process_id user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_defender_update_activity_in_inetcache_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Some legitimate system maintenance tools or security scanners may download updates using WinINet and write to INetCache with similar naming patterns. Filter alerts when these tools are verified and approved.
 references:
     - https://github.com/Nightmare-Eclipse/BlueHammer
 drilldown_searches:
diff --git a/detections/endpoint/windows_suspicious_driver_loaded_path.yml b/detections/endpoint/windows_suspicious_driver_loaded_path.yml
index c401f3b5a8e..5a7bd41b228 100644
--- a/detections/endpoint/windows_suspicious_driver_loaded_path.yml
+++ b/detections/endpoint/windows_suspicious_driver_loaded_path.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects the loading of drivers from suspicious paths, which is a technique often used by malicious software such as coin miners (e.g., xmrig). It leverages Sysmon EventCode 6 to identify drivers loaded from non-standard directories. This activity is significant because legitimate drivers typically reside in specific system directories, and deviations may indicate malicious activity. If confirmed malicious, this could allow an attacker to execute code at the kernel level, potentially leading to privilege escalation, persistence, or further system compromise.
 data_source:
     - Sysmon EventID 6
-search: '`sysmon` EventCode=6 ImageLoaded IN("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*Recycle.bin*", "*\\Windows\\Media\\*","\\Windows\\repair\\*", "*\\PerfLogs\\*", "*:\\Windows\\Prefetch\\*", "*:\\Windows\\Cursors\\*", "*\\temp\\*", "*\\download*", "*\\appdata\\*") |  stats  min(_time) as firstTime max(_time) as lastTime count by ImageLoaded dest dvc process_hash process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_driver_loaded_path_filter`'
+search: |
+    `sysmon` EventCode=6 ImageLoaded IN ("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "*\\Windows\\repair\\*", "*\\PerfLogs\\*", "*:\\Windows\\Prefetch\\*", "*:\\Windows\\Cursors\\*", "*\\temp\\*", "*\\download*", "*\\appdata\\*") | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc process_hash process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_driver_loaded_path_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: Limited false positives will be present. Some applications do load drivers
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious driver $ImageLoaded$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_suspicious_file_in_efi_volume.yml b/detections/endpoint/windows_suspicious_file_in_efi_volume.yml
index 149dff72ce6..810da6915a8 100644
--- a/detections/endpoint/windows_suspicious_file_in_efi_volume.yml
+++ b/detections/endpoint/windows_suspicious_file_in_efi_volume.yml
@@ -6,30 +6,15 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects data files in the EFI volume.
+description: 'Detects data files in the EFI volume.
+
     This is sometimes indicative of an actor attempting to bypass secure boot through vulnerabilities such as CVE-2024-7344.
-    These use vulnerable boot loaders to run malicious system firmware code.
+
+    These use vulnerable boot loaders to run malicious system firmware code.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.file_path="*\\EFI\\Boot\\*"
-    Filesystem.file_path="*.dat"
-
-    by Filesystem.dest Filesystem.file_create_time Filesystem.process_path
-       Filesystem.process_guid Filesystem.process_id Filesystem.file_path Filesystem.file_name
-       Filesystem.action Filesystem.user Filesystem.vendor_product
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_suspicious_file_in_efi_volume_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\EFI\\Boot\\*" Filesystem.file_name="*.dat" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_file_in_efi_volume_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate system or firmware update processes may create or modify files in the EFI volume. Review alerts carefully to distinguish between normal maintenance and suspicious activity.
 references:
@@ -43,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious EFI volume data file created at $file_path$ on $dest$.
     entity:
diff --git a/detections/endpoint/windows_suspicious_named_pipe.yml b/detections/endpoint/windows_suspicious_named_pipe.yml
index 38cc4205615..d76174e178b 100644
--- a/detections/endpoint/windows_suspicious_named_pipe.yml
+++ b/detections/endpoint/windows_suspicious_named_pipe.yml
@@ -6,11 +6,13 @@ modification_date: '2026-09-22'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects the creation or connection to known suspicious named pipes.
+description: 'The following analytic detects the creation or connection to known suspicious named pipes.
+
     It leverages Sysmon EventCodes 17 and 18 to identify known default pipe names used by malicious or suspicious tools.
+
     If confirmed malicious, this could allow an attacker to abuse these to potentially gain privilege escalation,
-    persistence, c2 communications, or further system compromise.
+
+    persistence, c2 communications, or further system compromise.'
 data_source:
     - Sysmon EventID 17
     - Sysmon EventID 18
@@ -43,12 +45,12 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_suspicious_named_pipe_filter`
-how_to_implement: |
-    To successfully implement this search, you need to be ingesting
+how_to_implement: 'To successfully implement this search, you need to be ingesting
+
     logs with the process name and pipename from your endpoints. If you are using Sysmon,
-    you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: |
-    False positives should be rare, investigate matches and apply additional filters as needed.
+
+    you must have at least version 6.0.4 of the Sysmon TA.'
+known_false_positives: False positives should be rare, investigate matches and apply additional filters as needed.
 references:
     - https://attack.mitre.org/techniques/T1218/009/
     - https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes
@@ -60,7 +62,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $process_name$ located in $process_path$ was identified on endpoint $dest$ accessing known suspicious named pipe $pipe_name$.
     entity:
diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml
index 4cf1735d21c..a02cd469220 100644
--- a/detections/endpoint/windows_suspicious_process_file_path.yml
+++ b/detections/endpoint/windows_suspicious_process_file_path.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path IN("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*Recycle.bin*", "*\\Windows\\Media\\*","\\Windows\\repair\\*", "*\\PerfLogs\\*", "*:\\Windows\\Prefetch\\*", "*:\\Windows\\Cursors\\*", "*:\\Windows\\INF\\*") AND NOT(Processes.process_path IN ("*\\temp\\*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_process_file_path_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path IN ("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "*\\Windows\\repair\\*", "*\\PerfLogs\\*", "*:\\Windows\\Prefetch\\*", "*:\\Windows\\Cursors\\*", "*:\\Windows\\INF\\*") NOT Processes.process_path="*\\temp\\*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_process_file_path_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may allow execution of specific binaries in non-standard paths. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_suspicious_qemu_execution.yml b/detections/endpoint/windows_suspicious_qemu_execution.yml
index 059c54dd88b..951d3c826c5 100644
--- a/detections/endpoint/windows_suspicious_qemu_execution.yml
+++ b/detections/endpoint/windows_suspicious_qemu_execution.yml
@@ -6,35 +6,15 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects execution of the QEMU binary and an image file with the -nographic flag.
+description: 'Detects execution of the QEMU binary and an image file with the -nographic flag.
+
     This causes it to run in the background without any display.
-    This has been observed as a persistence and initial access technique by some threat actors to install a rogue linux virtual machine
+
+    This has been observed as a persistence and initial access technique by some threat actors to install a rogue linux virtual machine'
 data_source:
     - Sysmon EventID 1
-search: |-
-    `sysmon`
-    EventID=1
-    CommandLine="*-nographic*"
-    CommandLine="*.img*"
-    (
-        Description="*QEMU machine*"
-        OR
-        Product="QEMU"
-        OR
-        Company="*qemu*"
-    )
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer EventID CommandLine Description Product Company action dest
-         original_file_name parent_process parent_process_exec parent_process_guid
-         parent_process_id parent_process_name parent_process_path process_hash
-         process_integrity_level user user_id vendor_product
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_suspicious_qemu_execution_filter`
+search: |
+    `sysmon` EventCode=1 CommandLine="*-nographic*" CommandLine="*.img*" Description="*QEMU machine*" OR Product="QEMU" OR Company="*qemu*" | eval src_user=src_user | stats count min(_time) as firstTime max(_time) as lastTime by action dest original_file_name parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process process_exec process_guid process_hash process_id process_integrity_level process_name process_path user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_qemu_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate virtual machine setups or automated testing environments may run QEMU with the -nographic flag. Review and whitelist approved systems to reduce false alerts.
 references:
@@ -48,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential suspicious QEMU execution observed on $dest$ via $CommandLine$.
     entity:
diff --git a/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml b/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml
index 667888e72b3..697192718f9 100644
--- a/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml
+++ b/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml
@@ -6,102 +6,29 @@ modification_date: '2026-10-09'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    This analytic detects Windows processes such as cmd.exe, PowerShell, and common Windows LOLBINs being spawned by React or Next.js application servers.
-    In the context of CVE-2025-55182 / React2Shell / CVE-2025-66478 for Next.js, successful exploitation can lead to arbitrary JavaScript execution on the server, which in turn is used to invoke Node's child_process APIs (for example child_process.execSync) to run OS-level commands.
+description: 'This analytic detects Windows processes such as cmd.exe, PowerShell, and common Windows LOLBINs being spawned by React or Next.js application servers.
+
+    In the context of CVE-2025-55182 / React2Shell / CVE-2025-66478 for Next.js, successful exploitation can lead to arbitrary JavaScript execution on the server, which in turn is used to invoke Node''s child_process APIs (for example child_process.execSync) to run OS-level commands.
+
     This detection focuses on suspicious child processes where a Next/React server process spawns an uncommon process.
-    Such activity might be a strong indicator of exploitation of the aforementioned vulnerability.
+
+    Such activity might be a strong indicator of exploitation of the aforementioned vulnerability.'
 data_source:
     - Sysmon EventID 1
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
-      from datamodel=Endpoint.Processes
-      where
-        Processes.parent_process_name = "node.exe"
-        Processes.parent_process IN (
-          "*--experimental-https*",
-          "*--experimental-next-config-strip-types*",
-          "*\\node_modules\\next*",
-          "*next dev*",
-          "*next start*",
-          "*next\" start*",
-          "*node_modules\\.bin\\\\..\\next*",
-          "*react-scripts start*",
-          "*start-server.js*",
-        )
-        AND
-        (
-          Processes.process_name IN (
-            "bash.exe",
-            "bitsadmin.exe",
-            "calc.exe",
-            "CalculatorApp.exe",
-            "certutil.exe",
-            "cscript.exe",
-            "curl.exe",
-            "ftp.exe",
-            "ipconfig.exe",
-            "mshta.exe",
-            "netstat.exe",
-            "OpenConsole.exe",
-            "powershell.exe",
-            "pwsh.exe",
-            "regsvr32.exe",
-            "rundll32.exe",
-            "sh.exe",
-            "tftp.exe",
-            "wget.exe",
-            "win32calc.exe",
-            "wmic.exe",
-            "wscript.exe",
-            "wsl.exe",
-            "wt.exe"
-          )
-          OR
-          (
-            Processes.process_name = "cmd.exe"
-            AND NOT Processes.process = "*/d /s /c *"
-          )
-          OR
-          (
-            Processes.process_name = "cmd.exe"
-            Processes.process = "*/d /s /c *"
-            AND NOT (
-              Processes.process = "*git config --local --get remote.origin.url*"
-              OR
-              (
-                Processes.process = "*netstat -ano | findstr /C:*"
-                Processes.process = "* | findstr LISTENING*"
-              )
-              OR
-              (
-                Processes.parent_process = "*--experimental-https*"
-                Processes.process = "*\\mkcert\\*"
-                Processes.process IN ("* -CAROOT*", "* -install *")
-              )
-            )
-          )
-        )
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process
-       Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name Processes.process_path
-       Processes.user Processes.user_id Processes.vendor_product
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*node.exe" Processes.parent_process IN ("*--experimental-https*", "*--experimental-next-config-strip-types*", "*\\node_modules\\next*", "*next dev*", "*next start*", "*next\" start*", "*node_modules\\.bin\\..\\next*", "*react-scripts start*", "*start-server.js*") (Processes.process_name="*cmd.exe" NOT Processes.process="*/d /s /c *") OR (Processes.process_name="*cmd.exe" Processes.process="*/d /s /c *" NOT ((Processes.process="*netstat -ano | findstr /C:*" Processes.process="* | findstr LISTENING*") OR (Processes.parent_process="*--experimental-https*" Processes.process="*\\mkcert\\*" Processes.process IN ("* -CAROOT*", "* -install *")) OR Processes.process="*git config --local --get remote.origin.url*")) OR Processes.process_name IN ("*bash.exe", "*bitsadmin.exe", "*calc.exe", "*CalculatorApp.exe", "*certutil.exe", "*cscript.exe", "*curl.exe", "*ftp.exe", "*ipconfig.exe", "*mshta.exe", "*netstat.exe", "*OpenConsole.exe", "*powershell.exe", "*pwsh.exe", "*regsvr32.exe", "*rundll32.exe", "*sh.exe", "*tftp.exe", "*wget.exe", "*win32calc.exe", "*wmic.exe", "*wscript.exe", "*wsl.exe", "*wt.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_react_or_next_js_child_process_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
 
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_suspicious_react_or_next_js_child_process_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
     These agents are designed to provide security-related telemetry from the endpoints where the agent is installed.
+
     To implement this search, you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions.
+
     These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model.
-    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    Rare false positives might show up from child processes such as cmd or powershell. Apply additional filters as needed.
+
+    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.'
+known_false_positives: Rare false positives might show up from child processes such as cmd or powershell. Apply additional filters as needed.
 references:
     - https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
     - https://nextjs.org/blog/CVE-2025-66478
@@ -116,7 +43,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Node-based server process ($parent_process_name$) spawned the child process $process_name$ with command-line $process$ on host $dest$ by user $user$, which may indicate remote code execution via React Server Components (CVE-2025-55182 / React2Shell) or abuse of a similar Node.js RCE vector.
     entity:
diff --git a/detections/endpoint/windows_suspicious_vmware_tools_child_process.yml b/detections/endpoint/windows_suspicious_vmware_tools_child_process.yml
index 72121d8dbd8..8f2f67e1c41 100644
--- a/detections/endpoint/windows_suspicious_vmware_tools_child_process.yml
+++ b/detections/endpoint/windows_suspicious_vmware_tools_child_process.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes\n  WHERE Processes.parent_process_name=vmtoolsd.exe\n    AND\n    Processes.process_name IN (\"powershell.exe\",\"cmd.exe\", \"msbuild.exe\", \"microsoft.workflow.compiler.exe\", \"searchprotocolhost.exe\", \"scrcons.exe\", \"cscript.exe\", \"wscript.exe\",\"bitsadmin.exe\", \"rundll32.exe\", \"wmic.exe\", \"mshta.exe\", \"certutil.exe\", \"schtasks.exe\")\n    AND NOT\n    (Processes.process_name=\"cmd.exe\" AND Processes.process IN (\"*\\\\VMware Tools\\\\poweroff-vm-default.bat*\",\"*\\\\VMware Tools\\\\poweron-vm-default.bat*\"))\n  BY Processes.action Processes.dest Processes.original_file_name\n     Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid\n     Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path\n     Processes.process Processes.process_exec Processes.process_guid\n     Processes.process_hash Processes.process_id Processes.process_integrity_level\n     Processes.process_name Processes.process_path Processes.user\n     Processes.user_id Processes.vendor_product\n| `drop_dm_object_name(Processes)`\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `windows_suspicious_vmware_tools_child_process_filter`"
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*vmtoolsd.exe" Processes.process_name IN ("*powershell.exe", "*cmd.exe", "*msbuild.exe", "*microsoft.workflow.compiler.exe", "*searchprotocolhost.exe", "*scrcons.exe", "*cscript.exe", "*wscript.exe", "*bitsadmin.exe", "*rundll32.exe", "*wmic.exe", "*mshta.exe", "*certutil.exe", "*schtasks.exe") NOT Processes.process_name="*cmd.exe" Processes.process IN ("*\\VMware Tools\\poweroff-vm-default.bat*", "*\\VMware Tools\\poweron-vm-default.bat*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_vmware_tools_child_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Although unlikely, some legitimate Administrative scripts may utilize VMWare Tools to execute commands on virtual machines.
 references:
diff --git a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml
index 24bfd4f7a40..80238b97212 100644
--- a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml
+++ b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml
@@ -10,7 +10,8 @@ description: The following analytic detects an anomaly where an svchost.exe proc
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name != "services.exe" AND Processes.process_name = "svchost.exe" AND Processes.process != unknown AND Processes.parent_process_path != "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe" AND Processes.parent_process_path != "C:\\Program Files\\Windows Defender\\MsMpEng.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_svchost_exe_parent_process_anomaly_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.parent_process_name="*services.exe" Processes.process_name="*svchost.exe" NOT Processes.process="unknown" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_svchost_exe_parent_process_anomaly_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Windows Update or other Windows Installer processes may launch their own svchost.exe processes that are not directly spawned by services.exe in certain edge cases (e.g., during patches or updates).
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_symboliclink_testing_tools_utility_execution.yml b/detections/endpoint/windows_symboliclink_testing_tools_utility_execution.yml
index 1bb9cfc8ff7..33fd2b92db4 100644
--- a/detections/endpoint/windows_symboliclink_testing_tools_utility_execution.yml
+++ b/detections/endpoint/windows_symboliclink_testing_tools_utility_execution.yml
@@ -6,46 +6,19 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects the execution of tools from the `symboliclink-testing-tools` toolkit.
+description: 'Detects the execution of tools from the `symboliclink-testing-tools` toolkit.
+
     This toolkit is often used for exploiting Windows symbolic link, junction, and oplock vulnerabilities to achieve local privilege escalation from a standard user to SYSTEM.
+
     Symbolic link attacks against Windows exploit a class of logical vulnerability where a SYSTEM or administrator-level process performs a file operation on a path that a low-privileged attacker can redirect using a combination of NTFS junctions, object manager symbolic links, and opportunistic locks (oplocks).
-    By chaining these primitives a standard user can redirect a privileged file write, delete, or read to an arbitrary path, effectively turning a narrow file operation vulnerability into arbitrary write or code execution as SYSTEM.
+
+    By chaining these primitives a standard user can redirect a privileged file write, delete, or read to an arbitrary path, effectively turning a narrow file operation vulnerability into arbitrary write or code execution as SYSTEM.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process_name IN (
-        "BaitAndSwitch.exe",
-        "CreateDosDeviceSymlink.exe",
-        "CreateMountPoint.exe",
-        "CreateNtfsSymlink.exe",
-        "CreateObjectDirectory.exe",
-        "CreateRegSymlink.exe",
-        "DeleteMountPoint.exe",
-        "DumpReparsePoint.exe",
-        "NativeSymlink.exe",
-        "SetOpLock.exe"
-    )
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
-       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_symboliclink_testing_tools_utility_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*BaitAndSwitch.exe", "*CreateDosDeviceSymlink.exe", "*CreateMountPoint.exe", "*CreateNtfsSymlink.exe", "*CreateObjectDirectory.exe", "*CreateRegSymlink.exe", "*DeleteMountPoint.exe", "*DumpReparsePoint.exe", "*NativeSymlink.exe", "*SetOpLock.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_symboliclink_testing_tools_utility_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate system administration or development tasks may use these tools for managing symbolic links or file locks. Filter alerts for authorized maintenance and testing activities.
 references:
@@ -58,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential Symbolic Link Testing Tools activity observed on $dest$ via $process$.
     entity:
diff --git a/detections/endpoint/windows_symlink_evaluation_change_via_fsutil.yml b/detections/endpoint/windows_symlink_evaluation_change_via_fsutil.yml
index f4e09f7d66e..35be2e7303a 100644
--- a/detections/endpoint/windows_symlink_evaluation_change_via_fsutil.yml
+++ b/detections/endpoint/windows_symlink_evaluation_change_via_fsutil.yml
@@ -6,52 +6,39 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects the execution of the Windows built-in tool Fsutil.exe with
+description: 'This analytic detects the execution of the Windows built-in tool Fsutil.exe with
+
     the "behavior", "set" and "SymlinkEvaluation" parameters.
+
     Attackers can abuse this to alter symlink evaluation behavior on Windows, potentially enabling remote traversal over SMB shares or evading defenses.
-    Such changes should be uncommon or even rare in enterprise environments and should be investigated.
+
+    Such changes should be uncommon or even rare in enterprise environments and should be investigated.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-        count min(_time) as firstTime max(_time) as lastTime
-      from datamodel=Endpoint.Processes where
-
-      (
-        Processes.process_name="fsutil.exe"
-        OR Processes.original_file_name="fsutil.exe"
-      )
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*fsutil.exe" OR Processes.original_file_name="fsutil.exe" Processes.process="*behavior*" Processes.process="*set*" Processes.process="*SymlinkEvaluation*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_symlink_evaluation_change_via_fsutil_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-      Processes.process="*behavior*"
-      Processes.process="*set*"
-      Processes.process="*SymlinkEvaluation*"
-
-      by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-      Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-      Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-      Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-      Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_symlink_evaluation_change_via_fsutil_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    Edge cases may exist in environments where this command is used for legitimate purposes.
-    However, such usage is expected to be uncommon. It is recommended to investigate any occurrences of this command, and apply filters as necessary.
+
+    names and speed up the data modeling process.'
+known_false_positives: 'Edge cases may exist in environments where this command is used for legitimate purposes.
+
+    However, such usage is expected to be uncommon. It is recommended to investigate any occurrences of this command, and apply filters as necessary.'
 references:
     - https://learn.microsoft.com/windows-server/administration/windows-commands/fsutil-behavior
     - https://www.group-ib.com/blog/blackcat/
@@ -64,7 +51,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
index 6cd471d6f50..786573c0689 100644
--- a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_hh` Processes.process=*-decompile*
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_system_binary_proxy_execution_compiled_html_file_decompile_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*hh.exe" OR Processes.original_file_name="HH.EXE" Processes.process="*-decompile*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_binary_proxy_execution_compiled_html_file_decompile_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited, filter as needed.
 references:
@@ -41,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $process_name$ has been identified using decompile against a CHM on $dest$ under user $user$.
     entity:
diff --git a/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml b/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml
index 33a90598999..49fddb310a4 100644
--- a/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml
+++ b/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name = "nslookup.exe"
-            OR
-            Processes.original_file_name = "nslookup.exe"
-        )
-        AND Processes.process = "*_ldap._tcp.dc._msdcs*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_system_discovery_using_ldap_nslookup_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*nslookup.exe" OR Processes.original_file_name="nslookup.exe" Processes.process="*_ldap._tcp.dc._msdcs*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_discovery_using_ldap_nslookup_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: dministrator may execute this commandline tool for auditing purposes. Filter as needed.
 references:
@@ -43,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_system_discovery_using_qwinsta.yml b/detections/endpoint/windows_system_discovery_using_qwinsta.yml
index 470a8db0126..f17ee80459c 100644
--- a/detections/endpoint/windows_system_discovery_using_qwinsta.yml
+++ b/detections/endpoint/windows_system_discovery_using_qwinsta.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = "qwinsta.exe"
-        OR
-        Processes.original_file_name = "qwinsta.exe"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_system_discovery_using_qwinsta_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*qwinsta.exe" OR Processes.original_file_name="qwinsta.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_discovery_using_qwinsta_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator may execute this commandline tool for auditing purposes. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_system_file_on_disk.yml b/detections/endpoint/windows_system_file_on_disk.yml
index 86bc8881b5c..c2597207112 100644
--- a/detections/endpoint/windows_system_file_on_disk.yml
+++ b/detections/endpoint/windows_system_file_on_disk.yml
@@ -9,18 +9,8 @@ type: Hunting
 description: The following analytic detects the creation of new .sys files on disk. It leverages the Endpoint.Filesystem data model to identify and log instances where .sys files are written to the filesystem. This activity is significant because .sys files are often used as kernel mode drivers, and their unauthorized creation can indicate malicious activity such as rootkit installation. If confirmed malicious, this could allow an attacker to gain kernel-level access, leading to full system compromise, persistent control, and the ability to bypass security mechanisms.
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE Filesystem.file_name="*.sys*"
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_system_file_on_disk_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*.sys*" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_file_on_disk_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on files from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. In addition, filtering may occur by adding NOT (Filesystem.file_path IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")). This will level out the noise generated to potentally lead to generating findings.
 known_false_positives: False positives will be present. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_system_logoff_commandline.yml b/detections/endpoint/windows_system_logoff_commandline.yml
index 4b5aa28537a..97311048b81 100644
--- a/detections/endpoint/windows_system_logoff_commandline.yml
+++ b/detections/endpoint/windows_system_logoff_commandline.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name = shutdown.exe
-            OR
-            Processes.original_file_name = shutdown.exe
-        )
-        Processes.process="*shutdown*" Processes.process IN ("* /l*", "* -l*") Processes.process IN ("* /t*","* -t*","* /f*","* -f*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_system_logoff_commandline_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*shutdown.exe" OR Processes.original_file_name="shutdown.exe" Processes.process="*shutdown*" Processes.process IN ("* /l*", "* -l*") Processes.process IN ("* /t*", "* -t*", "* /f*", "* -f*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_logoff_commandline_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator may execute this commandline to trigger shutdown, logoff or restart the host machine.
 references:
@@ -43,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml
index b829d6559fd..85e98c0e267 100644
--- a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml
+++ b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name="ipconfig.exe"
-        OR
-        Processes.original_file_name = "ipconfig.exe"
-        AND
-        Processes.process = "*/displaydns*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_system_network_config_discovery_display_dns_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.original_file_name="ipconfig.exe" Processes.process="*/displaydns*") OR Processes.process_name="*ipconfig.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_network_config_discovery_display_dns_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -43,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml
index a0660e5aa91..b590a164bfc 100644
--- a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml
+++ b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml
@@ -11,32 +11,10 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    `process_netsh`
-    Processes.process="* show *"
-    Processes.process IN ("*state*", "*config*", "*wlan*", "*profile*")
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_system_network_connections_discovery_netsh_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*netsh.exe" OR Processes.original_file_name="netsh.exe" Processes.process="* show *" Processes.process IN ("*state*", "*config*", "*wlan*", "*profile*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_network_connections_discovery_netsh_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Network administrators, power users, and third party tools can and will use this utility for various purposes. Apply the necessary filters by user, parent process, and command line.
+known_false_positives: Network administrators, power users, and third party tools can and will use this utility for various purposes. Apply the necessary filters by user, parent process, and command line.
 references:
     - https://attack.mitre.org/techniques/T1049/
     - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
@@ -50,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml
index f4a9cfff617..11163d56aea 100644
--- a/detections/endpoint/windows_system_reboot_commandline.yml
+++ b/detections/endpoint/windows_system_reboot_commandline.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name = shutdown.exe
-            OR
-            Processes.original_file_name = shutdown.exe
-        )
-        Processes.process="*shutdown*" Processes.process IN ("* /r*", "* -r*") Processes.process IN ("* /t*","* -t*","* /f*","* -f*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_system_reboot_commandline_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*shutdown.exe" OR Processes.original_file_name="shutdown.exe" Processes.process="*shutdown*" Processes.process IN ("* /r*", "* -r*") Processes.process IN ("* /t*", "* -t*", "* /f*", "* -f*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_reboot_commandline_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator may execute this commandline to trigger shutdown or restart the host machine.
 references:
diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml
index c81335469ff..6b22e9aefcc 100644
--- a/detections/endpoint/windows_system_remote_discovery_with_query.yml
+++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml
@@ -11,25 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.process_name="query.exe"
-            OR
-            Processes.original_file_name="query.exe"
-        )
-        AND (Processes.process="*/server*") AND NOT Processes.process IN ("*/server:localhost*", "*/server:127.0.0.1*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_system_remote_discovery_with_query_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*query.exe" OR Processes.original_file_name="query.exe" Processes.process="*/server*" NOT (Processes.process IN ("*/server:localhost*", "*/server:127.0.0.1*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_remote_discovery_with_query_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
diff --git a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml
index 42e84f9ed2e..b1a9baf29a0 100644
--- a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml
+++ b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name IN ("wscript.exe","cscript.exe") Processes.process="*syncappvpublishingserver.vbs*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_system_script_proxy_execution_syncappvpublishingserver_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*wscript.exe", "*cscript.exe") Processes.process="*syncappvpublishingserver.vbs*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_script_proxy_execution_syncappvpublishingserver_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives may be present if the vbscript syncappvpublishingserver is used for legitimate purposes. Filter as needed. Adding a n; to the command-line arguments may help reduce any noise.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download files or evade critical controls.
     entity:
diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml
index dff63e2e538..ed25d7d0460 100644
--- a/detections/endpoint/windows_system_shutdown_commandline.yml
+++ b/detections/endpoint/windows_system_shutdown_commandline.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) Processes.process="*shutdown*" AND Processes.process IN("* /s*", "* -s*") AND Processes.process IN ("* /t*","* -t*","* /f*","* -f*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_shutdown_commandline_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*shutdown.exe" OR Processes.original_file_name="shutdown.exe" Processes.process="*shutdown*" Processes.process IN ("* /s*", "* -s*") Processes.process IN ("* /t*", "* -t*", "* /f*", "* -f*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_shutdown_commandline_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrator may execute this commandline to trigger shutdown or restart the host machine.
 references:
@@ -25,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml
index 2d254087fea..7f569eec6ef 100644
--- a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml
+++ b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name = w32tm.exe Processes.process= "* /stripchart *" Processes.process= "* /computer:localhost *" Processes.process= "* /period:*" Processes.process= "* /dataonly *" Processes.process= "* /samples:*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_system_time_discovery_w32tm_delay_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*w32tm.exe" Processes.process="* /stripchart *" Processes.process="* /computer:localhost *" Processes.process="* /period:*" Processes.process="* /dataonly *" Processes.process="* /samples:*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_time_discovery_w32tm_delay_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -40,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_system_user_discovery_via_quser.yml b/detections/endpoint/windows_system_user_discovery_via_quser.yml
index 94d79507ab5..fa1fb9ab20a 100644
--- a/detections/endpoint/windows_system_user_discovery_via_quser.yml
+++ b/detections/endpoint/windows_system_user_discovery_via_quser.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name="quser.exe"
-        OR
-        Processes.original_file_name = "quser.exe"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_system_user_discovery_via_quser_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*quser.exe" OR Processes.original_file_name="quser.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_user_discovery_via_quser_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network administrator can use this command tool to audit RDP access of user in specific network or host.
 references:
diff --git a/detections/endpoint/windows_system_user_privilege_discovery.yml b/detections/endpoint/windows_system_user_privilege_discovery.yml
index c5aa96ad712..58257adc8e2 100644
--- a/detections/endpoint/windows_system_user_privilege_discovery.yml
+++ b/detections/endpoint/windows_system_user_privilege_discovery.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name="whoami.exe" Processes.process= "*/priv*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_system_user_privilege_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*whoami.exe" Processes.process="*/priv*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_user_privilege_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting. Filter as needed.
 references:
diff --git a/detections/endpoint/windows_teamcity_payload_execution_from_temp_directory.yml b/detections/endpoint/windows_teamcity_payload_execution_from_temp_directory.yml
index 2d71bc4064a..8f68f7ab41e 100644
--- a/detections/endpoint/windows_teamcity_payload_execution_from_temp_directory.yml
+++ b/detections/endpoint/windows_teamcity_payload_execution_from_temp_directory.yml
@@ -6,39 +6,15 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects the bundled TeamCity java executing a payload out of the temp directory.
-    This activity can be associated with a malicious plugin installed by metasploit for remote code execution.
+description: 'Detects the bundled TeamCity java executing a payload out of the temp directory.
+
+    This activity can be associated with a malicious plugin installed by metasploit for remote code execution.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.process="*-classpath *"
-    Processes.process="*:\\Windows\\TEMP\\~spawn*"
-    Processes.process="*.tmp.dir *"
-    Processes.process="*.Payload*"
-    Processes.process="*TeamCity*"
-
-    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
-       Processes.parent_process_name Processes.parent_process_exec Processes.action
-       Processes.dest Processes.process_current_directory Processes.process_path
-       Processes.process_integrity_level Processes.original_file_name
-       Processes.parent_process Processes.parent_process_path
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.process_guid Processes.process_id
-       Processes.user Processes.process_name
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_teamcity_payload_execution_from_temp_directory_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*-classpath *" Processes.process="*:\\Windows\\TEMP\\~spawn*" Processes.process="*.tmp.dir *" Processes.process="*.Payload*" Processes.process="*TeamCity*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_teamcity_payload_execution_from_temp_directory_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate TeamCity operations or updates may occasionally run java processes from the temp directory. Review and filter based on verified TeamCity activity.
 references:
@@ -53,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential suspicious TeamCity activity observed on $dest$ via $process$.
     entity:
diff --git a/detections/endpoint/windows_teamcity_plugin_installed.yml b/detections/endpoint/windows_teamcity_plugin_installed.yml
index 2b6ac23498f..d5c988f14e7 100644
--- a/detections/endpoint/windows_teamcity_plugin_installed.yml
+++ b/detections/endpoint/windows_teamcity_plugin_installed.yml
@@ -6,30 +6,13 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects the creation of a plugin zip file under the TeamCity data structure.
-    This indicates a new plugin has been installed and can potentially indicate attempts to gain code execution on the TeamCity server if the plugin installation was unexpected.
+description: 'Detects the creation of a plugin zip file under the TeamCity data structure.
+
+    This indicates a new plugin has been installed and can potentially indicate attempts to gain code execution on the TeamCity server if the plugin installation was unexpected.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.file_path="*:\\ProgramData\\JetBrains\\TeamCity\\plugins\\*"
-    Filesystem.file_name="*.zip"
-    Filesystem.action="created"
-
-    by Filesystem.dest Filesystem.action Filesystem.file_name Filesystem.user
-       Filesystem.vendor_product Filesystem.file_create_time Filesystem.process_path
-       Filesystem.process_guid Filesystem.process_id Filesystem.file_path
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_teamcity_plugin_installed_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*:\\ProgramData\\JetBrains\\TeamCity\\plugins\\*" Filesystem.file_name="*.zip" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_teamcity_plugin_installed_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate plugin installations by authorized administrators can trigger this detection. Verify with change management records before investigating further.
 references:
@@ -43,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_terminating_lsass_process.yml b/detections/endpoint/windows_terminating_lsass_process.yml
index 94b634ef688..421b4a507cb 100644
--- a/detections/endpoint/windows_terminating_lsass_process.yml
+++ b/detections/endpoint/windows_terminating_lsass_process.yml
@@ -6,12 +6,12 @@ modification_date: '2026-09-08'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects a process requesting PROCESS_TERMINATE access to Lsass.exe.
-    It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_TERMINATE (0x1).
+description: 'The following analytic detects a process requesting PROCESS_TERMINATE access to Lsass.exe.
+
+    It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_TERMINATE (0x1).'
 data_source:
     - Sysmon EventID 10
-search: |-
+search: |
     `sysmon`
     EventCode=10
     TargetImage="*\\lsass.exe"
@@ -49,7 +49,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_theme_file_creation_in_unusual_location.yml b/detections/endpoint/windows_theme_file_creation_in_unusual_location.yml
index 69eb15238be..4b117223f90 100644
--- a/detections/endpoint/windows_theme_file_creation_in_unusual_location.yml
+++ b/detections/endpoint/windows_theme_file_creation_in_unusual_location.yml
@@ -6,35 +6,11 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects theme files being created in unusual locations. These files, used to customize desktop appearances, have been used for remote code execution and NTLM coercion attacks.
+description: Detects theme files being created in unusual locations. These files, used to customize desktop appearances, have been used for remote code execution and NTLM coercion attacks.
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.file_path IN (
-        "*\\Desktop\\*",
-        "*\\Documents\\*",
-        "*\\Downloads\\*",
-        "*\\Temp\\*"
-    )
-    Filesystem.file_name="*.theme"
-    Filesystem.action="created"
-
-    by Filesystem.dest Filesystem.file_create_time Filesystem.process_path
-       Filesystem.process_guid Filesystem.process_id Filesystem.file_path
-       Filesystem.action Filesystem.file_name
-       Filesystem.user Filesystem.vendor_product
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_theme_file_creation_in_unusual_location_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\Desktop\\*", "*\\Documents\\*", "*\\Downloads\\*", "*\\Temp\\*") Filesystem.file_name="*.theme" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_theme_file_creation_in_unusual_location_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate customization or IT management may use theme files that trigger this detection. Review and allow trusted themes from authorized sources.
 references:
@@ -47,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_time_based_evasion.yml b/detections/endpoint/windows_time_based_evasion.yml
index f8cfd97a98d..354dbd8b7da 100644
--- a/detections/endpoint/windows_time_based_evasion.yml
+++ b/detections/endpoint/windows_time_based_evasion.yml
@@ -6,53 +6,20 @@ modification_date: '2026-10-09'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects potentially malicious processes that initiate a ping delay using an invalid IP address.
+description: 'The following analytic detects potentially malicious processes that initiate a ping delay using an invalid IP address.
+
     It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving "ping 0 -n".
+
     Malware like NJRAT was observed using this technique to introduce time delays for evasion tactics, such as delaying self-deletion.
-    If confirmed malicious, this activity could indicate an active infection attempting to evade detection, potentially leading to further compromise and persistence within the environment.
+
+    If confirmed malicious, this activity could indicate an active infection attempting to evade detection, potentially leading to further compromise and persistence within the environment.'
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    Processes.process_name = "ping.exe"
-    (
-        Processes.parent_process IN (
-            "*ping  0 -n *",
-            "*ping 0 -n *",
-            "*ping.exe  0 -n *",
-            "*ping.exe 0 -n *"
-        )
-        OR
-        Processes.process IN (
-            "*ping  0 -n *",
-            "*ping 0 -n *",
-            "*ping.exe  0 -n *",
-            "*ping.exe 0 -n *"
-        )
-    )
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*ping.exe" Processes.parent_process IN ("*ping  0 -n *", "*ping 0 -n *", "*ping.exe  0 -n *", "*ping.exe 0 -n *") OR Processes.process IN ("*ping  0 -n *", "*ping 0 -n *", "*ping.exe  0 -n *", "*ping.exe 0 -n *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_time_based_evasion_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process.
 
-    | `drop_dm_object_name("Processes")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_time_based_evasion_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process.
-    Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+    Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.'
 known_false_positives: No false positives have been identified at this time.
 references:
     - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
@@ -64,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A $process_name$ did a suspicious ping to invalid IP address on $dest$
     entity:
diff --git a/detections/endpoint/windows_time_based_evasion_via_choice_exec.yml b/detections/endpoint/windows_time_based_evasion_via_choice_exec.yml
index 62231699677..c3e92251d82 100644
--- a/detections/endpoint/windows_time_based_evasion_via_choice_exec.yml
+++ b/detections/endpoint/windows_time_based_evasion_via_choice_exec.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name =choice.exe  Processes.process = "*/T*"  Processes.process = "*/N*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_time_based_evasion_via_choice_exec_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*choice.exe" Processes.process="*/T*" Processes.process="*/N*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_time_based_evasion_via_choice_exec_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: administrator may use choice.exe to allow user to choose from and indexes of choices from a batch script.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_tinycc_shellcode_execution.yml b/detections/endpoint/windows_tinycc_shellcode_execution.yml
index 0d0bbec806c..74835728ebf 100644
--- a/detections/endpoint/windows_tinycc_shellcode_execution.yml
+++ b/detections/endpoint/windows_tinycc_shellcode_execution.yml
@@ -6,54 +6,34 @@ modification_date: '2026-09-01'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    Detects abuse of Tiny-C-Compiler (TinyCC) for shellcode execution, where tcc.exe is renamed to masquerade as svchost.exe and used to compile and execute C source files containing shellcode.
+description: 'Detects abuse of Tiny-C-Compiler (TinyCC) for shellcode execution, where tcc.exe is renamed to masquerade as svchost.exe and used to compile and execute C source files containing shellcode.
+
     This technique was observed in the Lotus Blossom Chrysalis backdoor campaign, where attackers renamed "tcc.exe" to "svchost.exe", and executed a file named "conf.c" containing Metasploit block_api shellcode with the flags -nostdlib -run.
+
     TinyCC is a legitimate C compiler, but its ability to compile and execute code on-the-fly makes it attractive to attackers seeking to evade detection.
-    The combination of a renamed compiler binary executing from non-standard locations with suspicious flags is a strong indicator of malicious activity.
+
+    The combination of a renamed compiler binary executing from non-standard locations with suspicious flags is a strong indicator of malicious activity.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*svchost.exe", "*tcc.exe") Processes.process="* -nostdlib*" Processes.process="* -run*" Processes.process IN ("*.c", "*conf.c") NOT (Processes.process_path IN ("*\\system32\\*", "*\\syswow64\\*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_tinycc_shellcode_execution_filter`
+how_to_implement: 'To successfully implement this search, you need to be ingesting logs with process creation information from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA and have enabled EventCode 1 (Process Create). Ensure that command-line arguments are being captured in your Sysmon configuration.
 
-    from datamodel=Endpoint.Processes where
+    The detection relies on the OriginalFileName field being populated to distinguish between legitimate svchost.exe and renamed tcc.exe binaries. Ensure Sysmon is configured to capture full command-line arguments.'
+known_false_positives: 'Legitimate TinyCC usage by developers may trigger this detection if executed from non-standard locations. However, the combination of:
 
-    Processes.process_name IN ("svchost.exe", "tcc.exe")
-    Processes.process="* -nostdlib*"
-    Processes.process="* -run*"
-    Processes.process IN ("*.c", "*conf.c*")
-    NOT Processes.process_path IN (
-        "*:\\Windows\\System32\\*",
-        "*:\\Windows\\SysWOW64\\*"
-    )
-
-    By Processes.action Processes.dest Processes.user Processes.process Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name
-       Processes.parent_process_path Processes.process_name Processes.process_id
-       Processes.process_exec Processes.process_guid Processes.process_hash
-       Processes.process_integrity_level Processes.process_path
-       Processes.original_file_name Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_tinycc_shellcode_execution_filter`
-how_to_implement: |
-    To successfully implement this search, you need to be ingesting logs with process creation information from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA and have enabled EventCode 1 (Process Create). Ensure that command-line arguments are being captured in your Sysmon configuration.
-    The detection relies on the OriginalFileName field being populated to distinguish between legitimate svchost.exe and renamed tcc.exe binaries. Ensure Sysmon is configured to capture full command-line arguments.
-known_false_positives: |
-    Legitimate TinyCC usage by developers may trigger this detection if executed from non-standard locations. However, the combination of:
     1. Renamed binary (svchost.exe with tcc.exe OriginalFileName)
+
     2. Execution from user-writable directories (AppData, Temp, ProgramData)
+
     3. Suspicious flags (-nostdlib -run) with .c file execution
 
+
     is highly suspicious and warrants investigation. Legitimate TinyCC usage typically occurs from Program Files or developer directories with standard compilation workflows.
 
-    Allowlist known development environments if needed.
+
+    Allowlist known development environments if needed.'
 references:
     - https://attack.mitre.org/techniques/T1059/003/
     - https://attack.mitre.org/techniques/T1027/
@@ -67,7 +47,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: TinyCC compiler execution on [$dest$] by user [$user$] from [$process_path$] via the CommandLine [$process$] from the ParentProcess [$parent_process$], indicating potential malicious code execution.
     entity:
@@ -104,6 +84,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/lotus_blossom_chrysalis/windows-sysmon.log
-          sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
       test_type: unit
diff --git a/detections/endpoint/windows_tor_client_execution.yml b/detections/endpoint/windows_tor_client_execution.yml
index 494188e14d1..9172d2c94c1 100644
--- a/detections/endpoint/windows_tor_client_execution.yml
+++ b/detections/endpoint/windows_tor_client_execution.yml
@@ -6,49 +6,35 @@ modification_date: '2026-05-13'
 author: Vignesh Subramanian, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the execution of the TOR Browser and related TOR components on Windows endpoints by monitoring process creation activity.
+description: 'The following analytic detects the execution of the TOR Browser and related TOR components on Windows endpoints by monitoring process creation activity.
+
     Adversaries and insider threats leverage TOR to anonymize command-and-control traffic, facilitate data exfiltration, and evade network monitoring and policy enforcement.
-    While TOR can be used for legitimate research and privacy purposes, its presence on enterprise endpoints is often unusual and should be investigated to determine intent, scope, and any associated malicious behavior.
+
+    While TOR can be used for legitimate research and privacy purposes, its presence on enterprise endpoints is often unusual and should be investigated to determine intent, scope, and any associated malicious behavior.'
 data_source:
     - CrowdStrike ProcessRollup2
     - Sysmon EventID 1
     - Windows Event Log Security 4688
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
-      from datamodel=Endpoint.Processes where
-      (
-        Processes.process_name = "tor.exe"
-        OR
-        (
-          Processes.process_path = "*\\BraveSoftware\\Brave-Browser*"
-          Processes.process_path = "*\\tor-*"
-        )
-      )
-      by Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec
-         Processes.parent_process_guid Processes.parent_process_id
-         Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_tor_client_execution_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.process_path="*\\BraveSoftware\\Brave-Browser*" Processes.process_path="*\\tor-*") OR Processes.process_name="*tor.exe" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_tor_client_execution_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    This detection focuses on TOR-related processes and may generate benign matches in environments where TOR is intentionally used, such as security testing, research, or lab environments.
+
+    names and speed up the data modeling process.'
+known_false_positives: This detection focuses on TOR-related processes and may generate benign matches in environments where TOR is intentionally used, such as security testing, research, or lab environments.
 references:
     - https://unit42.paloaltonetworks.com/tor-traffic-enterprise-networks/
     - https://attack.mitre.org/software/S0183/
@@ -61,7 +47,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -98,6 +84,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1090.003/windows_tor_client_execution/windows-sysmon.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml b/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml
index 1576d8bc073..b04d491f9bc 100644
--- a/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml
+++ b/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_integrity_level IN ("high","system") AND Processes.parent_process_name IN (`uacbypass_process_name`) AND (Processes.process_name IN ("cmd.exe","powershell.exe","pwsh.exe","wscript","cscript.exe","bash.exe","werfault.exe") OR Processes.process IN ("*\\\\*","*\\Users\\*","*\\ProgramData\\*","*\\Temp\\*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | where parent_process_name != process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_uac_bypass_suspicious_child_process_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_integrity_level IN ("high", "system") Processes.parent_process_name IN ("*BitlockerWizardElev.exe", "*cliconfg.exe", "*clipup.exe", "*cmstp.exe", "*CompMgmtLauncher.exe", "*consent.exe", "*control.exe", "*credwiz.exe", "*dccw.exe", "*dismhost.exe", "*EventVwr.exe", "*fodhelper.exe", "*GWXUXWorker.exe", "*inetmgr.exe", "*iscsicli.exe", "*mcx2prov.exe", "*migwiz.exe", "*mmc.exe", "*msconfig.exe", "*oobe.exe", "*osk.exe", "*pkgmgr.exe", "*recdisc.exe", "*rstrui.exe", "*sdclt.exe", "*setupsqm.exe", "*slui.exe", "*sysprep.exe", "*SystemPropertiesAdvanced.exe", "*taskhost.exe", "*TpmInit.exe", "*tzsync.exe", "*w32tm.exe", "*WerFault.exe", "*WSReset.exe", "*wusa.exe") Processes.process_name IN ("*cmd.exe", "*powershell.exe", "*pwsh.exe", "*wscript", "*cscript.exe", "*bash.exe", "*werfault.exe") OR Processes.process IN ("*\\*", "*\\Users\\*", "*\\ProgramData\\*", "*\\Temp\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_uac_bypass_suspicious_child_process_filter`
 how_to_implement: Target environment must ingest sysmon data, specifically Event ID 1 with process integrity level data.
 known_false_positives: Including Werfault.exe may cause some unintended false positives related to normal application faulting, but is used in a number of UAC bypass techniques.
 references:
@@ -27,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A UAC bypass parent process- $parent_process_name$ on host- $dest$ launched a suspicious child process - $process_name$.
     entity:
diff --git a/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml b/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml
index d0c11354b0c..671ee6ef631 100644
--- a/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml
+++ b/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml
@@ -6,14 +6,16 @@ modification_date: '2026-05-13'
 author: Steven Dick
 status: production
 type: TTP
-description: |-
-    The following analytic detects when a process spawns an executable known for User Account Control (UAC) bypass exploitation and subsequently monitors for any child processes with a higher integrity level than the original process.
+description: 'The following analytic detects when a process spawns an executable known for User Account Control (UAC) bypass exploitation and subsequently monitors for any child processes with a higher integrity level than the original process.
+
     This detection leverages Sysmon EventID 1 data, focusing on process integrity levels and known UAC bypass executables.
+
     This activity is significant as it may indicate an attacker has successfully used a UAC bypass exploit to escalate privileges.
-    If confirmed malicious, the attacker could gain elevated privileges, potentially leading to further system compromise and persistent access.
+
+    If confirmed malicious, the attacker could gain elevated privileges, potentially leading to further system compromise and persistent access.'
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 1
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count max(_time) as lastTime
 
@@ -97,10 +99,8 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_uac_bypass_suspicious_escalation_behavior_filter`
-how_to_implement: |-
-    Target environment must ingest sysmon data, specifically Event ID 1 with process integrity level data.
-known_false_positives: |-
-    Including Werfault.exe may cause some unintended false positives related to normal application faulting, but is used in a number of UAC bypass techniques.
+how_to_implement: Target environment must ingest sysmon data, specifically Event ID 1 with process integrity level data.
+known_false_positives: Including Werfault.exe may cause some unintended false positives related to normal application faulting, but is used in a number of UAC bypass techniques.
 references:
     - https://attack.mitre.org/techniques/T1548/002/
     - https://atomicredteam.io/defense-evasion/T1548.002/
@@ -114,7 +114,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A UAC bypass behavior was detected by process $parent_process_name$ on host $dest$ by $user$.
     entity:
@@ -132,8 +132,6 @@ threat_objects:
       type: parent_process_name
     - field: process_name
       type: process_name
-    - field: process_name
-      type: process_name
 analytic_story:
     - Living Off The Land
     - Compromised Windows Host
diff --git a/detections/endpoint/windows_uncommon_remote_thread_creation_in_browser_process.yml b/detections/endpoint/windows_uncommon_remote_thread_creation_in_browser_process.yml
index c1b66bf2dab..38230ffb412 100644
--- a/detections/endpoint/windows_uncommon_remote_thread_creation_in_browser_process.yml
+++ b/detections/endpoint/windows_uncommon_remote_thread_creation_in_browser_process.yml
@@ -6,124 +6,20 @@ modification_date: '2026-06-29'
 author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic identifies the creation of a remote thread by a process such as wermgr.exe or rundll32.exe into a browser process such as firefox.exe, chrome.exe, and others.
+description: 'The following analytic identifies the creation of a remote thread by a process such as wermgr.exe or rundll32.exe into a browser process such as firefox.exe, chrome.exe, and others.
+
     These processes do not typically create remote threads, in browser processes.
+
     It leverages Sysmon EventID 8 to detect this behavior by monitoring SourceImage and TargetImage fields.
+
     This activity is significant because it is commonly associated with malware like Qakbot and IcedID, which injects malicious code into legitimate processes to steal information.
-    If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data from the compromised host.
+
+    If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data from the compromised host.'
 data_source:
     - Sysmon EventID 8
-search: |-
-    `sysmon`
-    EventCode=8
-    SourceImage IN (
-        "*\\rundll32.exe",
-        "*\\wermgr.exe"
-    )
-    TargetImage IN (
-        "*\\Sputnik.exe",
-        "*\\ChromePlus.exe",
-        "*\\QIP Surf.exe",
-        "*\\BlackHawk.exe",
-        "*\\7Star.exe",
-        "*\\Sleipnir5.exe",
-        "*\\Citrio.exe",
-        "*\\Chrome SxS.exe",
-        "*\\Chrome.exe",
-        "*\\Coowon.exe",
-        "*\\CocCocBrowser.exe",
-        "*\\Uran.exe",
-        "*\\QQBrowser.exe",
-        "*\\Orbitum.exe",
-        "*\\Slimjet.exe",
-        "*\\Iridium.exe",
-        "*\\Vivaldi.exe",
-        "*\\Chromium.exe",
-        "*\\GhostBrowser.exe",
-        "*\\CentBrowser.exe",
-        "*\\Xvast.exe",
-        "*\\Chedot.exe",
-        "*\\SuperBird.exe",
-        "*\\360Browser.exe",
-        "*\\360Chrome.exe",
-        "*\\dragon.exe",
-        "*\\brave.exe",
-        "*\\torch.exe",
-        "*\\UCBrowser.exe",
-        "*\\BliskBrowser.exe",
-        "*\\Epic Privacy Browser.exe",
-        "*\\nichrome.exe",
-        "*\\AmigoBrowser.exe",
-        "*\\KometaBrowser.exe",
-        "*\\XpomBrowser.exe",
-        "*\\msedge.exe",
-        "*\\LiebaoBrowser.exe",
-        "*\\AvastBrowser.exe",
-        "*\\Kinza.exe",
-        "*\\seamonkey.exe",
-        "*\\icedragon.exe",
-        "*\\cyberfox.exe",
-        "*\\SlimBrowser.exe",
-        "*\\palemoon.exe",
-        "*\\opera.exe",
-        "*\\yandex.exe",
-        "*\\atom.exe",
-        "*\\Chromodo.exe",
-        "*\\360chrome.exe",
-        "*\\360se.exe",
-        "*\\Maxthon.exe",
-        "*\\k-meleon.exe",
-        "*\\SLBrowser.exe",
-        "*\\Go!.exe",
-        "*\\Secure Browser.exe",
-        "*\\Elements Browser.exe",
-        "*\\Mustang.exe",
-        "*\\Suhba.exe",
-        "*\\TorBro.exe",
-        "*\\RockMelt.exe",
-        "*\\Bromium.exe",
-        "*\\Twinkstar.exe",
-        "*\\iTop Private Browser.exe",
-        "*\\CCleaner Browser.exe",
-        "*\\AcWebBrowser.exe",
-        "*\\CoolNovo.exe",
-        "*\\spark.exe",
-        "*\\iron.exe",
-        "*\\Titan Browser.exe",
-        "*\\AVG Browser.exe",
-        "*\\UR Browser.exe",
-        "*\\Flock.exe",
-        "*\\CryptoTab Browser.exe",
-        "*\\Sidekick.exe",
-        "*\\SwingBrowser.exe",
-        "*\\SalamWeb.exe",
-        "*\\NetboxBrowser.exe",
-        "*\\GarenaPlus.exe",
-        "*\\InsomniacBrowser.exe",
-        "*\\Viasat Browser.exe",
-        "*\\whale.exe",
-        "*\\falkon.exe",
-        "*\\SogouExplorer.exe",
-        "*\\firefox.exe",
-        "*\\waterfox.exe",
-        "*\\thunderbird.exe",
-        "*\\basilisk.exe",
-        "*\\BitTubeBrowser.exe"
-    )
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-                  values(NewThreadId) as "NewThreadId"
-                  values(StartAddress) as "StartAddress"
-      by dest signature_id signature
-         SourceProcessGuid SourceProcessId SourceImage
-         TargetProcessGuid TargetProcessId TargetImage
-         StartModule StartFunction vendor_product
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_uncommon_remote_thread_creation_in_browser_process_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+search: |
+    `sysmon` EventCode=8 SourceImage IN ("*\\rundll32.exe", "*\\wermgr.exe") TargetImage IN ("*\\Sputnik.exe", "*\\ChromePlus.exe", "*\\QIP Surf.exe", "*\\BlackHawk.exe", "*\\7Star.exe", "*\\Sleipnir5.exe", "*\\Citrio.exe", "*\\Chrome SxS.exe", "*\\Chrome.exe", "*\\Coowon.exe", "*\\CocCocBrowser.exe", "*\\Uran.exe", "*\\QQBrowser.exe", "*\\Orbitum.exe", "*\\Slimjet.exe", "*\\Iridium.exe", "*\\Vivaldi.exe", "*\\Chromium.exe", "*\\GhostBrowser.exe", "*\\CentBrowser.exe", "*\\Xvast.exe", "*\\Chedot.exe", "*\\SuperBird.exe", "*\\360Browser.exe", "*\\360Chrome.exe", "*\\dragon.exe", "*\\brave.exe", "*\\torch.exe", "*\\UCBrowser.exe", "*\\BliskBrowser.exe", "*\\Epic Privacy Browser.exe", "*\\nichrome.exe", "*\\AmigoBrowser.exe", "*\\KometaBrowser.exe", "*\\XpomBrowser.exe", "*\\msedge.exe", "*\\LiebaoBrowser.exe", "*\\AvastBrowser.exe", "*\\Kinza.exe", "*\\seamonkey.exe", "*\\icedragon.exe", "*\\cyberfox.exe", "*\\SlimBrowser.exe", "*\\palemoon.exe", "*\\opera.exe", "*\\yandex.exe", "*\\atom.exe", "*\\Chromodo.exe", "*\\360se.exe", "*\\Maxthon.exe", "*\\k-meleon.exe", "*\\SLBrowser.exe", "*\\Go!.exe", "*\\Secure Browser.exe", "*\\Elements Browser.exe", "*\\Mustang.exe", "*\\Suhba.exe", "*\\TorBro.exe", "*\\RockMelt.exe", "*\\Bromium.exe", "*\\Twinkstar.exe", "*\\iTop Private Browser.exe", "*\\CCleaner Browser.exe", "*\\AcWebBrowser.exe", "*\\CoolNovo.exe", "*\\spark.exe", "*\\iron.exe", "*\\Titan Browser.exe", "*\\AVG Browser.exe", "*\\UR Browser.exe", "*\\Flock.exe", "*\\CryptoTab Browser.exe", "*\\Sidekick.exe", "*\\SwingBrowser.exe", "*\\SalamWeb.exe", "*\\NetboxBrowser.exe", "*\\GarenaPlus.exe", "*\\InsomniacBrowser.exe", "*\\Viasat Browser.exe", "*\\whale.exe", "*\\falkon.exe", "*\\SogouExplorer.exe", "*\\firefox.exe", "*\\waterfox.exe", "*\\thunderbird.exe", "*\\basilisk.exe", "*\\BitTubeBrowser.exe") | stats count min(_time) as firstTime max(_time) as lastTime by dest signature_id signature SourceProcessGuid SourceProcessId SourceImage TargetProcessGuid TargetProcessId TargetImage StartModule StartFunction SourceUser TargetUser vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_uncommon_remote_thread_creation_in_browser_process_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
     - https://news.sophos.com/en-us/2022/03/10/qakbot-decoded/
@@ -137,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_universal_data_link_file_creation.yml b/detections/endpoint/windows_universal_data_link_file_creation.yml
index d1234d658d6..5d5b59f1aa3 100644
--- a/detections/endpoint/windows_universal_data_link_file_creation.yml
+++ b/detections/endpoint/windows_universal_data_link_file_creation.yml
@@ -6,31 +6,15 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects the creation of Universal Data Link (UDL) files.
+description: 'Detects the creation of Universal Data Link (UDL) files.
+
     This could indicate a phishing technique that exploits UDL files, which are typically used in Windows for database connections.
-    Attackers might leverage UDL files to bypass email filters and capture user credentials by tricking victims into testing a connection to a malicious server.
+
+    Attackers might leverage UDL files to bypass email filters and capture user credentials by tricking victims into testing a connection to a malicious server.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.file_name="*.udl"
-    Filesystem.action="created"
-
-    by Filesystem.dest Filesystem.file_create_time Filesystem.process_path
-       Filesystem.process_guid Filesystem.process_id Filesystem.file_path
-       Filesystem.action Filesystem.file_name Filesystem.user
-       Filesystem.vendor_product
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_universal_data_link_file_creation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.udl" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_universal_data_link_file_creation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate database administrators or developers may create UDL files for routine connection testing. Filter alerts based on trusted user activity to reduce false positives.
 references:
@@ -43,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml
index 31d8f46e31e..52391ca8369 100644
--- a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml
+++ b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml
@@ -6,34 +6,17 @@ modification_date: '2026-09-08'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects unauthorized access to Outlook credentials stored in the Windows registry.
+description: 'The following analytic detects unauthorized access to Outlook credentials stored in the Windows registry.
+
     It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles.
+
     This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts.
-    If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk.
+
+    If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk.'
 data_source:
     - Windows Event Log Security 4663
-search: |-
-    `wineventlog_security`
-    EventCode=4663
-    object_file_path IN (
-        "*\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676*",
-        "*\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676*"
-    )
-    NOT process_name IN (
-            "*\\HxOutlook.exe",
-            "*\\Outlook.exe"
-        )
-
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-
-      by EventCode object_file_name object_file_path
-         process_name process_path process_id dest
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_unsecured_outlook_credentials_access_in_registry_filter`
+search: |
+    `wineventlog_security` EventCode=4663 object_file_path IN ("*\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676*", "*\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676*") NOT (process_name IN ("*\\HxOutlook.exe", "*\\Outlook.exe")) | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsecured_outlook_credentials_access_in_registry_filter`
 how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
 known_false_positives: third party software may access this outlook registry.
 references:
@@ -47,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml
index 362861aa83f..0e3316d6325 100644
--- a/detections/endpoint/windows_unsigned_dll_side_loading.yml
+++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation of potentially malicious unsigned DLLs in the c:\windows\system32 or c:\windows\syswow64 folders. It leverages Sysmon EventCode 7 logs to identify unsigned DLLs with unavailable signatures loaded in these critical directories. This activity is significant as it may indicate a DLL hijacking attempt, a technique used by attackers to gain unauthorized access and execute malicious code. If confirmed malicious, this could lead to privilege escalation, allowing the attacker to gain elevated privileges and further compromise the target system.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7 Signed=false OriginalFileName = "-" SignatureStatus="unavailable" ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsigned_dll_side_loading_filter`'
+search: |
+    `sysmon` EventCode=7 Signed="false" OR (iginalFileName="-" SignatureStatus="unavailable" ImageLoaded IN ("*\\system32\\*", "*\\syswow64\\*")) | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsigned_dll_side_loading_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: It is possible some Administrative utilities will load dismcore.dll outside of normal system paths, filter as needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml
index 036b7c8f638..0738bc3a6d5 100644
--- a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml
+++ b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml
@@ -9,7 +9,8 @@ type: TTP
 description: This detection identifies unsigned DLLs loaded through DLL side-loading with same file path with the process loaded the DLL, a technique observed in DarkGate malware. This detection monitors DLL loading, verifies signatures, and flags unsigned DLLs. Suspicious file paths and known executable associations are checked. Detecting such suspicious DLLs is crucial in preventing privilege escalation attacks and other potential security breaches. Regular security assessments, thorough monitoring, and implementing security best practices are essential in safeguarding systems from such threats.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7 Signed=false SignatureStatus != Valid NOT (Image IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*")) NOT (ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*")) |  rex field=Image "(?<ImageFolderPath>.+\\\)" |  rex field=ImageLoaded "(?<ImageLoadedFolderPath>.+\\\)" |  where ImageFolderPath = ImageLoadedFolderPath | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsigned_dll_side_loading_in_same_process_path_filter`'
+search: |
+    `sysmon` EventCode=7 Signed=false SignatureStatus != Valid NOT (Image IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*")) NOT (ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*")) |  rex field=Image "(?<ImageFolderPath>.+\\\)" |  rex field=ImageLoaded "(?<ImageLoadedFolderPath>.+\\\)" |  where ImageFolderPath = ImageLoadedFolderPath | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsigned_dll_side_loading_in_same_process_path_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An unsigned dll module was loaded on $dest$
     entity:
diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml
index 71387cbe8f2..575b2bfc63c 100644
--- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml
+++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml
@@ -52,7 +52,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -87,6 +87,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_load/wineloader_dll_sideload.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml
index 928ca65c33c..bfed034652f 100644
--- a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml
+++ b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. It leverages EventCode 4768, which is generated when the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT) and detects failure code `0x12` (credentials revoked). This behavior is significant as it may indicate a Password Spraying attack targeting disabled accounts, potentially leading to initial access or privilege escalation. If confirmed malicious, attackers could gain unauthorized access or elevate privileges within the Active Directory environment.
 data_source:
     - Windows Event Log Security 4768
-search: |-
+search: |
     `wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12
       | bucket span=5m _time
       | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user values(dest) as dest
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -56,9 +56,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml
index 39803843db3..8638aa69372 100644
--- a/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml
+++ b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. It leverages Event ID 4768, which is generated when the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT) and detects failure code 0x6, indicating the user is not found in the Kerberos database. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access and potential privilege escalation within the Active Directory environment.
 data_source:
     - Windows Event Log Security 4768
-search: |-
+search: |
     `wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6
       | bucket span=5m _time
       | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user values(dest) as dest
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -56,9 +56,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml
index 82358f447da..34132b033ff 100644
--- a/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml
+++ b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. It leverages EventCode 4776 and calculates the standard deviation for each host, using the 3-sigma rule to detect anomalies. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access or privilege escalation, posing a significant threat to the Active Directory environment. This detection is focused on domain controllers.
 data_source:
     - Windows Event Log Security 4776
-search: |-
+search: |
     `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064
       | bucket span=2m _time
       | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user values(dest) as dest
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -59,9 +59,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml
index 7bd3e2fab3c..5446dc5a80f 100644
--- a/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml
+++ b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. It leverages Windows Event Code 4648 and calculates the standard deviation for each host, using the 3-sigma rule to detect anomalies. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, or further compromise of the Active Directory environment.
 data_source:
     - Windows Event Log Security 4648
-search: |-
+search: |
     `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$
       | bucket span=5m _time
       | stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) as user values(dest) as dest values(src_ip) as src_ip
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -59,9 +59,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml
index 3b197ab1d41..e536f8d35e5 100644
--- a/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml
+++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a source endpoint failing to authenticate multiple valid users using the Kerberos protocol, potentially indicating a Password Spraying attack. It leverages Event 4771, which is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT) due to a wrong password (failure code 0x18). This detection uses statistical analysis, specifically the 3-sigma rule, to identify unusual authentication failures. If confirmed malicious, this activity could allow an attacker to gain initial access or elevate privileges within an Active Directory environment.
 data_source:
     - Windows Event Log Security 4771
-search: |-
+search: |
     `wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18
       | bucket span=5m _time
       | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user values(dest) as dest
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -58,9 +58,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml
index 9b65d729cbf..ebffa009d8a 100644
--- a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml
+++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a source process failing to authenticate multiple users, potentially indicating a Password Spraying attack. It leverages Windows Event 4625, which logs failed logon attempts, and uses statistical analysis to detect anomalies. This activity is significant as it may represent an adversary attempting to gain initial access or elevate privileges within an Active Directory environment. If confirmed malicious, the attacker could compromise multiple accounts, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
 data_source:
     - Windows Event Log Security 4625
-search: |-
+search: |
     `wineventlog_security`  EventCode=4625 Logon_Type=2 ProcessName!="-"
       | bucket span=2m _time
       | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user values(dest) as dest values(src) as src
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
@@ -62,9 +62,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml
index c0dc3ac2517..be901ca45a3 100644
--- a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml
+++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a source endpoint failing to authenticate multiple valid users using the NTLM protocol, potentially indicating a Password Spraying attack. It leverages Event 4776 from Domain Controllers, calculating the standard deviation for each host and applying the 3-sigma rule to detect anomalies. This activity is significant as it may represent an adversary attempting to gain initial access or elevate privileges. If confirmed malicious, the attacker could compromise multiple accounts, leading to unauthorized access and potential lateral movement within the network.
 data_source:
     - Windows Event Log Security 4776
-search: |-
+search: |
     `wineventlog_security`  EventCode=4776 TargetUserName!=*$ Status=0xC000006A
       | bucket span=2m _time
       | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts values(dest) as dest
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Workstation$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Workstation$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: Workstation
@@ -54,9 +54,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml b/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml
index 617bf0f8156..8b1beac0a42 100644
--- a/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml
+++ b/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies a source host failing to authenticate against a remote host with multiple users, potentially indicating a Password Spraying attack. It leverages Windows Event 4625 (failed logon attempts) and Logon Type 3 (remote authentication) to detect this behavior. This activity is significant as it may represent an adversary attempting to gain initial access or elevate privileges within an Active Directory environment. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and further compromise of the network.
 data_source:
     - Windows Event Log Security 4625
-search: |-
+search: |
     `wineventlog_security`  EventCode=4625 Logon_Type=3 IpAddress!="-"
       | bucket span=2m _time
       | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts values(dest) as dest values(src) as src values(user) as user
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$Computer$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: Computer
@@ -57,9 +57,9 @@ product:
 category: endpoint
 security_domain: endpoint
 tests:
-    - attack_data:
+    - name: True Positive Test
+      attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log
           source: XmlWinEventLog:Security
           sourcetype: XmlWinEventLog
-      name: True Positive Test
       test_type: unit
diff --git a/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml b/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml
index bd0469d430a..ab545d7d1f0 100644
--- a/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml
+++ b/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml
@@ -6,45 +6,19 @@ modification_date: '2026-09-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects executable file formats being created within the Confluence main directory.
+description: 'The following analytic detects executable file formats being created within the Confluence main directory.
+
     This can be indicative of exploitation of the Confluence web services to stage malware.
-    This won't catch adversaries who modify the output location outside the Confluence directory when exploiting.
+
+    This won''t catch adversaries who modify the output location outside the Confluence directory when exploiting.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.file_path="*\\Atlassian\\Confluence\\*"
-    Filesystem.file_path IN (
-        "*.bat",
-        "*.cmd",
-        "*.dat",
-        "*.dll",
-        "*.exe",
-        "*.msc",
-        "*.ps1",
-        "*.vbe",
-        "*.vbs"
-    )
-
-    by Filesystem.dest Filesystem.file_create_time Filesystem.process_path Filesystem.process_name
-       Filesystem.process_guid Filesystem.process_id Filesystem.file_path Filesystem.action
-       Filesystem.file_name Filesystem.user Filesystem.vendor_product
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\Atlassian\\Confluence\\*" Filesystem.file_name IN ("*.bat", "*.cmd", "*.dat", "*.dll", "*.exe", "*.msc", "*.ps1", "*.vbe", "*.vbs") by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product Filesystem.process_name | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unusual_file_creation_in_confluence_directory_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: 'Some legitimate administrative or development activities may create executable files in the Confluence directory.
 
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_unusual_file_creation_in_confluence_directory_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Some legitimate administrative or development activities may create executable files in the Confluence directory.
-    Review and filter based on approved maintenance processes.
+    Review and filter based on approved maintenance processes.'
 references:
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a
     - https://confluence.atlassian.com/security/cve-2023-22515-broken-access-control-vulnerability-in-confluence-data-center-and-server-1295682276.html
@@ -57,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_unusual_filezilla_xml_config_access.yml b/detections/endpoint/windows_unusual_filezilla_xml_config_access.yml
index 66f662ff8df..8e0fb704573 100644
--- a/detections/endpoint/windows_unusual_filezilla_xml_config_access.yml
+++ b/detections/endpoint/windows_unusual_filezilla_xml_config_access.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic identifies processes accessing FileZilla XML config files such as recentservers.xml and sitemanager.xml. It leverages Windows Security Event logs, specifically monitoring EventCode 4663, which tracks object access events. This activity is significant because it can indicate unauthorized access or manipulation of sensitive configuration files used by FileZilla, a popular FTP client. If confirmed malicious, this could lead to data exfiltration, credential theft, or further compromise of the system.
 data_source:
     - Windows Event Log Security 4663
-search: '`wineventlog_security` EventCode=4663  NOT (ProcessName IN("C:\\Program Files\\FileZilla FTP Client\\filezilla.exe", "C:\Program Files (x86)\\FileZilla FTP Client\\filezilla.exe", "C:\\Program Files\\Microsoft OneDrive\\OneDrive.exe", "C:\\Program Files (x86)\\Microsoft OneDrive\\OneDrive.exe")) file_path IN ("*FileZilla\\recentservers.xml*", "*FileZilla\\sitemanager.xml*") | stats count min(_time) as firstTime max(_time) as lastTime by  ObjectName ObjectType ProcessName AccessMask process_id EventCode Computer Caller_User_Name | rename Computer as dest Caller_User_Name as user ProcessName as process_name |  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unusual_filezilla_xml_config_access_filter`'
+search: |
+    `wineventlog_security` EventCode=4663 NOT (ProcessName IN ("C:\\Program Files\\FileZilla FTP Client\\filezilla.exe", "C:Program Files (x86)\\FileZilla FTP Client\\filezilla.exe", "C:\\Program Files\\Microsoft OneDrive\\OneDrive.exe", "C:\\Program Files (x86)\\Microsoft OneDrive\\OneDrive.exe")) file_path IN ("*FileZilla\\recentservers.xml*", "*FileZilla\\sitemanager.xml*") | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unusual_filezilla_xml_config_access_filter`
 how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
 known_false_positives: a third party application can access the FileZilla XML config files. Filter is needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_unusual_intelliform_storage_registry_access.yml b/detections/endpoint/windows_unusual_intelliform_storage_registry_access.yml
index b3d9a5bd361..6c894cbc98c 100644
--- a/detections/endpoint/windows_unusual_intelliform_storage_registry_access.yml
+++ b/detections/endpoint/windows_unusual_intelliform_storage_registry_access.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic identifies processes accessing Intelliform Storage Registry keys used by Internet Explorer. It leverages Windows Security Event logs, specifically monitoring EventCode 4663, which tracks object access events. This activity is significant because it can indicate unauthorized access or manipulation of sensitive registry keys used for storing form data in Internet Explorer. If confirmed malicious, this could lead to data exfiltration, credential theft, or further compromise of the system.
 data_source:
     - Windows Event Log Security 4663
-search: '`wineventlog_security` EventCode=4663  NOT (ProcessName IN("C:\\Program Files\\Internet Explorer\\iexplore.exe", "C:\\Windows\\System32\\dllhost.exe", "C:\\Windows\\SysWow64\\dllhost.exe")) ObjectName IN ("*Software\\microsoft\\Internet Explorer\\Intelliforms\\storage2*") | stats count min(_time) as firstTime max(_time) as lastTime by  ObjectName ObjectType ProcessName AccessMask process_id EventCode Computer Caller_User_Name | rename Computer as dest Caller_User_Name as user ProcessName as process_name |  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unusual_intelliform_storage_registry_access_filter`'
+search: |
+    `wineventlog_security` EventCode=4663 NOT (ProcessName IN ("C:\\Program Files\\Internet Explorer\\iexplore.exe", "C:\\Windows\\System32\\dllhost.exe", "C:\\Windows\\SysWow64\\dllhost.exe")) ObjectName="*Software\\microsoft\\Internet Explorer\\Intelliforms\\storage2*" | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unusual_intelliform_storage_registry_access_filter`
 how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
 known_false_positives: a third party application can access the FileZilla XML config files. Filter is needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_source.yml b/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_source.yml
index 90aa08fc290..b3ecea3b0fd 100644
--- a/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_source.yml
+++ b/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_source.yml
@@ -52,7 +52,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_user.yml b/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_user.yml
index 4889ee81f8f..4bb9cd1849c 100644
--- a/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_user.yml
+++ b/detections/endpoint/windows_unusual_ntlm_authentication_destinations_by_user.yml
@@ -55,7 +55,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_unusual_ntlm_authentication_users_by_destination.yml b/detections/endpoint/windows_unusual_ntlm_authentication_users_by_destination.yml
index c6ad9b781f6..282a0b41dc1 100644
--- a/detections/endpoint/windows_unusual_ntlm_authentication_users_by_destination.yml
+++ b/detections/endpoint/windows_unusual_ntlm_authentication_users_by_destination.yml
@@ -54,7 +54,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_unusual_ntlm_authentication_users_by_source.yml b/detections/endpoint/windows_unusual_ntlm_authentication_users_by_source.yml
index daaba27029b..cbaf66eaa12 100644
--- a/detections/endpoint/windows_unusual_ntlm_authentication_users_by_source.yml
+++ b/detections/endpoint/windows_unusual_ntlm_authentication_users_by_source.yml
@@ -54,7 +54,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/endpoint/windows_unusual_process_load_mozilla_nss_mozglue_module.yml b/detections/endpoint/windows_unusual_process_load_mozilla_nss_mozglue_module.yml
index dc687b606fd..916197ab21a 100644
--- a/detections/endpoint/windows_unusual_process_load_mozilla_nss_mozglue_module.yml
+++ b/detections/endpoint/windows_unusual_process_load_mozilla_nss_mozglue_module.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic identifies processes loading Mozilla NSS-Mozglue libraries such as mozglue.dll and nss3.dll. It leverages Sysmon Event logs, specifically monitoring EventCode 7, which tracks image loaded events. This activity is significant because it can indicate unauthorized access or manipulation of these libraries, which are commonly used by Mozilla applications like Firefox and Thunderbird. If confirmed malicious, this could lead to data exfiltration, credential theft, or further compromise of the system.
 data_source:
     - Sysmon EventID 7
-search: '`sysmon` EventCode=7  ImageLoaded IN ("*\\mozglue.dll", "*\\nss3.dll") NOT(process_path IN("*:\\Program Files\Mozilla Firefox\\firefox.exe", "*:\\Program Files (x86)\Mozilla Firefox\\firefox.exe", "*:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe", "*:\\Program Files (x86)\\Mozilla Thunderbird\\thunderbird.exe", "*\\Tor Browser\\Browser\\firefox.exe","*:\\Program Files\\Code42\\CrashPlan\\Code42Service.exe", "*:\\Program Files (x86)\\Code42\\CrashPlan\\Code42Service.exe", "*:\\Program Files\\Pale Moon\\palemoon.exe", "*:\\Program Files (x86)\\Pale Moon\\palemoon.exe", "*:\\Program Files\\Waterfox\\waterfox.exe","*:\\Program Files (x86)\\Waterfox\\waterfox.exe", "*:\\Program Files\\Cyberfox\cyberfox.exe", "*:\\Program Files (x86)\\Cyberfox\\cyberfox.exe", "*\\AppData\\Local\\slack\\slack.exe", "*:\\Program Files (x86)\\VMware\\VMware Horizon View Client\\vmware-view.exe", "*:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe", "*:\\Program Files\\Google\\Google Earth Pro\\client\\googleearth.exe")) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unusual_process_load_mozilla_nss_mozglue_module_filter`'
+search: |
+    `sysmon` EventCode=7 ImageLoaded IN ("*\\mozglue.dll", "*\\nss3.dll") NOT (process_path IN ("*:\\Program FilesMozilla Firefox\\firefox.exe", "*:\\Program Files (x86)Mozilla Firefox\\firefox.exe", "*:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe", "*:\\Program Files (x86)\\Mozilla Thunderbird\\thunderbird.exe", "*\\Tor Browser\\Browser\\firefox.exe", "*:\\Program Files\\Code42\\CrashPlan\\Code42Service.exe", "*:\\Program Files (x86)\\Code42\\CrashPlan\\Code42Service.exe", "*:\\Program Files\\Pale Moon\\palemoon.exe", "*:\\Program Files (x86)\\Pale Moon\\palemoon.exe", "*:\\Program Files\\Waterfox\\waterfox.exe", "*:\\Program Files (x86)\\Waterfox\\waterfox.exe", "*:\\Program Files\\Cyberfoxcyberfox.exe", "*:\\Program Files (x86)\\Cyberfox\\cyberfox.exe", "*\\AppData\\Local\\slack\\slack.exe", "*:\\Program Files (x86)\\VMware\\VMware Horizon View Client\\vmware-view.exe", "*:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe", "*:\\Program Files\\Google\\Google Earth Pro\\client\\googleearth.exe")) | eval User=User | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unusual_process_load_mozilla_nss_mozglue_module_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: Legitimate windows application that are not on the list loading this dll. Filter as needed.
 references:
@@ -22,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml
index aef8ef031fe..f570f2c2347 100644
--- a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml
+++ b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml
@@ -10,7 +10,8 @@ description: The following analytic detects an unusual process execution pattern
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\Windows\\SysWOW64\\*" AND Processes.process = "*windows\\system32\\*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unusual_syswow64_process_run_system32_executable_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path="*\\syswow64\\*" Processes.process="*\\system32\\*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unusual_syswow64_process_run_system32_executable_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: some legitimate system processes, software updaters, or compatibility tools may trigger this behavior, occurrences involving unknown, unsigned, or unusual parent processes should be investigated for potential malware activity, persistence mechanisms, or execution flow hijacking.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_usbstor_registry_key_modification.yml b/detections/endpoint/windows_usbstor_registry_key_modification.yml
index 230e0a84b3b..571d900dfcc 100644
--- a/detections/endpoint/windows_usbstor_registry_key_modification.yml
+++ b/detections/endpoint/windows_usbstor_registry_key_modification.yml
@@ -10,21 +10,8 @@ description: This analytic is used to identify when a USB removable media device
 data_source:
     - Sysmon EventID 12
     - Sysmon EventID 13
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as firstTime, max(_time) as lastTime, count FROM datamodel=Endpoint.Registry
-      WHERE Registry.registry_path IN ("HKLM\\System\\CurrentControlSet\\Enum\\USBSTOR\\*")
-        AND
-        Registry.registry_value_name ="FriendlyName"
-      BY Registry.action Registry.dest Registry.process_guid
-         Registry.process_id Registry.registry_hive Registry.registry_path
-         Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
-         Registry.registry_value_type Registry.status Registry.user
-         Registry.vendor_product
-    | `drop_dm_object_name(Registry)`
-    | eval object_name = registry_value_data, object_handle = split(mvindex(split(registry_path, "\\"),6),"&amp;"), object_handle = mvindex(mvfilter(NOT len(object_handle)=1),0)
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_usbstor_registry_key_modification_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_key_name="HKLM\\System\\CurrentControlSet\\Enum\\USBSTOR\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product Registry.object_handle | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_usbstor_registry_key_modification_filter`
 how_to_implement: To successfully implement this search, you must ingest endpoint logging that tracks changes to the HKLM\System\CurrentControlSet\Enum\USBSTOR\ registry keys. Ensure that the field from the event logs is being mapped to the proper fields in the Endpoint.Registry data model.
 known_false_positives: Legitimate USB activity will also be detected. Please verify and investigate as appropriate.
 references:
@@ -39,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate USB events on $dest$
       search: '| from datamodel:Endpoint.Registry | search dest=$dest$ registry_path IN ("HKLM\\System\\CurrentControlSet\\Enum\\USBSTOR\\*")'
       earliest_offset: $info_min_time$
diff --git a/detections/endpoint/windows_user_deletion_via_net.yml b/detections/endpoint/windows_user_deletion_via_net.yml
index 3f2b5c512f3..97bc65f9817 100644
--- a/detections/endpoint/windows_user_deletion_via_net.yml
+++ b/detections/endpoint/windows_user_deletion_via_net.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_net`
-        AND
-        Processes.process="*user*"
-        AND
-        Processes.process="*/delete*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_user_deletion_via_net_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*net1.exe" OR Processes.original_file_name="net1.exe" Processes.process="*user*" Processes.process="*/delete*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_deletion_via_net_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: System administrators or scripts may delete user accounts via this technique. Filter as needed.
 references:
@@ -41,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_user_disabled_via_net.yml b/detections/endpoint/windows_user_disabled_via_net.yml
index 0050971bc48..d610eab2dad 100644
--- a/detections/endpoint/windows_user_disabled_via_net.yml
+++ b/detections/endpoint/windows_user_disabled_via_net.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_net`
-        AND
-        Processes.process="*user*"
-        AND
-        Processes.process="*/active:no*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_user_disabled_via_net_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*net1.exe" OR Processes.original_file_name="net1.exe" Processes.process="*user*" Processes.process="*/active:no*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_disabled_via_net_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -41,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_user_discovery_via_net.yml b/detections/endpoint/windows_user_discovery_via_net.yml
index 2aedf2608b4..b42da1594f9 100644
--- a/detections/endpoint/windows_user_discovery_via_net.yml
+++ b/detections/endpoint/windows_user_discovery_via_net.yml
@@ -6,52 +6,19 @@ modification_date: '2026-08-05'
 author: Mauricio Velazco, Teoderick Contreras, Nasreddine Bencherchali, Splunk
 status: production
 type: Hunting
-description: |-
-    The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments `user` or `users` to query local and domain accounts.
+description: 'The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments `user` or `users` to query local and domain accounts.
+
     It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate local and domain users, which is a common step in situational awareness and Active Directory discovery.
-    If confirmed malicious, this behavior could lead to further attacks, including privilege escalation and lateral movement within the network.
+
+    If confirmed malicious, this behavior could lead to further attacks, including privilege escalation and lateral movement within the network.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Endpoint.Processes WHERE
-
-    `process_net`
-
-    Processes.process IN (
-        "*user *",
-        "*user",
-        "*users *",
-        "*users"
-    )
-    NOT Processes.process IN (
-        "*/add*",
-        "*/active*",
-        "*/delete*",
-        "*/times*"
-    )
-
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_user_discovery_via_net_filter`
-how_to_implement: |-
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |-
-    Administrators or power users may use this command for troubleshooting.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*net1.exe" OR Processes.original_file_name="net1.exe" Processes.process IN ("*user *", "*user*", "*users *", "*users*") NOT (Processes.process IN ("*/add*", "*/active*", "*/delete*", "*/times*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_discovery_via_net_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
     - https://attack.mitre.org/techniques/T1087/001/
     - https://attack.mitre.org/techniques/T1087/002/
diff --git a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml
index 80763d9af86..397048854a1 100644
--- a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml
+++ b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic detects the creation URL shortcut files, often used by malware like CHAOS ransomware. It leverages the Endpoint.Filesystem datamodel to identify ".url" files created outside common directories, such as "Program Files". This activity can be significant as ".URL" files can be used as mean to trick the user into visiting certain websites unknowingly, or when placed in certain locations such as "\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", it may allow the execution of malicious code upon system reboot. If confirmed malicious, this could allow an attacker to achieve persistence and execute harmful payloads, potentially leading to further system compromise and data loss.
 data_source:
     - Sysmon EventID 11
-search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where NOT Filesystem.file_path IN ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*", "*\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", "*:\\Windows\\WinSxS\\*") Filesystem.file_name=*.url by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_execution_malicious_url_shortcut_file_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where NOT (Filesystem.file_path IN ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*", "*\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", "*:\\Windows\\WinSxS\\*")) Filesystem.file_name="*.url" by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_execution_malicious_url_shortcut_file_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 known_false_positives: Administrators may allow creation of script or exe in this path.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_visual_basic_commandline_compiler_dnsquery.yml b/detections/endpoint/windows_visual_basic_commandline_compiler_dnsquery.yml
index 022e7cb9611..f1df8317c52 100644
--- a/detections/endpoint/windows_visual_basic_commandline_compiler_dnsquery.yml
+++ b/detections/endpoint/windows_visual_basic_commandline_compiler_dnsquery.yml
@@ -9,19 +9,8 @@ type: TTP
 description: The following analytic detects instances where vbc.exe, the Visual Basic Command Line Compiler, initiates DNS queries. Normally, vbc.exe operates locally to compile Visual Basic code and does not require internet access or to perform DNS lookups. Therefore, any observed DNS activity originating from vbc.exe is highly suspicious and indicative of potential malicious activity. This behavior often suggests that a malicious payload is masquerading as the legitimate vbc.exe process to establish command-and-control (C2) communication, resolve domains for data exfiltration, or download additional stages of malware. Security teams should investigate the process's parent, command-line arguments, and the resolved domains for further indicators of compromise.
 data_source:
     - Sysmon EventID 22
-search: |-
-    `sysmon` EventCode=22 process_name="vbc.exe"
-      | rename dvc as dest
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY answer answer_count dest
-           process_exec process_guid process_name
-           query query_count reply_code_id
-           signature signature_id src
-           user_id vendor_product QueryName
-           QueryResults QueryStatus
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_visual_basic_commandline_compiler_dnsquery_filter`
+search: |
+    `sysmon` EventCode=22 process_name="vbc.exe" | eval process_name=process_name, dvc=dvc, dest=Computer, QueryName=QueryName | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count query query_count reply_code_id src vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_visual_basic_commandline_compiler_dnsquery_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -34,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: vbc.exe process [$process_name$] made a DNS query for $query$ from host $dest$.
     entity:
diff --git a/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml b/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml
index 93c761b557f..ffdc5a4b5cf 100644
--- a/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml
+++ b/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml
@@ -6,35 +6,23 @@ modification_date: '2026-05-01'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects vssvc.exe opening a handle to MsMpEng.exe.
+description: 'Detects vssvc.exe opening a handle to MsMpEng.exe.
+
     In the RedSun exploit, VSS participates in the cloud-file restore race that directs WD to write through the NTFS junction.
+
     This handle acquisition is observed at the exact moment of exploitation.
-    vssvc querying MsMpEng is not expected in normal operation.
+
+    vssvc querying MsMpEng is not expected in normal operation.'
 data_source:
     - Sysmon EventID 10
-search: |-
-    `sysmon`
-    EventCode=10
-    TargetImage="*\\MsMpEng.exe"
-    SourceImage="*\\vssvc.exe"
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by EventID GrantedAccess Guid Opcode ProcessID
-         SourceImage SourceProcessGUID  SourceProcessId
-         TargetImage TargetProcessGUID TargetProcessId
-         UserID dest CallTrace user_id parent_process_name
-         parent_process_guid process_name
-         process_guid process_id signature
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_vssvc_process_accessing_defender_engine_filter`
-how_to_implement: |-
-    This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe.
+search: |
+    `sysmon` EventCode=10 TargetImage="*\\MsMpEng.exe" SourceImage="*\\vssvc.exe" | eval granted_access=granted_access, parent_process_path=parent_process_path | stats count min(_time) as firstTime max(_time) as lastTime by dest user_id process_name process_guid process_id signature SourceImage TargetImage GrantedAccess CallTrace | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_vssvc_process_accessing_defender_engine_filter`
+how_to_implement: 'This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe.
+
     This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs.
-    Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
-known_false_positives: |-
-    No false positives have been identified at this time.
+
+    Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.'
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://github.com/Nightmare-Eclipse/RedSun
     - https://www.huntress.com/blog/nightmare-eclipse-intrusion
@@ -46,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Windows Process $SourceImage$ accessing $TargetImage$ on $dest$
     entity:
diff --git a/detections/endpoint/windows_vulnerable_3cx_software.yml b/detections/endpoint/windows_vulnerable_3cx_software.yml
index 9f71be30036..3aa0da0e884 100644
--- a/detections/endpoint/windows_vulnerable_3cx_software.yml
+++ b/detections/endpoint/windows_vulnerable_3cx_software.yml
@@ -9,19 +9,8 @@ type: TTP
 description: The following analytic detects instances of the 3CXDesktopApp.exe with a FileVersion of 18.12.x, leveraging Sysmon logs. This detection focuses on identifying vulnerable versions 18.12.407 and 18.12.416 of the 3CX desktop app. Monitoring this activity is crucial as these specific versions have known vulnerabilities that could be exploited by attackers. If confirmed malicious, exploitation of this vulnerability could lead to unauthorized access, code execution, or further compromise of the affected system, posing significant security risks.
 data_source:
     - Sysmon EventID 1
-search: |-
-    `sysmon` (process_name=3CXDesktopApp.exe OR OriginalFileName=3CXDesktopApp.exe)  FileVersion=18.12.*
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY action dest original_file_name
-           parent_process parent_process_exec parent_process_guid
-           parent_process_id parent_process_name parent_process_path
-           process process_exec process_guid
-           process_hash process_id process_integrity_level
-           process_name process_path user
-           user_id vendor_product
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_vulnerable_3cx_software_filter`
+search: |
+    `sysmon` EventCode=1 Image="*3CXDesktopApp.exe" OR OriginalFileName="3CXDesktopApp.exe" FileVersion="18.12.*" | eval src_user=src_user | stats count min(_time) as firstTime max(_time) as lastTime by action dest original_file_name parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process process_exec process_guid process_hash process_id process_integrity_level process_name process_path user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_vulnerable_3cx_software_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: False positives may be present based on file version, modify the analytic to only look for version between 18.12.407 and 18.12.416 as needed.
 references:
@@ -38,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A known vulnerable instance of 3CX Software $process_name$ ran on $dest$, related to a supply chain attack.
     entity:
diff --git a/detections/endpoint/windows_vulnerable_driver_installed.yml b/detections/endpoint/windows_vulnerable_driver_installed.yml
index 6f5d12c6d4d..3c470965893 100644
--- a/detections/endpoint/windows_vulnerable_driver_installed.yml
+++ b/detections/endpoint/windows_vulnerable_driver_installed.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Windows System service install EventCode 7045 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration. This detection is a Windows Event Log adaptation of the Sysmon driver loaded detection written by Michael Haag.
 data_source:
     - Windows Event Log System 7045
-search: |-
+search: |
     `wineventlog_system` EventCode=7045 ServiceType="kernel mode driver"
       | table _time dest EventCode ImagePath ServiceName ServiceType
       | lookup local=t loldrivers driver_name AS ImagePath OUTPUT is_driver driver_description
@@ -31,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potentially vulnerable/malicious driver [$ImagePath$] has been installed on $dest$
     entity:
diff --git a/detections/endpoint/windows_vulnerable_driver_loaded.yml b/detections/endpoint/windows_vulnerable_driver_loaded.yml
index 26fcf996f6b..8c7e165c21e 100644
--- a/detections/endpoint/windows_vulnerable_driver_loaded.yml
+++ b/detections/endpoint/windows_vulnerable_driver_loaded.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Sysmon EventCode 6 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration.
 data_source:
     - Sysmon EventID 6
-search: |-
+search: |
     `sysmon` EventCode=6
       | stats  min(_time) as firstTime max(_time) as lastTime count
         BY ImageLoaded dest dvc
diff --git a/detections/endpoint/windows_wbadmin_file_recovery_from_backup.yml b/detections/endpoint/windows_wbadmin_file_recovery_from_backup.yml
index 6260f0cb37c..ff3c950fdb8 100644
--- a/detections/endpoint/windows_wbadmin_file_recovery_from_backup.yml
+++ b/detections/endpoint/windows_wbadmin_file_recovery_from_backup.yml
@@ -6,49 +6,37 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic identifies the execution of wbadmin.exe with arguments indicative of restoring files from an existing backup.
+description: 'The following analytic identifies the execution of wbadmin.exe with arguments indicative of restoring files from an existing backup.
+
     WBAdmin is a legitimate Windows Backup utility used for creating, managing, and restoring backups. However, adversaries may abuse it to restore specific files (e.g., sensitive credentials, configuration files, or malware stagers) from prior backups to regain access or re-establish persistence after cleanup or encryption events.
+
     Monitoring this behavior is important because restoring individual files from a system backup outside of approved recovery workflows may indicate an attacker attempting to retrieve deleted or encrypted data, recover previously dropped payloads, or access prior system states as part of post-compromise activity.
-    If confirmed malicious, this action could enable attackers to regain operational footholds, extract sensitive data, or restore tampered components, undermining remediation and containment efforts.
+
+    If confirmed malicious, this action could enable attackers to regain operational footholds, extract sensitive data, or restore tampered components, undermining remediation and containment efforts.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wbadmin.exe" OR Processes.original_file_name="WBADMIN.EXE" Processes.process="*start*" Processes.process="*recovery*" Processes.process="*itemtype:file*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wbadmin_file_recovery_from_backup_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
 
-    (Processes.process_name=wbadmin.exe OR Processes.original_file_name=WBADMIN.EXE)
-    Processes.process = "*start*"
-    Processes.process = "*recovery*"
-    Processes.process = "*itemtype:file*"
-
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
-       Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id
-       Processes.vendor_product
-
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_wbadmin_file_recovery_from_backup_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    Administrators may use WBAdmin to restore files during approved recovery or testing activities. Validate the users and context of the operation and apply additional filters as needed.
+
+    names and speed up the data modeling process.'
+known_false_positives: Administrators may use WBAdmin to restore files during approved recovery or testing activities. Validate the users and context of the operation and apply additional filters as needed.
 references:
     - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
     - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
@@ -61,7 +49,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml
index 7f894ff9bfa..151eabf4eb6 100644
--- a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml
+++ b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml
@@ -6,32 +6,17 @@ modification_date: '2026-10-12'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects the wermgr.exe process creating an alternate stream in the temp directory. It leverages Sysmon EventID 15 to identify these actions.
+description: 'The following analytic detects the wermgr.exe process creating an alternate stream in the temp directory. It leverages Sysmon EventID 15 to identify these actions.
+
     This activity is significant because wermgr.exe is typically associated with error reporting, not file creation. Such activity is significant as it may indicate RoguePlanet malware, which creates an alternate stream in the temp directory to execute malicious code.
-    If confirmed malicious, this could lead to further malware infections, data exfiltration, or system compromise.
+
+    If confirmed malicious, this could lead to further malware infections, data exfiltration, or system compromise.'
 data_source:
     - Sysmon EventID 15
-search: |-
-    `sysmon`
-    EventCode=15
-    TargetFilename = "*\\Temp\\*"
-    TargetFilename = "*\\wermgr.exe:*"
-
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by dest file_hash file_name file_path
-         process_path process_name process_exec process_guid process_id
-         user_id user Contents
-         signature signature_id vendor_product
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_wermgr_alternate_data_stream_in_temp_dir_filter`
-how_to_implement: |-
-    To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
-known_false_positives: |-
-    No false positives have been identified at this time.
+search: |
+    `sysmon` EventCode=15 TargetFilename="*\\Temp\\*" TargetFilename="*\\wermgr.exe:*" | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc file_hash file_name file_path process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wermgr_alternate_data_stream_in_temp_dir_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://github.com/MSNightmare/RoguePlanet/tree/main
 drilldown_searches:
@@ -42,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_wermgr_spawning_system_integrity_process.yml b/detections/endpoint/windows_wermgr_spawning_system_integrity_process.yml
index 61822ae2030..3db1effb1bc 100644
--- a/detections/endpoint/windows_wermgr_spawning_system_integrity_process.yml
+++ b/detections/endpoint/windows_wermgr_spawning_system_integrity_process.yml
@@ -6,43 +6,23 @@ modification_date: '2026-08-18'
 author: Onur Mustafa Erdogan, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects WerMgr.exe (Windows Error Reporting) spawning a child process running at SYSTEM integrity level.
+description: 'The following analytic detects WerMgr.exe (Windows Error Reporting) spawning a child process running at SYSTEM integrity level.
+
     WerMgr.exe normally runs at the integrity level of the reporting user or as a background SYSTEM-owned service that does not launch interactive children.
+
     In the ShieldBreak exploit, WerMgr.exe is manually triggered via the QueueReporting scheduled task and loads an attacker-planted phantom DLL (phoneinfo.dll), which then spawns an elevated shell.
-    If confirmed malicious, this activity indicates successful local privilege escalation to SYSTEM.
+
+    If confirmed malicious, this activity indicates successful local privilege escalation to SYSTEM.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Processes where
-
-    Processes.parent_process_name="WerMgr.exe"
-    (
-        Processes.process_integrity_level="System"
-        OR
-        Processes.user IN ("*$", "System")
-    )
-
-    by Processes.action Processes.dest Processes.parent_process_name Processes.parent_process_path
-       Processes.parent_process Processes.parent_process_id Processes.process_name
-       Processes.process_path Processes.process Processes.process_id Processes.process_hash
-       Processes.process_integrity_level Processes.user Processes.vendor_product
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*WerMgr.exe" Processes.process_integrity_level="System" OR Processes.user IN ("*$", "*System") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wermgr_spawning_system_integrity_process_filter`
+how_to_implement: This detection is based on Process creation events. Make sure you are ingesting logs that contain parent process details and fields that indicate privilege level, such as user name or integrity level. If you are using Sysmon, make sure to enable logging of child processes of WerMgr.exe.
+known_false_positives: 'No false positives have been identified at this time.
 
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_wermgr_spawning_system_integrity_process_filter`
-how_to_implement: |-
-    This detection is based on Process creation events. Make sure you are ingesting logs that contain parent process details and fields that indicate privilege level, such as user name or integrity level. If you are using Sysmon, make sure to enable logging of child processes of WerMgr.exe.
-known_false_positives: |-
-    No false positives have been identified at this time.
-    WerMgr.exe spawning a SYSTEM-integrity child process is not expected under normal Windows Error Reporting operation.
+    WerMgr.exe spawning a SYSTEM-integrity child process is not expected under normal Windows Error Reporting operation.'
 references:
     - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day
     - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet
@@ -55,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: The [$parent_process_name$] process spawned [$process_name$] running at SYSTEM integrity level on $dest$
     entity:
diff --git a/detections/endpoint/windows_windbg_spawning_autoit3.yml b/detections/endpoint/windows_windbg_spawning_autoit3.yml
index c66a241fc26..e7a56c6642d 100644
--- a/detections/endpoint/windows_windbg_spawning_autoit3.yml
+++ b/detections/endpoint/windows_windbg_spawning_autoit3.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes  where Processes.parent_process_name=windbg.exe  AND (Processes.process_name IN ("autoit3.exe", "autoit*.exe") OR Processes.original_file_name IN ("autoit3.exe", "autoit*.exe")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval matches_extension=if(match(process, "\\.(au3|a3x|exe|aut|aup)$"), "Yes", "No") | search matches_extension="Yes" | `windows_windbg_spawning_autoit3_filter`'
+search: |
+    `sysmon` EventCode=1 ParentImage="*windbg.exe" Image IN ("autoit3.exe", "autoit*.exe") OR OriginalFileName IN ("autoit3.exe", "autoit*.exe") matches_extension="Yes" | eval src_user=src_user | stats count min(_time) as firstTime max(_time) as lastTime by action dest original_file_name parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process process_exec process_guid process_hash process_id process_integrity_level process_name process_path user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_windbg_spawning_autoit3_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives will only be present if the WinDBG process legitimately spawns AutoIt3. Filter as needed.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$.
     entity:
diff --git a/detections/endpoint/windows_winlogon_with_public_network_connection.yml b/detections/endpoint/windows_winlogon_with_public_network_connection.yml
index 4664d0c00a0..f3cdc61131d 100644
--- a/detections/endpoint/windows_winlogon_with_public_network_connection.yml
+++ b/detections/endpoint/windows_winlogon_with_public_network_connection.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: The following analytic detects instances of Winlogon.exe, a critical Windows process, connecting to public IP addresses. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on network connections made by Winlogon.exe. Under normal circumstances, Winlogon.exe should not connect to public IPs, and such activity may indicate a compromise, such as the BlackLotus bootkit attack. This detection is significant as it highlights potential system integrity breaches. If confirmed malicious, attackers could maintain persistence, bypass security measures, and compromise the system at a fundamental level.
 data_source:
     - Sysmon EventID 1 AND Sysmon EventID 3
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
       WHERE Processes.process_name IN (winlogon.exe) Processes.process!=unknown
       BY Processes.action Processes.dest Processes.original_file_name
diff --git a/detections/endpoint/windows_winpeas_powershell_script_execution.yml b/detections/endpoint/windows_winpeas_powershell_script_execution.yml
index b85c12178b7..e76a17b75fe 100644
--- a/detections/endpoint/windows_winpeas_powershell_script_execution.yml
+++ b/detections/endpoint/windows_winpeas_powershell_script_execution.yml
@@ -6,31 +6,15 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects the execution of the WinPEAS PowerShell script via default function names used within the script.
+description: 'Detects the execution of the WinPEAS PowerShell script via default function names used within the script.
+
     winPEAS is a Windows tool that stands for Windows Privilege Escalation Awesome Script.
-    Similar to its Linux counterpart, linpeas.sh, winPEAS is designed to automate the process of identifying potential privilege escalation paths on Windows systems.
+
+    Similar to its Linux counterpart, linpeas.sh, winPEAS is designed to automate the process of identifying potential privilege escalation paths on Windows systems.'
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell`
-    EventID="4104"
-    ScriptBlockText IN (
-        "*returnHotFixID*",
-        "*Start-ACLCheck*",
-        "*UnquotedServicePathCheck*",
-        "*Get-ClipBoardText*"
-    )
-    | fillnull
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by Computer EventID ScriptBlockText signature signature_id user_id vendor_product Guid
-         Opcode Name Path ProcessID ScriptBlockId
-
-    | rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_winpeas_powershell_script_execution_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process IN ("*returnHotFixID*", "*Start-ACLCheck*", "*UnquotedServicePathCheck*", "*Get-ClipBoardText*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_winpeas_powershell_script_execution_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate security assessments or administrative audits may run WinPEAS for privilege escalation checks. Exclude trusted security tools to reduce false alerts.
 references:
@@ -43,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential WinPEAS PowerShell activity observed on $dest$ via script block $ScriptBlockId$.
     entity:
diff --git a/detections/endpoint/windows_winrar_launched_outside_default_installation_directory.yml b/detections/endpoint/windows_winrar_launched_outside_default_installation_directory.yml
index c1a98ae106e..3060b90d9c9 100644
--- a/detections/endpoint/windows_winrar_launched_outside_default_installation_directory.yml
+++ b/detections/endpoint/windows_winrar_launched_outside_default_installation_directory.yml
@@ -6,35 +6,19 @@ modification_date: '2026-05-13'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    This Analytics detects the execution of WinRAR or RAR outside the default installation directory.
+description: 'This Analytics detects the execution of WinRAR or RAR outside the default installation directory.
+
     This behavior can be significant as it could indicate attempts to archive collected sensitive data from the endpoint for exfiltration.
-    We recommend reviewing the process path and the parent process path to determine if the execution is legitimate and if possible validate the data being archived.
+
+    We recommend reviewing the process path and the parent process path to determine if the execution is legitimate and if possible validate the data being archived.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
-      from datamodel=Endpoint.Processes where
-      Processes.process_name IN ("Winrar.exe", "rar.exe")
-      NOT Processes.process_path IN (
-        "*:\\Program Files (x86)\\WinRAR\\*",
-        "*:\\Program Files\\WinRAR\\*"
-      )
-      by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-      Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-      Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-      Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-      Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_winrar_launched_outside_default_installation_directory_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: |
-    False positives are expected from machines where the default installation path was changed. Apply additional filters accordingly.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name IN ("*Winrar.exe", "*rar.exe") NOT (Processes.process_path IN ("*:\\Program Files (x86)\\WinRAR\\*", "*:\\Program Files\\WinRAR\\*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_winrar_launched_outside_default_installation_directory_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: False positives are expected from machines where the default installation path was changed. Apply additional filters accordingly.
 references:
     - https://malpedia.caad.fkie.fraunhofer.de/details/py.blankgrabber
 drilldown_searches:
@@ -45,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_winscp_configuration_security_access.yml b/detections/endpoint/windows_winscp_configuration_security_access.yml
index 5e11ead6c81..3c3e09fd24c 100644
--- a/detections/endpoint/windows_winscp_configuration_security_access.yml
+++ b/detections/endpoint/windows_winscp_configuration_security_access.yml
@@ -6,33 +6,21 @@ modification_date: '2026-07-22'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    This analytic detects unauthorized access to the WinSCP security configuration folder by processes other than WinSCP itself.
+description: 'This analytic detects unauthorized access to the WinSCP security configuration folder by processes other than WinSCP itself.
+
     WinSCP stores sensitive SSH and FTP session credentials, including passwords and private key references, under the user profile path Martin Prikryl\WinSCP 2\Configuration\Security. Information-stealing malware such as Phantom Stealer targets this directory to harvest stored credentials for exfiltration.
+
     The detection uses Windows Security Event 4663 (Object Access) to identify any non-WinSCP process reading or accessing files within this path, which is abnormal during routine system operation.
-    Analysts should investigate the accessing process, its parent, and any associated network activity to determine whether a credential theft attempt is underway.
+
+    Analysts should investigate the accessing process, its parent, and any associated network activity to determine whether a credential theft attempt is underway.'
 data_source:
     - Windows Event Log Security 4663
-search: |-
-    `wineventlog_security`
-    EventCode=4663
-    object_file_path="*\\Martin Prikryl\\WinSCP 2\\Configuration\\Security*"
-    NOT process_path IN ("*:\\Program Files (x86)\\WinSCP\\WinSCP.exe")
-
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-      by object_file_name object_file_path
-         process_name process_path process_id
-         EventCode dest
+search: |
+    `wineventlog_security` EventCode=4663 object_file_path="*\\Martin Prikryl\\WinSCP 2\\Configuration\\Security*" NOT process_path="*:\\Program Files (x86)\\WinSCP\\WinSCP.exe" | eval process_name=process_name, process_id=process_id | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_winscp_configuration_security_access_filter`
+how_to_implement: 'To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663.
 
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_winscp_configuration_security_access_filter`
-how_to_implement: |-
-    To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663.
-    For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
-known_false_positives: |-
-    False positive may occur during backup or anti-virus scanning process, as well as from WinSCP itself if it is installed in a different path than the default path. Filter as needed.
+    For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."'
+known_false_positives: False positive may occur during backup or anti-virus scanning process, as well as from WinSCP itself if it is installed in a different path than the default path. Filter as needed.
 references:
     - https://malpedia.caad.fkie.fraunhofer.de/details/win.phantom_stealer
     - https://www.proofpoint.com/us/blog/threat-insight/not-safe-work-tracking-and-investigating-stealerium-and-phantom-infostealers
@@ -44,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_wmi_impersonate_token.yml b/detections/endpoint/windows_wmi_impersonate_token.yml
index 5c9648a1bbd..fdb6a308547 100644
--- a/detections/endpoint/windows_wmi_impersonate_token.yml
+++ b/detections/endpoint/windows_wmi_impersonate_token.yml
@@ -6,12 +6,12 @@ modification_date: '2026-09-08'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects WMI token impersonation by identifying `wmiprvse.exe` requesting the query, VM, and duplicate-handle rights associated with WMI process access.
-    It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_INFORMATION (0x400), PROCESS_QUERY_LIMITED_INFORMATION (0x1000), PROCESS_VM_OPERATION (0x8), PROCESS_VM_READ (0x10), PROCESS_VM_WRITE (0x20), PROCESS_DUP_HANDLE (0x40), and PROCESS_ALL_ACCESS (0x1f3fff).
+description: 'The following analytic detects WMI token impersonation by identifying `wmiprvse.exe` requesting the query, VM, and duplicate-handle rights associated with WMI process access.
+
+    It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_INFORMATION (0x400), PROCESS_QUERY_LIMITED_INFORMATION (0x1000), PROCESS_VM_OPERATION (0x8), PROCESS_VM_READ (0x10), PROCESS_VM_WRITE (0x20), PROCESS_DUP_HANDLE (0x40), and PROCESS_ALL_ACCESS (0x1f3fff).'
 data_source:
     - Sysmon EventID 10
-search: |-
+search: |
     `sysmon`
     EventCode=10
     SourceImage="*\\wmiprvse.exe"
@@ -61,7 +61,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_wmi_process_and_service_list.yml b/detections/endpoint/windows_wmi_process_and_service_list.yml
index d24a33dc9b0..1425caafdda 100644
--- a/detections/endpoint/windows_wmi_process_and_service_list.yml
+++ b/detections/endpoint/windows_wmi_process_and_service_list.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_wmic` Processes.process IN ("*process*", "*service*") Processes.process = "*list*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_wmi_process_and_service_list_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process IN ("*process*", "*service*") Processes.process="*list*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmi_process_and_service_list_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: netowrk administrator or IT may execute this command for auditing processes and services.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml
index 72ddb7df02c..7b72416666f 100644
--- a/detections/endpoint/windows_wmi_process_call_create.yml
+++ b/detections/endpoint/windows_wmi_process_call_create.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_wmic` Processes.process = "* process *" Processes.process = "* call *" Processes.process = "* create *"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_wmi_process_call_create_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process="* process *" Processes.process="* call *" Processes.process="* create *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmi_process_call_create_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may execute this command for testing or auditing.
 references:
diff --git a/detections/endpoint/windows_wmi_reconnaissance_class_query.yml b/detections/endpoint/windows_wmi_reconnaissance_class_query.yml
index 5170634032b..7eff3aa5c62 100644
--- a/detections/endpoint/windows_wmi_reconnaissance_class_query.yml
+++ b/detections/endpoint/windows_wmi_reconnaissance_class_query.yml
@@ -6,61 +6,16 @@ modification_date: '2026-10-02'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the use of WMIC (Windows Management Instrumentation Command-line) for reconnaissance and system information discovery on Windows endpoints.
-    It identifies command-line queries targeting common Win32 WMI classes such as Win32_OperatingSystem, Win32_Processor, csproduct, Win32_DiskDrive, and Win32_PhysicalMemory, which are frequently leveraged to enumerate hardware, operating system details, and system configuration. Adversaries often use these queries during post-exploitation to fingerprint hosts, assess virtualization, and tailor follow-on activity. While WMIC usage can be legitimate for administrative and inventory tasks, suspicious or unexpected execution—particularly by non-administrative users or uncommon parent processes—may indicate malicious reconnaissance aligned with system discovery techniques.
+description: 'The following analytic detects the use of WMIC (Windows Management Instrumentation Command-line) for reconnaissance and system information discovery on Windows endpoints.
+
+    It identifies command-line queries targeting common Win32 WMI classes such as Win32_OperatingSystem, Win32_Processor, csproduct, Win32_DiskDrive, and Win32_PhysicalMemory, which are frequently leveraged to enumerate hardware, operating system details, and system configuration. Adversaries often use these queries during post-exploitation to fingerprint hosts, assess virtualization, and tailor follow-on activity. While WMIC usage can be legitimate for administrative and inventory tasks, suspicious or unexpected execution—particularly by non-administrative users or uncommon parent processes—may indicate malicious reconnaissance aligned with system discovery techniques.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-      as lastTime from datamodel=Endpoint.Processes where
-      (
-        NOT Processes.parent_process_path  IN (
-            "*:\\Program Files (x86)\\*",
-            "*:\\Program Files\\*",
-            "*:\\Windows\\System32\\*",
-            "*:\\Windows\\SysWOW64\\*"
-        )
-        OR
-        Processes.parent_process_name IN(
-            "cmd.exe",
-            "powershell*",
-            "pwsh.exe"
-        )
-      )
-      AND
-      (
-        Processes.process_name = "wmic.exe"
-        OR
-        Processes.original_file_name = "wmic.exe"
-      )
-      Processes.process IN (
-        "*csproduct*",
-        "*Win32_BaseBoard*",
-        "*Win32_Bios*",
-        "*Win32_DiskDrive*",
-        "*Win32_DisplayConfiguration*",
-        "*Win32_OperatingSystem*",
-        "*Win32_PhysicalMemory*",
-        "*Win32_PnPEntity*",
-        "*Win32_Processor*",
-        "*Win32_ShadowCopy*",
-        "*win32_ShortcutFile*",
-        "*win32_VideoController*"
-      )
-      by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-      Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-      Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-      Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-      Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_wmi_reconnaissance_class_query_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*cmd.exe", "*powershell", "*pwsh.exe") Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process IN ("*csproduct*", "*Win32_BaseBoard*", "*Win32_Bios*", "*Win32_DiskDrive*", "*Win32_DisplayConfiguration*", "*Win32_OperatingSystem*", "*Win32_PhysicalMemory*", "*Win32_PnPEntity*", "*Win32_Processor*", "*Win32_ShadowCopy*", "*win32_ShortcutFile*", "*win32_VideoController*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmi_reconnaissance_class_query_filter`
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may execute this command for testing or auditing.
 references:
     - https://malpedia.caad.fkie.fraunhofer.de/details/py.blankgrabber
@@ -75,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_wmic_cpu_discovery.yml b/detections/endpoint/windows_wmic_cpu_discovery.yml
index c054b1a607a..f7ff7c64d19 100644
--- a/detections/endpoint/windows_wmic_cpu_discovery.yml
+++ b/detections/endpoint/windows_wmic_cpu_discovery.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_wmic` (Processes.process="* cpu*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_wmic_cpu_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process="* cpu*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmic_cpu_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may execute this command for testing or auditing.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_wmic_diskdrive_discovery.yml b/detections/endpoint/windows_wmic_diskdrive_discovery.yml
index 097b1fde199..f385c43c623 100644
--- a/detections/endpoint/windows_wmic_diskdrive_discovery.yml
+++ b/detections/endpoint/windows_wmic_diskdrive_discovery.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_wmic` (Processes.process="* diskdrive*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_wmic_diskdrive_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process="* diskdrive*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmic_diskdrive_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may execute this command for testing or auditing.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_wmic_memory_chip_discovery.yml b/detections/endpoint/windows_wmic_memory_chip_discovery.yml
index 3e062e75955..f5ee780f224 100644
--- a/detections/endpoint/windows_wmic_memory_chip_discovery.yml
+++ b/detections/endpoint/windows_wmic_memory_chip_discovery.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_wmic` (Processes.process="* memorychip*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_wmic_memory_chip_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process="* memorychip*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmic_memory_chip_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may execute this command for testing or auditing.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_wmic_network_discovery.yml b/detections/endpoint/windows_wmic_network_discovery.yml
index 7bc27e4317b..0023b3b3c95 100644
--- a/detections/endpoint/windows_wmic_network_discovery.yml
+++ b/detections/endpoint/windows_wmic_network_discovery.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_wmic` (Processes.process="* nic*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_wmic_network_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process="* nic*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmic_network_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may execute this command for testing or auditing.
 references:
@@ -37,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_wmic_shadowcopy_delete.yml b/detections/endpoint/windows_wmic_shadowcopy_delete.yml
index 26a3b9d0b51..030122e04b1 100644
--- a/detections/endpoint/windows_wmic_shadowcopy_delete.yml
+++ b/detections/endpoint/windows_wmic_shadowcopy_delete.yml
@@ -9,12 +9,8 @@ type: Anomaly
 description: This analytic detects the use of WMIC to delete volume shadow copies, which is a common technique used by ransomware actors to prevent system recovery. Ransomware like Cactus often delete shadow copies before encrypting files to ensure victims cannot recover their data without paying the ransom. This behavior is particularly concerning as it indicates potential ransomware activity or malicious actors attempting to prevent system recovery.
 data_source:
     - Sysmon EventID 1
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe Processes.process = "*shadowcopy*" Processes.process = "*delete*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
-    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
-    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmic_shadowcopy_delete_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" Processes.process="*shadowcopy*" Processes.process="*delete*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmic_shadowcopy_delete_filter`
 how_to_implement: This detection requires Sysmon logging with Event ID 1 (Process Create) enabled. The logs must be processed using the appropriate Splunk Technology Add-ons and mapped to the Endpoint.Processes data model. Ensure that command-line arguments are being logged and that the appropriate permissions are in place to capture this data.
 known_false_positives: Legitimate system maintenance or backup operations may occasionally delete shadow copies. However, this activity should be rare and typically performed through approved administrative tools rather than direct WMIC commands. Tune and modify the search to fit your environment, enable as TTP.
 references:
@@ -29,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$process_name$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$process_name$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/windows_wmic_systeminfo_discovery.yml b/detections/endpoint/windows_wmic_systeminfo_discovery.yml
index e1c8573531c..942fd140c7b 100644
--- a/detections/endpoint/windows_wmic_systeminfo_discovery.yml
+++ b/detections/endpoint/windows_wmic_systeminfo_discovery.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_wmic` (Processes.process="* computersystem*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_wmic_systeminfo_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process="* computersystem*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmic_systeminfo_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may execute this command for testing or auditing.
 references:
@@ -38,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/windows_wpdbusenum_registry_key_modification.yml b/detections/endpoint/windows_wpdbusenum_registry_key_modification.yml
index 65e26e25af4..7f4163858c5 100644
--- a/detections/endpoint/windows_wpdbusenum_registry_key_modification.yml
+++ b/detections/endpoint/windows_wpdbusenum_registry_key_modification.yml
@@ -10,23 +10,8 @@ description: This analytic is used to identify when a USB removable media device
 data_source:
     - Sysmon EventID 12
     - Sysmon EventID 13
-search: |-
-    | tstats `security_content_summariesonly` min(_time) as firstTime, max(_time) as lastTime, count FROM datamodel=Endpoint.Registry
-      WHERE Registry.registry_path IN ("HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\*","HKLM\\System\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\*")
-        AND
-        Registry.registry_value_name ="FriendlyName"
-        AND
-        Registry.registry_path="*USBSTOR*"
-      BY Registry.action Registry.dest Registry.process_guid
-         Registry.process_id Registry.registry_hive Registry.registry_path
-         Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
-         Registry.registry_value_type Registry.status Registry.user
-         Registry.vendor_product
-    | `drop_dm_object_name(Registry)`
-    | eval object_handle = registry_value_data, object_name = replace(mvindex(split(mvindex(split(registry_path, "??"),1),"&amp;"),2),"PROD_","")
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_wpdbusenum_registry_key_modification_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_key_name IN ("HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\*", "HKLM\\System\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\*") Registry.registry_path="*USBSTOR*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.status Registry.user Registry.vendor_product Registry.object_handle | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wpdbusenum_registry_key_modification_filter`
 how_to_implement: To successfully implement this search, you must ingest endpoint logging that tracks changes to the HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ registry keys. Ensure that the field from the event logs is being mapped to the proper fields in the Endpoint.Registry data model.
 known_false_positives: Legitimate USB activity will also be detected. Please verify and investigate as appropriate.
 references:
@@ -41,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate USB events on $dest$
       search: '| from datamodel:Endpoint.Registry | search dest=$dest$ registry_path IN ("HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\*","HKLM\\System\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\*")'
       earliest_offset: $info_min_time$
diff --git a/detections/endpoint/windows_wsus_spawning_shell.yml b/detections/endpoint/windows_wsus_spawning_shell.yml
index 457588590b5..06f3829071c 100644
--- a/detections/endpoint/windows_wsus_spawning_shell.yml
+++ b/detections/endpoint/windows_wsus_spawning_shell.yml
@@ -11,24 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=wsusservice.exe
-        AND
-        `process_cmd`
-        OR
-        `process_powershell`
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_wsus_spawning_shell_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where (Processes.parent_process_name="*wsusservice.exe" Processes.process_name="*cmd.exe" OR Processes.original_file_name="Cmd.Exe") OR Processes.process_name IN ("*pwsh.exe", "*powershell.exe", "*powershell_ise.exe") OR Processes.original_file_name IN ("pwsh.dll", "PowerShell.EXE", "powershell_ise.EXE") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wsus_spawning_shell_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate WSUS maintenance scripts or administrative tools may spawn shells in rare cases. However, wsusservice.exe spawning interactive shells is highly abnormal behavior. Review the command line arguments and user context to determine legitimacy. Filter known administrative scripts if needed.
 references:
@@ -43,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: WSUS service process wsusservice.exe spawned shell process $process_name$ on $dest$ by $user$, indicating possible CVE-2025-59287 exploitation
     entity:
@@ -77,6 +61,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/wsus-windows-sysmon.log
-          sourcetype: XmlWinEventLog
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
       test_type: unit
diff --git a/detections/endpoint/windows_xll_file_creation_outside_of_typical_location.yml b/detections/endpoint/windows_xll_file_creation_outside_of_typical_location.yml
index 23008cf0f32..4d78f559a0b 100644
--- a/detections/endpoint/windows_xll_file_creation_outside_of_typical_location.yml
+++ b/detections/endpoint/windows_xll_file_creation_outside_of_typical_location.yml
@@ -6,34 +6,13 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects the creation of an XLL file outside of typical locations.
-    This can indicate an attempt to abuse Excel COM objects to load and execute a malicious XLL.
+description: 'Detects the creation of an XLL file outside of typical locations.
+
+    This can indicate an attempt to abuse Excel COM objects to load and execute a malicious XLL.'
 data_source:
     - Sysmon EventID 11
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    from datamodel=Endpoint.Filesystem where
-
-    Filesystem.file_path="*.xll"
-
-    NOT Filesystem.file_path IN (
-        "*:\\Program Files\\Microsoft Office\\*",
-        "*\\AppData\\Roaming\\Microsoft\\AddIns\\*"
-        )
-
-    by Filesystem.dest Filesystem.file_create_time Filesystem.process_path
-       Filesystem.process_guid Filesystem.process_id Filesystem.file_path
-       Filesystem.action Filesystem.file_name
-       Filesystem.user Filesystem.vendor_product
-
-    | `drop_dm_object_name(Filesystem)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_xll_file_creation_outside_of_typical_location_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.xll" NOT (Filesystem.file_path IN ("*:\\Program Files\\Microsoft Office\\*", "*\\AppData\\Roaming\\Microsoft\\AddIns\\*")) by Filesystem.action Filesystem.dest Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_xll_file_creation_outside_of_typical_location_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Some legitimate Excel add-ins and administrative tools may create XLL files outside typical locations. Review and allow approved applications to reduce false positives.
 references:
@@ -47,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
index 775c591c2bd..c41adb00d9a 100644
--- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
@@ -9,14 +9,8 @@ type: TTP
 description: The following analytic detects the creation of scheduled tasks designed to execute commands using native Windows shells like PowerShell, Cmd, Wscript, or Cscript. It leverages Windows Security EventCode 4698 to identify when such tasks are registered. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
 data_source:
     - Windows Event Log Security 4698
-search: |-
-    `wineventlog_security` EventCode=4698 TaskContent IN ("*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*cmd.exe*", "*sh.exe*", "*ksh.exe*", "*zsh.exe*", "*bash.exe*", "*scrcons.exe*", "*pwsh.exe*")
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY Computer, TaskName, TaskContent
-      | rename Computer as dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `winevent_scheduled_task_created_to_spawn_shell_filter`
+search: |
+    `wineventlog_security` EventCode=4698 TaskContent IN ("*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*cmd.exe*", "*sh.exe*", "*ksh.exe*", "*zsh.exe*", "*bash.exe*", "*scrcons.exe*", "*pwsh.exe*") | eval TaskName=TaskName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_to_spawn_shell_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
 known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately.
 references:
@@ -32,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: 'A Windows Scheduled Task was created (task name=$TaskName$) on $dest$ with the following contents: $TaskContent$'
     entity:
diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
index 60341516761..d2ab4090fd8 100644
--- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -10,18 +10,7 @@ description: The following analytic detects the creation of scheduled tasks with
 data_source:
     - Windows Event Log Security 4698
 search: |
-    `wineventlog_security`
-    EventCode=4698
-    TaskContent IN (
-      "*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*",
-      "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*"
-      )
-    | stats count min(_time) as firstTime max(_time) as lastTime
-      by Computer, TaskName, TaskContent, user
-    |  rename Computer as dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `winevent_scheduled_task_created_within_public_path_filter`
+    `wineventlog_security` EventCode=4698 TaskContent IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*") | eval TaskName=TaskName | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
 known_false_positives: False positives are possible if legitimate applications are allowed to register tasks in public paths. Filter as needed based on paths that are used legitimately.
 references:
@@ -38,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A windows scheduled task was created (task name=$TaskName$) on $dest$
     entity:
diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
index 39513a58e5d..a95ca40cbda 100644
--- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
+++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
@@ -10,7 +10,8 @@ description: The following analytic detects the execution of tasks registered in
 data_source:
     - Windows Event Log TaskScheduler 200
     - Windows Event Log TaskScheduler 201
-search: '`wineventlog_task_scheduler` EventCode IN ("200","201")  | stats count min(_time) as firstTime max(_time) as lastTime by TaskName dvc EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_windows_task_scheduler_event_action_started_filter`'
+search: |
+    `wineventlog_task_scheduler` EventCode=200 EventCode="201" | stats count min(_time) as firstTime max(_time) as lastTime by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_windows_task_scheduler_event_action_started_filter`
 how_to_implement: Task Scheduler logs are required to be collected. Enable logging with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] and renderXml=false. Note, not translating it in XML may require a proper extraction of specific items in the Message.
 known_false_positives: False positives will be present. Filter based on ActionName paths or specify keywords of interest.
 references:
diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml
index 417e1f07335..56a9e5c37c7 100644
--- a/detections/endpoint/winhlp32_spawning_a_process.yml
+++ b/detections/endpoint/winhlp32_spawning_a_process.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winhlp32.exe Processes.process IN ("*\\appdata\\*","*\\programdata\\*", "*\\temp\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winhlp32_spawning_a_process_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*winhlp32.exe" Processes.process IN ("*\\appdata\\*", "*\\programdata\\*", "*\\temp\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winhlp32_spawning_a_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: False positives should be limited as winhlp32.exe is typically not used with the latest flavors of Windows OS. However, filter as needed.
 references:
@@ -26,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, and is not typical activity for this process.
     entity:
diff --git a/detections/endpoint/winrar_spawning_shell_application.yml b/detections/endpoint/winrar_spawning_shell_application.yml
index 8240c2de231..dd0f2d4e01e 100644
--- a/detections/endpoint/winrar_spawning_shell_application.yml
+++ b/detections/endpoint/winrar_spawning_shell_application.yml
@@ -11,22 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=winrar.exe `windows_shells`
-        OR
-        Processes.process_name IN ("certutil.exe","mshta.exe","bitsadmin.exe")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `winrar_spawning_shell_application_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*winrar.exe" Processes.process_name IN ("*cmd.exe", "*powershell.exe", "*powershell_ise.exe", "*pwsh.exe", "*sh.exe", "*bash.exe", "*wscript.exe", "*cscript.exe", "*wt.exe", "*WindowsTerminal.exe", "*mshta.exe", "*certutil.exe", "*bitsadmin.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winrar_spawning_shell_application_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Be aware of potential false positives - legitimate uses of WinRAR and the listed processes in your environment may cause benign activities to be flagged. Upon triage, review the destination, user, parent process, and process name involved in the flagged activity. Capture and inspect any relevant on-disk artifacts, and look for concurrent processes to identify the attack source. This approach helps analysts detect potential threats earlier and mitigate the risks.
 references:
@@ -41,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file.
     entity:
diff --git a/detections/endpoint/winrm_spawning_a_process.yml b/detections/endpoint/winrm_spawning_a_process.yml
index dc349c78b12..c0333e5bc5f 100644
--- a/detections/endpoint/winrm_spawning_a_process.yml
+++ b/detections/endpoint/winrm_spawning_a_process.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.parent_process_name=wsmprovhost.exe Processes.process_name IN ("cmd.exe","sh.exe","bash.exe","powershell.exe","pwsh.exe","schtasks.exe","certutil.exe","whoami.exe","bitsadmin.exe","scp.exe")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `winrm_spawning_a_process_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*wsmprovhost.exe" Processes.process_name IN ("*cmd.exe", "*sh.exe", "*bash.exe", "*powershell.exe", "*pwsh.exe", "*schtasks.exe", "*certutil.exe", "*whoami.exe", "*bitsadmin.exe", "*scp.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winrm_spawning_a_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time. system management software may spawn processes from `wsmprovhost.exe`.
 references:
diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml
index 43eb55bf2d1..79fb10b569c 100644
--- a/detections/endpoint/wmi_permanent_event_subscription.yml
+++ b/detections/endpoint/wmi_permanent_event_subscription.yml
@@ -6,11 +6,10 @@ modification_date: '2026-10-09'
 author: Rico Valdez, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects permanent WMI event subscriptions that are containing `CommandLineEventConsumer` or `ActiveScriptEventConsumer`. Due to their command execution capabilties, given WMI consumers are often leveraged by adversaries for both execution and persistence purposes.
+description: Detects permanent WMI event subscriptions that are containing `CommandLineEventConsumer` or `ActiveScriptEventConsumer`. Due to their command execution capabilties, given WMI consumers are often leveraged by adversaries for both execution and persistence purposes.
 data_source:
     - Windows Event Log WMI Activity 5861
-search: |-
+search: |
     `wmi`
     EventCode=5861
     | spath input=_raw output=possible_cause path=Event.UserData.Operation_ESStoConsumerBinding.PossibleCause
@@ -48,11 +47,10 @@ search: |-
     | `security_content_ctime(lastTime)`
     | rename Computer as dest
     | `wmi_permanent_event_subscription_filter`
-how_to_implement: |-
-    Ingest Microsoft-Windows-WMI-Activity/Operational events and ensure EventCode, Computer, and the raw XML event are available.
-    The search uses spath to extract the binding details, then regex to parse the embedded __EventFilter and the supported CommandLineEventConsumer and ActiveScriptEventConsumer properties. For non-XML rendered events, Message is used as a fallback for the consumer details.
-known_false_positives: |-
-    Administrators and software may use permanent WMI event subscriptions. Review the consumer, filter query, and creator context; tune known authorized subscriptions with the detection filter macro.
+how_to_implement: 'Ingest Microsoft-Windows-WMI-Activity/Operational events and ensure EventCode, Computer, and the raw XML event are available.
+
+    The search uses spath to extract the binding details, then regex to parse the embedded __EventFilter and the supported CommandLineEventConsumer and ActiveScriptEventConsumer properties. For non-XML rendered events, Message is used as a fallback for the consumer details.'
+known_false_positives: Administrators and software may use permanent WMI event subscriptions. Review the consumer, filter query, and creator context; tune known authorized subscriptions with the detection filter macro.
 references:
     - https://learn.microsoft.com/en-us/windows/win32/wmisdk/binding-an-event-filter-with-a-logical-consumer
     - https://learn.microsoft.com/en-us/windows/win32/wmisdk/commandlineeventconsumer
diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
index 14db112d4c3..9e8899aa63c 100644
--- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
+++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
@@ -6,30 +6,13 @@ modification_date: '2026-10-09'
 author: Rico Valdez, Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |-
-    Detects the creation, modification or deletion of a WMI permanent event subscription using Sysmon EventID 21.
+description: Detects the creation, modification or deletion of a WMI permanent event subscription using Sysmon EventID 21.
 data_source:
     - Sysmon EventID 21
-search: |-
-    `sysmon`
-    EventCode=21
-    Operation IN (
-        Created,
-        Deleted,
-        Modified
-    )
-
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-        BY dest user Consumer Filter
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `wmi_permanent_event_subscription___sysmon_filter`
-how_to_implement: |-
-    To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields.
-known_false_positives: |-
-    Administrators and software may create authorized WMI subscriptions. Review the consumer and filter paths, then tune known authorized subscriptions with the detection filter macro.
+search: |
+    `sysmon` EventCode=21 Operation IN ("Created", "Deleted", "Modified") | eval Consumer=Consumer, Filter=Filter | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc object object_attrs object_category object_path signature signature_id src status user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmi_permanent_event_subscription___sysmon_filter`
+how_to_implement: To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields.
+known_false_positives: Administrators and software may create authorized WMI subscriptions. Review the consumer and filter paths, then tune known authorized subscriptions with the detection filter macro.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md
     - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
@@ -46,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml
index 7275b03df73..2a672bab932 100644
--- a/detections/endpoint/wmi_recon_running_process_or_services.yml
+++ b/detections/endpoint/wmi_recon_running_process_or_services.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI performs an event query to list running processes or services. This detection leverages PowerShell Script Block Logging to capture and analyze script block text for specific WMI queries. This activity is significant as it is commonly used by malware and APT actors to map security applications or services on a compromised machine. If confirmed malicious, this could allow attackers to identify and potentially disable security defenses, facilitating further compromise and persistence within the environment.
 data_source:
     - Powershell Script Block Logging 4104
-search: |-
-    `powershell` EventCode=4104 ScriptBlockText= "*SELECT*" AND (ScriptBlockText="*Win32_Process*" OR ScriptBlockText="*Win32_Service*")
-      | fillnull
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY dest signature signature_id
-           user_id vendor_product EventID
-           Guid Opcode Name
-           Path ProcessID ScriptBlockId
-           ScriptBlockText
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `wmi_recon_running_process_or_services_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*SELECT*" Processes.process IN ("*Win32_Process*", "*Win32_Service*") by Processes.dest Processes.signature Processes.signature_id Processes.user_id Processes.vendor_product Processes.Guid Processes.Opcode Processes.Name Processes.Path Processes.ProcessID Processes.ScriptBlockId Processes.ScriptBlockText | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
 known_false_positives: Network administrator may used this command for checking purposes
 references:
@@ -36,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/endpoint/wmic_group_discovery.yml b/detections/endpoint/wmic_group_discovery.yml
index f8a291d67da..569d89496dd 100644
--- a/detections/endpoint/wmic_group_discovery.yml
+++ b/detections/endpoint/wmic_group_discovery.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=wmic.exe (Processes.process="*group get name*")
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `wmic_group_discovery_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" Processes.process="*group get name*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_group_discovery_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
@@ -39,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
index 0af56ba2c64..73953936a9c 100644
--- a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
+++ b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=wmic.exe Processes.process="* product *" Processes.process="*where name*" Processes.process="*call uninstall*" Processes.process="*/nointeractive*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `wmic_noninteractive_app_uninstallation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" Processes.process="* product *" Processes.process="*where name*" Processes.process="*call uninstall*" Processes.process="*/nointeractive*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_noninteractive_app_uninstallation_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Third party application may use this approach to uninstall applications.
 references:
diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml
index c3688205fd8..e9f7e0638bf 100644
--- a/detections/endpoint/wmic_xsl_execution_via_url.yml
+++ b/detections/endpoint/wmic_xsl_execution_via_url.yml
@@ -6,48 +6,46 @@ modification_date: '2026-10-02'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects `wmic.exe` loading a remote XSL script
+description: 'The following analytic detects `wmic.exe` loading a remote XSL script
+
     via a URL. This detection leverages Endpoint Detection and Response (EDR) data,
+
     focusing on command-line executions that include HTTP/HTTPS URLs and the /FORMAT
+
     switch. This activity is significant as it indicates a potential application control
+
     bypass, allowing adversaries to execute JScript or VBScript within an XSL file.
+
     If confirmed malicious, this technique can enable attackers to execute arbitrary
+
     code, escalate privileges, or maintain persistence using a trusted Windows tool,
-    posing a severe threat to the environment.
+
+    posing a severe threat to the environment.'
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
     - Cisco Network Visibility Module Flow Data
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where
-    `process_wmic`
-    Processes.process IN ("*http://*", "*https://*")
-    Processes.process="*/format:*"
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
-       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
-       Processes.parent_process_name Processes.parent_process_path Processes.process
-       Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
-       Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `wmic_xsl_execution_via_url_filter`
-how_to_implement: |
-    The detection is based on data that originates from Endpoint Detection
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process IN ("*http://*", "*https://*") Processes.process="*/format:*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_xsl_execution_via_url_filter`
+how_to_implement: 'The detection is based on data that originates from Endpoint Detection
+
     and Response (EDR) agents. These agents are designed to provide security-related
+
     telemetry from the endpoints where the agent is installed. To implement this search,
+
     you must ingest logs that contain the process GUID, process name, and parent process.
+
     Additionally, you must ingest complete command-line executions. These logs must
+
     be processed using the appropriate Splunk Technology Add-ons that are specific to
+
     the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
+
     data model. Use the Splunk Common Information Model (CIM) to normalize the field
-    names and speed up the data modeling process.
-known_false_positives: |
-    False positives are limited as legitimate applications typically do not download files or xsl using WMIC. Filter as needed.
+
+    names and speed up the data modeling process.'
+known_false_positives: False positives are limited as legitimate applications typically do not download files or xsl using WMIC. Filter as needed.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md
     - https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
@@ -62,7 +60,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script.
     entity:
diff --git a/detections/endpoint/wmiprvse_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprvse_lolbas_execution_process_spawn.yml
index ac86030dd9b..c850d08afa2 100644
--- a/detections/endpoint/wmiprvse_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wmiprvse_lolbas_execution_process_spawn.yml
@@ -11,23 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE (
-            Processes.parent_process_name=wmiprvse.exe
-        )
-        (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe"))
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `wmiprvse_lolbas_execution_process_spawn_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*wmiprvse.exe" Processes.process_name IN ("*Regsvcs.exe", "*Ftp.exe", "*OfflineScannerShell.exe", "*Rasautou.exe", "*Schtasks.exe", "*Xwizard.exe", "*Dllhost.exe", "*Pnputil.exe", "*Atbroker.exe", "*Pcwrun.exe", "*Ttdinject.exe", "*Mshta.exe", "*Bitsadmin.exe", "*Certoc.exe", "*Ieexec.exe", "*Microsoft.Workflow.Compiler.exe", "*Runscripthelper.exe", "*Forfiles.exe", "*Msbuild.exe", "*Register-cimprovider.exe", "*Tttracer.exe", "*Ie4uinit.exe", "*Bash.exe", "*Hh.exe", "*SettingSyncHost.exe", "*Cmstp.exe", "*Mmc.exe", "*Stordiag.exe", "*Scriptrunner.exe", "*Odbcconf.exe", "*Extexport.exe", "*Msdt.exe", "*WorkFolders.exe", "*Diskshadow.exe", "*Mavinject.exe", "*Regasm.exe", "*Gpscript.exe", "*Rundll32.exe", "*Regsvr32.exe", "*Msiexec.exe", "*Wuauclt.exe", "*Presentationhost.exe", "*Wmic.exe", "*Runonce.exe", "*Syncappvpublishingserver.exe", "*Verclsid.exe", "*Infdefaultinstall.exe", "*Explorer.exe", "*Installutil.exe", "*Netsh.exe", "*Wab.exe", "*Dnscmd.exe", "*At.exe", "*Pcalua.exe", "*Msconfig.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmiprvse_lolbas_execution_process_spawn_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate applications may trigger this behavior, filter as needed.
 references:
@@ -42,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Wmiprvse.exe spawned a LOLBAS process on $dest$.
     entity:
diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml
index f9153f7e79a..8742061a8f8 100644
--- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml
+++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml
@@ -11,7 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes\n  WHERE Processes.parent_process_name IN (\"cscript.exe\", \"wscript.exe\") Processes.process_name IN (\"regsvr32.exe\", \"rundll32.exe\",\"winhlp32.exe\",\"certutil.exe\",\"msbuild.exe\",\"cmd.exe\",\"powershell*\",\"pwsh.exe\",\"wmic.exe\",\"mshta.exe\")\n  BY Processes.action Processes.dest Processes.original_file_name\n     Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid\n     Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path\n     Processes.process Processes.process_exec Processes.process_guid\n     Processes.process_hash Processes.process_id Processes.process_integrity_level\n     Processes.process_name Processes.process_path Processes.user\n     Processes.user_id Processes.vendor_product\n| `drop_dm_object_name(Processes)`\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `wscript_or_cscript_suspicious_child_process_filter`"
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name IN ("*cscript.exe", "*wscript.exe") Processes.process_name IN ("*regsvr32.exe", "*rundll32.exe", "*winhlp32.exe", "*certutil.exe", "*msbuild.exe", "*cmd.exe", "*powershell", "*pwsh.exe", "*wmic.exe", "*mshta.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wscript_or_cscript_suspicious_child_process_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Administrators may create vbs or js script that use several tool as part of its execution. Filter as needed.
 references:
diff --git a/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml
index 7c170e52847..fce25fc269a 100644
--- a/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml
@@ -11,21 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE
-    Processes.parent_process_name=wsmprovhost.exe
-    Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")
-    BY Processes.action Processes.dest Processes.original_file_name
-       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-       Processes.process Processes.process_exec Processes.process_guid
-       Processes.process_hash Processes.process_id Processes.process_integrity_level
-       Processes.process_name Processes.process_path Processes.user
-       Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `wsmprovhost_lolbas_execution_process_spawn_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name="*wsmprovhost.exe" Processes.process_name IN ("*Regsvcs.exe", "*Ftp.exe", "*OfflineScannerShell.exe", "*Rasautou.exe", "*Schtasks.exe", "*Xwizard.exe", "*Dllhost.exe", "*Pnputil.exe", "*Atbroker.exe", "*Pcwrun.exe", "*Ttdinject.exe", "*Mshta.exe", "*Bitsadmin.exe", "*Certoc.exe", "*Ieexec.exe", "*Microsoft.Workflow.Compiler.exe", "*Runscripthelper.exe", "*Forfiles.exe", "*Msbuild.exe", "*Register-cimprovider.exe", "*Tttracer.exe", "*Ie4uinit.exe", "*Bash.exe", "*Hh.exe", "*SettingSyncHost.exe", "*Cmstp.exe", "*Mmc.exe", "*Stordiag.exe", "*Scriptrunner.exe", "*Odbcconf.exe", "*Extexport.exe", "*Msdt.exe", "*WorkFolders.exe", "*Diskshadow.exe", "*Mavinject.exe", "*Regasm.exe", "*Gpscript.exe", "*Rundll32.exe", "*Regsvr32.exe", "*Msiexec.exe", "*Wuauclt.exe", "*Presentationhost.exe", "*Wmic.exe", "*Runonce.exe", "*Syncappvpublishingserver.exe", "*Verclsid.exe", "*Infdefaultinstall.exe", "*Explorer.exe", "*Installutil.exe", "*Netsh.exe", "*Wab.exe", "*Dnscmd.exe", "*At.exe", "*Pcalua.exe", "*Msconfig.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wsmprovhost_lolbas_execution_process_spawn_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: Legitimate applications may trigger this behavior, filter as needed.
 references:
@@ -40,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Wsmprovhost.exe spawned a LOLBAS process on $dest$.
     entity:
diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml
index 64bab930e9a..c99df605826 100644
--- a/detections/endpoint/wsreset_uac_bypass.yml
+++ b/detections/endpoint/wsreset_uac_bypass.yml
@@ -10,7 +10,8 @@ description: The following analytic detects a suspicious modification of the reg
 data_source:
     - Sysmon EventID 12
     - Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" AND (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "DelegateExecute") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wsreset_uac_bypass_filter`'
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.status Registry.user Registry.vendor_product Registry.registry_value_name | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wsreset_uac_bypass_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ on $dest$
     entity:
diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml
index 5497c015bc5..e04ee11e52a 100644
--- a/detections/endpoint/xsl_script_execution_with_wmic.yml
+++ b/detections/endpoint/xsl_script_execution_with_wmic.yml
@@ -11,20 +11,8 @@ data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE `process_wmic` Processes.process = "*os get*" Processes.process="*/format:*" Processes.process = "*.xsl*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
-    | `drop_dm_object_name(Processes)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `xsl_script_execution_with_wmic_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name="*wmic.exe" OR Processes.original_file_name="wmic.exe" Processes.process="*os get*" Processes.process="*/format:*" Processes.process="*.xsl*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `xsl_script_execution_with_wmic_filter`
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -41,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to load a XSL script.
     entity:
diff --git a/detections/network/3cx_supply_chain_attack_network_indicators.yml b/detections/network/3cx_supply_chain_attack_network_indicators.yml
index 946c2451347..7d542a29c18 100644
--- a/detections/network/3cx_supply_chain_attack_network_indicators.yml
+++ b/detections/network/3cx_supply_chain_attack_network_indicators.yml
@@ -41,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Indicators related to 3CX supply chain attack have been identified on $src$.
     entity:
diff --git a/detections/network/cisco_configuration_archive_logging_analysis.yml b/detections/network/cisco_configuration_archive_logging_analysis.yml
index e5c1ab9d351..93e7a85bf68 100644
--- a/detections/network/cisco_configuration_archive_logging_analysis.yml
+++ b/detections/network/cisco_configuration_archive_logging_analysis.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. Configuration archive logging captures all changes made to a device's configuration, providing a detailed audit trail that can be used to identify suspicious or malicious activities. This detection is particularly valuable for identifying patterns of malicious configuration changes that might indicate an attacker's presence, such as the creation of backdoor accounts, SNMP community string modifications, and TFTP server configurations for data exfiltration. By analyzing these logs, security teams can gain a holistic view of configuration changes across sessions and users, helping to detect sophisticated attack campaigns like those conducted by threat actors such as Static Tundra.
 data_source:
     - Cisco IOS Logs
-search: |-
+search: |
     | tstats `security_content_summariesonly` count values(All_Changes.command) as commands min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes
       WHERE (
             (All_Changes.command="*username*privilege 15*")
@@ -42,7 +42,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 analytic_story:
     - Cisco Smart Install Remote Code Execution CVE-2018-0171
 asset_type: Network
@@ -62,6 +62,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/cisco/cisco_smart_install/cisco_ios.log
-          sourcetype: cisco:ios
           source: cisco:ios
+          sourcetype: cisco:ios
       test_type: unit
diff --git a/detections/network/cisco_ios_suspicious_privileged_account_creation.yml b/detections/network/cisco_ios_suspicious_privileged_account_creation.yml
index 5791be30a16..fc88e3e527e 100644
--- a/detections/network/cisco_ios_suspicious_privileged_account_creation.yml
+++ b/detections/network/cisco_ios_suspicious_privileged_account_creation.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This analytic detects the creation of privileged user accounts on Cisco IOS devices, which could indicate an attacker establishing backdoor access. The detection focuses on identifying when user accounts are created with privilege level 15 (the highest administrative privilege level in Cisco IOS) or when existing accounts have their privileges elevated. This type of activity is particularly concerning when performed by unauthorized users or during unusual hours, as it may represent a key step in establishing persistence following the exploitation of vulnerabilities like CVE-2018-0171 in Cisco Smart Install. Threat actors like Static Tundra have been observed creating privileged accounts as part of their attack chain after gaining initial access to network devices.
 data_source:
     - Cisco IOS Logs
-search: |-
+search: |
     | tstats `security_content_summariesonly` count values(All_Changes.command) as command min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes
       WHERE (
             (All_Changes.command="*username * privilege 15*")
@@ -40,7 +40,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -72,6 +72,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/cisco/cisco_smart_install/cisco_ios.log
-          sourcetype: cisco:ios
           source: cisco:ios
+          sourcetype: cisco:ios
       test_type: unit
diff --git a/detections/network/cisco_network_interface_modifications.yml b/detections/network/cisco_network_interface_modifications.yml
index a70160e31a9..56b307cf04a 100644
--- a/detections/network/cisco_network_interface_modifications.yml
+++ b/detections/network/cisco_network_interface_modifications.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This analytic detects the creation or modification of network interfaces on Cisco devices, which could indicate an attacker establishing persistence or preparing for lateral movement. After gaining initial access to network devices, threat actors like Static Tundra often create new interfaces (particularly loopback interfaces) to establish covert communication channels or maintain persistence. This detection specifically looks for the configuration of new interfaces, interface state changes, and the assignment of IP addresses to interfaces. These activities are particularly concerning when they involve unusual interface names or descriptions containing suspicious terms.
 data_source:
     - Cisco IOS Logs
-search: |-
+search: |
     | tstats `security_content_summariesonly` count values(All_Changes.command) as command min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes
       WHERE (
             (All_Changes.command="*interface*")
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -71,6 +71,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/cisco/cisco_smart_install/cisco_ios.log
-          sourcetype: cisco:ios
           source: cisco:ios
+          sourcetype: cisco:ios
       test_type: unit
diff --git a/detections/network/cisco_privileged_account_creation_with_http_command_execution.yml b/detections/network/cisco_privileged_account_creation_with_http_command_execution.yml
index a7e3c2b4ab1..46cbcf46857 100644
--- a/detections/network/cisco_privileged_account_creation_with_http_command_execution.yml
+++ b/detections/network/cisco_privileged_account_creation_with_http_command_execution.yml
@@ -6,12 +6,15 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Correlation
-description: |
-    This analytic correlates risk events between privileged account creation on Cisco IOS devices and HTTP requests to privileged execution paths such as `/level/15/exec/-/*`.
+description: 'This analytic correlates risk events between privileged account creation on Cisco IOS devices and HTTP requests to privileged execution paths such as `/level/15/exec/-/*`.
+
     APT actors have been observed creating privileged accounts and then running commands on routers via HTTP GET or POST requests that target privileged execution paths.
+
     These requests allow attackers to execute commands with the highest privilege level (15) on Cisco devices without requiring interactive SSH access.
+
     This correlation identifies when both "Cisco IOS Suspicious Privileged Account Creation" and "Privileged Command Execution via HTTP" Snort detections fire for the same network device.
-    This behavior indicates an attacker leveraging the newly created account to execute commands remotely via HTTP.
+
+    This behavior indicates an attacker leveraging the newly created account to execute commands remotely via HTTP.'
 data_source: []
 search: |
     | tstats `security_content_summariesonly`
@@ -46,10 +49,8 @@ search: |
     | `security_content_ctime(lastTime)`
     | where source_count >= 2
     | `cisco_privileged_account_creation_with_http_command_execution_filter`
-how_to_implement: |
-    This correlation search requires that the following detections are enabled and generating risk events - "Cisco IOS Suspicious Privileged Account Creation" and "Cisco Secure Firewall - Privileged Command Execution via HTTP". These detections must be configured to generate risk on the same entity field (the network device IP). The search correlates risk events within a 24-hour time window. Ensure that both Cisco IOS logs (sourcetype "cisco:ios") and Cisco Secure Firewall Threat Defense Intrusion Event logs are being ingested and that the underlying detections are properly configured.
-known_false_positives: |
-    No false positives have been identified yet.
+how_to_implement: This correlation search requires that the following detections are enabled and generating risk events - "Cisco IOS Suspicious Privileged Account Creation" and "Cisco Secure Firewall - Privileged Command Execution via HTTP". These detections must be configured to generate risk on the same entity field (the network device IP). The search correlates risk events within a 24-hour time window. Ensure that both Cisco IOS logs (sourcetype "cisco:ios") and Cisco Secure Firewall Threat Defense Intrusion Event logs are being ingested and that the underlying detections are properly configured.
+known_false_positives: No false positives have been identified yet.
 references:
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
 drilldown_searches:
@@ -60,7 +61,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$risk_object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Cisco Privileged Account Creation with HTTP Command Execution - $risk_object$
     entity:
diff --git a/detections/network/cisco_privileged_account_creation_with_suspicious_ssh_activity.yml b/detections/network/cisco_privileged_account_creation_with_suspicious_ssh_activity.yml
index 69661c6670d..f92e8ff8634 100644
--- a/detections/network/cisco_privileged_account_creation_with_suspicious_ssh_activity.yml
+++ b/detections/network/cisco_privileged_account_creation_with_suspicious_ssh_activity.yml
@@ -6,10 +6,11 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Correlation
-description: |
-    This analytic detects a correlation between privileged account creation on Cisco IOS devices and subsequent inbound SSH connections to non-standard ports or sshd_operns by correlating risk events
+description: 'This analytic detects a correlation between privileged account creation on Cisco IOS devices and subsequent inbound SSH connections to non-standard ports or sshd_operns by correlating risk events
+
     This correlation identifies when both "Cisco IOS Suspicious Privileged Account Creation" and SSH-related Snort detections ("SSH Connection to sshd_operns" or "SSH Connection to Non-Standard Port") fire for the same network device.
-    This behavior is highly indicative of persistence establishment following initial compromise.
+
+    This behavior is highly indicative of persistence establishment following initial compromise.'
 data_source: []
 search: |
     | tstats `security_content_summariesonly`
@@ -58,10 +59,8 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_privileged_account_creation_with_suspicious_ssh_activity_filter`
-how_to_implement: |
-    This correlation search requires that the following detections are enabled and generating risk events - "Cisco IOS Suspicious Privileged Account Creation", "Cisco Secure Firewall - SSH Connection to sshd_operns", and "Cisco Secure Firewall - SSH Connection to Non-Standard Port". These detections must be configured to generate risk on the same entity field (the network device IP). The search correlates risk events within a 24-hour time window. Ensure that both Cisco IOS logs (sourcetype "cisco:ios") and Cisco Secure Firewall Threat Defense Intrusion Event logs are being ingested and that the underlying detections are properly configured.
-known_false_positives: |
-    No false positives have been identified yet.
+how_to_implement: This correlation search requires that the following detections are enabled and generating risk events - "Cisco IOS Suspicious Privileged Account Creation", "Cisco Secure Firewall - SSH Connection to sshd_operns", and "Cisco Secure Firewall - SSH Connection to Non-Standard Port". These detections must be configured to generate risk on the same entity field (the network device IP). The search correlates risk events within a 24-hour time window. Ensure that both Cisco IOS logs (sourcetype "cisco:ios") and Cisco Secure Firewall Threat Defense Intrusion Event logs are being ingested and that the underlying detections are properly configured.
+known_false_positives: No false positives have been identified yet.
 references:
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
 drilldown_searches:
@@ -72,7 +71,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$normalized_risk_object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$normalized_risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Cisco Privileged Account Creation with Suspicious SSH Activity - $risk_object$
     entity:
diff --git a/detections/network/cisco_sa___access_to_anonymizer_services.yml b/detections/network/cisco_sa___access_to_anonymizer_services.yml
index ef245463a53..7000ab6e63e 100644
--- a/detections/network/cisco_sa___access_to_anonymizer_services.yml
+++ b/detections/network/cisco_sa___access_to_anonymizer_services.yml
@@ -6,25 +6,19 @@ modification_date: '2026-06-09'
 author: Mahamudul Chowdhury, Bhavin Patel, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects attempts to access proxy-evasion or anonymizer services using Cisco Secure Access DNS and secure web proxy telemetry.
+description: 'This analytic detects attempts to access proxy-evasion or anonymizer services using Cisco Secure Access DNS and secure web proxy telemetry.
+
     Users who reach anonymizer or proxy-evasion infrastructure are often trying to bypass corporate controls such as secure web gateway inspection, DLP monitoring, CASB visibility, and threat-detection systems. These services frequently establish encrypted tunnels that hide subsequent traffic from inspection.
-    Early identification helps security teams spot circumvention attempts before potential data exfiltration or follow-on malicious activity. Correlating DNS resolution and proxy session data strengthens confidence that access was intentional.
+
+    Early identification helps security teams spot circumvention attempts before potential data exfiltration or follow-on malicious activity. Correlating DNS resolution and proxy session data strengthens confidence that access was intentional.'
 data_source:
     - Cisco Secure Access DNS
-search: |-
-    `cisco_secure_access_dns`
-    action = "allowed" category= "*anonymizer*"
-    | fillnull
-    | stats count min(_time) as firstTime max(_time) as lastTime values(domain) as domain values(query) as query values(reply_code) as reply_code values(record_type) as record_type by src_ip src_external_ip user identity_type action category sourcetype
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_sa___access_to_anonymizer_services_filter`
-how_to_implement: |
-    Ingest Cisco Secure Access DNS and proxy events into Splunk using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    Update the `cisco_secure_access_dns` macro so it resolves to the indexes, sources, and sourcetypes used in your environment.
-known_false_positives: |
-    Security research, approved privacy tools, or mis-categorized destinations may appear as anonymizer traffic. Tune this analytic with the filter macro or allow-lists for known-good users, networks, and domains after validating business justification.
+search: |
+    `cisco_secure_access_dns` action="allowed" category="*anonymizer*" | stats count min(_time) as firstTime max(_time) as lastTime by category domain src_ip user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_sa___access_to_anonymizer_services_filter`
+how_to_implement: 'Ingest Cisco Secure Access DNS and proxy events into Splunk using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
+
+    Update the `cisco_secure_access_dns` macro so it resolves to the indexes, sources, and sourcetypes used in your environment.'
+known_false_positives: Security research, approved privacy tools, or mis-categorized destinations may appear as anonymizer traffic. Tune this analytic with the filter macro or allow-lists for known-good users, networks, and domains after validating business justification.
 references:
     - https://attack.mitre.org/techniques/T1090/003
 drilldown_searches:
@@ -35,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for $user$
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/network/cisco_sa___automated_web_reconnaissance_via_http_access_errors.yml b/detections/network/cisco_sa___automated_web_reconnaissance_via_http_access_errors.yml
index 8426443bcb0..59af3b5c685 100644
--- a/detections/network/cisco_sa___automated_web_reconnaissance_via_http_access_errors.yml
+++ b/detections/network/cisco_sa___automated_web_reconnaissance_via_http_access_errors.yml
@@ -6,13 +6,14 @@ modification_date: '2026-06-09'
 author: Mahamudul Chowdhury, Bhavin Patel, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects probable automated web reconnaissance using Cisco Secure Access proxy telemetry.
+description: 'This analytic detects probable automated web reconnaissance using Cisco Secure Access proxy telemetry.
+
     A high volume of HTTP client errors (401/403/404/etc) across many unique URLs in a short window is consistent with directory/file enumeration behavior generated by tools such as Gobuster, DirBuster, ffuf, or Burp Intruder.
-    Detecting this pattern helps identify pre-exploitation scanning activity, insider reconnaissance, compromised endpoints performing discovery, and attempts to find hidden administrative paths, APIs, backups, and exposed application files.
+
+    Detecting this pattern helps identify pre-exploitation scanning activity, insider reconnaissance, compromised endpoints performing discovery, and attempts to find hidden administrative paths, APIs, backups, and exposed application files.'
 data_source:
     - Cisco Secure Access Proxy
-search: |-
+search: |
     `cisco_secure_access_proxy`
     | eval src_ip=coalesce(src_ip, src)
     | eval host=coalesce(hostname, host)
@@ -28,12 +29,12 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_sa___automated_web_reconnaissance_via_http_access_errors_filter`
-how_to_implement: |
-    Ingest Cisco Secure Access proxy logs into Splunk using the Splunk Add-on for Cisco Security Cloud.
-    Update the `cisco_secure_access_proxy` macro so it resolves to the index, source, and sourcetype values used in your deployment.
-known_false_positives: |
-    Aggressive web vulnerability scanners, QA automation, uptime monitoring, and authorized security assessments can generate high HTTP error volumes with large URL diversity.
-    Tune by allow-listing known scanner hosts, user agents, test domains, and approved assessment windows using the filter macro.
+how_to_implement: 'Ingest Cisco Secure Access proxy logs into Splunk using the Splunk Add-on for Cisco Security Cloud.
+
+    Update the `cisco_secure_access_proxy` macro so it resolves to the index, source, and sourcetype values used in your deployment.'
+known_false_positives: 'Aggressive web vulnerability scanners, QA automation, uptime monitoring, and authorized security assessments can generate high HTTP error volumes with large URL diversity.
+
+    Tune by allow-listing known scanner hosts, user agents, test domains, and approved assessment windows using the filter macro.'
 references:
     - https://attack.mitre.org/techniques/T1595/
 drilldown_searches:
@@ -44,7 +45,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/network/cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity.yml b/detections/network/cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity.yml
index a838359bcb7..a2bc26964ee 100644
--- a/detections/network/cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity.yml
+++ b/detections/network/cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity.yml
@@ -6,13 +6,14 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    This analytic detects a exploitation activity attempts of targeting Cisco Catalyst SD-WAN Manager.
+description: 'This analytic detects a exploitation activity attempts of targeting Cisco Catalyst SD-WAN Manager.
+
     It leverages the "serviceproxy_access.log" and identifies source-host combinations that perform all key stages of the exploitation as reported in public POCs in a short period: authentication/config collection (`.dca`), upload actions (`uploadAck`), and payload-style access (`.gz/*`).
-    The behavior can indicate attempted exploitation activity associated with Cisco Catalyst SD-WAN Manager vulnerabilities CVE-2026-20122 (Arbitrary File Overwrite) and CVE-2026-20128 (Information Disclosure).
+
+    The behavior can indicate attempted exploitation activity associated with Cisco Catalyst SD-WAN Manager vulnerabilities CVE-2026-20122 (Arbitrary File Overwrite) and CVE-2026-20128 (Information Disclosure).'
 data_source:
     - Cisco SD-WAN Service Proxy Access Logs
-search: |-
+search: |
     `cisco_sd_wan_service_proxy_access`
     | rex field=_raw "^\[.*?\]\s+\"(?<http_method>\S+)\s+(?<uri>\S+)\s+(?<http_protocol>[^\"]+)\"\s+(?<http_response_code>\S+)\s+(?<response_flags>\S+)\s+(?<bytes_in>\S+)\s+(?<bytes_out>\S+)\s+(?<duration>\S+)\s+(?<upstream_service_time>\S+)\s+\"(?<src>[^\"]+)\"\s+\"(?<http_user_agent>[^\"]+)\"\s+\"(?<x_request_id>[^\"]+)\"\s+\"(?<dest>[^\"]+)\"\s+\"(?<upstream_host>[^\"]+)\""
     | rex field=uri "(?<uri_path>[^\?]+)(?<uri_query>\?.*)?"
@@ -61,11 +62,10 @@ search: |-
     | `security_content_ctime(lastTime)`
     | sort 0 - firstTime
     | `cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity_filter`
-how_to_implement: |
-    This detection requires Cisco SD-WAN Manager Envoy access logs to be ingested into Splunk.
-    These logs are located in "/var/log/nms/containers/service-proxy/serviceproxy-access.log".
-known_false_positives: |
-    No false positives have been identified at this time.
+how_to_implement: 'This detection requires Cisco SD-WAN Manager Envoy access logs to be ingested into Splunk.
+
+    These logs are located in "/var/log/nms/containers/service-proxy/serviceproxy-access.log".'
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v
     - https://github.com/zerozenxlabs/CVE-2026-20127---Cisco-SD-WAN-Preauth-RCE
@@ -77,7 +77,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Cisco SD-WAN Manager exploitation activity from $src$ has been identified targeting host $dest$.
     entity:
diff --git a/detections/network/cisco_sd_wan___low_frequency_rogue_peer.yml b/detections/network/cisco_sd_wan___low_frequency_rogue_peer.yml
index fcb6759df17..dcdfe37016a 100644
--- a/detections/network/cisco_sd_wan___low_frequency_rogue_peer.yml
+++ b/detections/network/cisco_sd_wan___low_frequency_rogue_peer.yml
@@ -6,19 +6,24 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic identifies low-frequency Cisco SD-WAN control peering activity from control-connection-state-change events where "new-state:up".
+description: 'This analytic identifies low-frequency Cisco SD-WAN control peering activity from control-connection-state-change events where "new-state:up".
+
 
     It extracts "peer-type" and "peer-system-ip", groups events by these two fields, and counts how often each combination appears within the selected time window.
 
+
     Combinations whose count is less than or equal to the defined threshold (currently <=3 occurrences in the search window) are flagged as rare.
 
+
     Analysts should prioritize peer identities that are rarely observed in the environment, particularly those involving unexpected peer-type roles or unfamiliar peer-system-ip values.
+
     Rare control-plane peers may indicate misconfiguration, unauthorized SD-WAN components, infrastructure drift, or potentially malicious control-plane connection attempts.
 
+
     Findings might indicate the potential exploitation of CVE-2026-20127.
 
-    Note that the threshold setting is set to "3", but its highly recommended that this should be adapted to the environment before deploying this search.
+
+    Note that the threshold setting is set to "3", but its highly recommended that this should be adapted to the environment before deploying this search.'
 data_source:
     - Cisco SD-WAN NTCE 1000001
 search: |
@@ -48,17 +53,22 @@ search: |
     | table dest peer_type peer_system_ip public_ips
             public_ports count
     | `cisco_sd_wan___low_frequency_rogue_peer_filter`
-how_to_implement: |
-    This analytic requires Cisco SD-WAN/vSmart logs in Splunk and assumes control peering status
+how_to_implement: 'This analytic requires Cisco SD-WAN/vSmart logs in Splunk and assumes control peering status
+
     messages are searchable via the `cisco_sd_wan_syslog` macro. Update that macro with your environment-specific index and sourcetype settings.
+
     Build a known-good baseline (lookup or macro conditions) for expected `peer-system-ip`, `public-ip`, and `peer-type` relationships, then tune the `cisco_sd_wan_rogue_peer_outlier_filter` macro to suppress approved peers and transport sources.
+
     The threshold (`<=3`) is a starting point and should be adjusted for your environment size and log
+
     volume.
-    Follow the documentation https://www.cisco.com/c/en/us/td/docs/routers/sdwan/17-x/systems-interfaces/systems-interfaces-guide-17-x/system-logging.html#config-sys-logging to start ingesting these logs.
-known_false_positives: |
-    New controller onboarding, topology expansion, controller failover, maintenance windows, and temporary transport.
+
+    Follow the documentation https://www.cisco.com/c/en/us/td/docs/routers/sdwan/17-x/systems-interfaces/systems-interfaces-guide-17-x/system-logging.html#config-sys-logging to start ingesting these logs.'
+known_false_positives: 'New controller onboarding, topology expansion, controller failover, maintenance windows, and temporary transport.
+
     Path changes can create rare peer/public-IP combinations.
-    Validate outliers against change records and known SD-WAN inventory before escalating.
+
+    Validate outliers against change records and known SD-WAN inventory before escalating.'
 references:
     - https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems
     - https://blog.talosintelligence.com/uat-8616-sd-wan/
@@ -74,7 +84,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/network/cisco_sd_wan___peering_activity.yml b/detections/network/cisco_sd_wan___peering_activity.yml
index 4ae5f5ae58d..8c8b1213349 100644
--- a/detections/network/cisco_sd_wan___peering_activity.yml
+++ b/detections/network/cisco_sd_wan___peering_activity.yml
@@ -6,17 +6,22 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Hunting
-description: |
-    This analytic detects Cisco SD-WAN `control-connection-state-change` events where a control connection transitions.
+description: 'This analytic detects Cisco SD-WAN `control-connection-state-change` events where a control connection transitions.
+
     It extracts and highlights key triage fields including `peer-type`, `peer-system-ip`, `public-ip`, and `public-port`.
+
     Analysts should manually validate whether the `peer-system-ip` matches the expected SD-WAN addressing schema and
+
     device inventory, whether the event timing aligns with known operational activity (maintenance, failover, or
+
     planned changes), and whether the `public-ip` is an expected source for control peering in the environment.
+
     Treat `peer-type:vmanage` events with higher scrutiny, especially when peer or source IP values are previously
-    unseen.
+
+    unseen.'
 data_source:
     - Cisco SD-WAN NTCE 1000001
-search: |-
+search: |
     `cisco_sd_wan_syslog`
     TERM("*control-connection-state-change*")
     TERM("*peer-system-ip:*")
@@ -41,14 +46,16 @@ search: |-
     | table event_time dest peer_type peer_system_ip
             public_ips public_ports count
     | `cisco_sd_wan___peering_activity_filter`
-how_to_implement: |
-    This analytic requires Cisco SD-WAN/vSmart logs in Splunk and assumes control peering status
+how_to_implement: 'This analytic requires Cisco SD-WAN/vSmart logs in Splunk and assumes control peering status
+
     messages are searchable via the `cisco_sd_wan_syslog` macro. Update that macro with your environment-specific index and sourcetype settings.
-    Follow the documentation https://www.cisco.com/c/en/us/td/docs/routers/sdwan/17-x/systems-interfaces/systems-interfaces-guide-17-x/system-logging.html#config-sys-logging to start ingesting these logs.
-known_false_positives: |
-    New controller onboarding, topology expansion, controller failover, maintenance windows, and temporary transport.
+
+    Follow the documentation https://www.cisco.com/c/en/us/td/docs/routers/sdwan/17-x/systems-interfaces/systems-interfaces-guide-17-x/system-logging.html#config-sys-logging to start ingesting these logs.'
+known_false_positives: 'New controller onboarding, topology expansion, controller failover, maintenance windows, and temporary transport.
+
     Path changes can create rare peer/public-IP combinations.
-    Validate outliers against change records and known SD-WAN inventory before escalating.
+
+    Validate outliers against change records and known SD-WAN inventory before escalating.'
 references:
     - https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems
     - https://blog.talosintelligence.com/uat-8616-sd-wan/
diff --git a/detections/network/cisco_sd_wan___uncommon_user_agent_multi_uri_activity.yml b/detections/network/cisco_sd_wan___uncommon_user_agent_multi_uri_activity.yml
index e2e1a3e7243..14768c3f6c3 100644
--- a/detections/network/cisco_sd_wan___uncommon_user_agent_multi_uri_activity.yml
+++ b/detections/network/cisco_sd_wan___uncommon_user_agent_multi_uri_activity.yml
@@ -6,13 +6,14 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Hunting
-description: |
-    This hunting search is designed to surface source IP activity using uncommon HTTP user-agents across multiple URI paths in Cisco SD-WAN Manager serviceproxy access logs.
+description: 'This hunting search is designed to surface source IP activity using uncommon HTTP user-agents across multiple URI paths in Cisco SD-WAN Manager serviceproxy access logs.
+
     It looks for source and user-agent combinations that access more than one distinct URI, then keeps only low-volume behavior (`requests<=50`) to reduce noise from normal high-volume traffic.
-    Use this hunt to pivot on `http_user_agent` and `src` and identify possible automation, scripted reconnaissance, or exploitation attempts.
+
+    Use this hunt to pivot on `http_user_agent` and `src` and identify possible automation, scripted reconnaissance, or exploitation attempts.'
 data_source:
     - Cisco SD-WAN Service Proxy Access Logs
-search: |-
+search: |
     `cisco_sd_wan_service_proxy_access`
     | rex field=_raw "^\[.*?\]\s+\"(?<http_method>\S+)\s+(?<uri>\S+)\s+(?<http_protocol>[^\"]+)\"\s+(?<http_response_code>\S+)\s+(?<response_flags>\S+)\s+(?<bytes_in>\S+)\s+(?<bytes_out>\S+)\s+(?<duration>\S+)\s+(?<upstream_service_time>\S+)\s+\"(?<src>[^\"]+)\"\s+\"(?<http_user_agent>[^\"]+)\"\s+\"(?<x_request_id>[^\"]+)\"\s+\"(?<dest>[^\"]+)\"\s+\"(?<upstream_host>[^\"]+)\""
     | rex field=uri "(?<uri_path>[^\?]+)(?<uri_query>\?.*)?"
@@ -28,11 +29,10 @@ search: |-
     | `security_content_ctime(lastTime)`
     | sort 0 +requests
     | `cisco_sd_wan___uncommon_user_agent_multi_uri_activity_filter`
-how_to_implement: |
-    This detection requires Cisco SD-WAN Manager Envoy access logs to be ingested into Splunk.
-    These logs are located in "/var/log/nms/containers/service-proxy/serviceproxy-access.log".
-known_false_positives: |
-    No false positives have been identified at this time.
+how_to_implement: 'This detection requires Cisco SD-WAN Manager Envoy access logs to be ingested into Splunk.
+
+    These logs are located in "/var/log/nms/containers/service-proxy/serviceproxy-access.log".'
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v
     - https://github.com/zerozenxlabs/CVE-2026-20127---Cisco-SD-WAN-Preauth-RCE
diff --git a/detections/network/cisco_secure_firewall___binary_file_type_download.yml b/detections/network/cisco_secure_firewall___binary_file_type_download.yml
index 1eb6a299ddb..259a343c911 100644
--- a/detections/network/cisco_secure_firewall___binary_file_type_download.yml
+++ b/detections/network/cisco_secure_firewall___binary_file_type_download.yml
@@ -6,11 +6,13 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects file downloads involving executable, archive, or scripting-related file types that are commonly used in malware delivery.
+description: 'The following analytic detects file downloads involving executable, archive, or scripting-related file types that are commonly used in malware delivery.
+
     These file types include formats like PE executables, shell scripts, autorun files, installers, and known testing samples such as EICAR.
+
     This detection leverages Cisco Secure Firewall Threat Defense logs and enriches the results using a filetype lookup to provide context.
-    If confirmed malicious, these downloads could indicate the initial infection vector, malware staging, or scripting abuse.
+
+    If confirmed malicious, these downloads could indicate the initial infection vector, malware staging, or scripting abuse.'
 data_source:
     - Cisco Secure Firewall Threat Defense File Event
 search: |
@@ -27,15 +29,21 @@ search: |
     | `security_content_ctime(lastTime)`
     | table firstTime lastTime src dest dest_port FileDirection FileType Description uri file_name file_hash app ClientApplication SHA_Disposition ThreatName
     | `cisco_secure_firewall___binary_file_type_download_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The malware & file access policy must also enable logging.
+
+    The malware & file access policy must also enable logging.'
 known_false_positives: IT admins or developers may legitimately download executables or scripts as part of their normal workflow. Apply additional filters accordingly.
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
@@ -47,7 +55,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/network/cisco_secure_firewall___bits_network_activity.yml b/detections/network/cisco_secure_firewall___bits_network_activity.yml
index 4a677c722ff..f63f8ff58df 100644
--- a/detections/network/cisco_secure_firewall___bits_network_activity.yml
+++ b/detections/network/cisco_secure_firewall___bits_network_activity.yml
@@ -10,24 +10,27 @@ description: The following analytic detects the use of the Background Intelligen
 data_source:
     - Cisco Secure Firewall Threat Defense Connection Event
 search: |
-    `cisco_secure_firewall` EventType=ConnectionEvent action IN ("Trust", "Allow", "allowed") ClientApplication="BITS" AND NOT url IN ("*://msedge.b.tlu.dl*")
-    | stats count min(_time) as firstTime max(_time) as lastTime by src, dest, dest_port, transport, rule, url, EVE_Process, ClientApplication, ClientApplicationVersion, action
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___bits_network_activity_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` action IN ("Trust", "Allow", "allowed") ClientApplication="BITS" NOT url="*://msedge.b.tlu.dl*" | eval EVE_Process=EVE_Process, Potentially_Exfiltrated=initiator_mb | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port transport rule action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___bits_network_activity_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The access policy must also enable logging.
-known_false_positives: |
-    BITS is a legitimate Windows component used by Microsoft services such as Windows Update or Microsoft Edge for downloading updates.
+
+    The access policy must also enable logging.'
+known_false_positives: 'BITS is a legitimate Windows component used by Microsoft services such as Windows Update or Microsoft Edge for downloading updates.
+
     Although this analytic filters known Microsoft Edge update URLs, false positives may still occur from other legitimate enterprise applications or software distribution platforms that utilize BITS.
-    Additional tuning may be required to account for internal application distribution systems or approved update mechanisms that also rely on BITS.
+
+    Additional tuning may be required to account for internal application distribution systems or approved update mechanisms that also rely on BITS.'
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
 drilldown_searches:
@@ -38,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml
index 68cbf8d2749..8a70f61608a 100644
--- a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml
+++ b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml
@@ -6,8 +6,7 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. It leverages Cisco Secure Firewall logs and compares the SSL certificate SHA1 fingerprint against a blacklist of certificates associated with malware distribution, command and control (C2) infrastructure, or phishing campaigns. This activity is significant as adversaries often reuse or self-sign certificates across malicious infrastructure, allowing defenders to track and detect encrypted sessions even when domains or IPs change. If confirmed malicious, this may indicate beaconing, malware download, or data exfiltration over TLS/SSL.
+description: The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. It leverages Cisco Secure Firewall logs and compares the SSL certificate SHA1 fingerprint against a blacklist of certificates associated with malware distribution, command and control (C2) infrastructure, or phishing campaigns. This activity is significant as adversaries often reuse or self-sign certificates across malicious infrastructure, allowing defenders to track and detect encrypted sessions even when domains or IPs change. If confirmed malicious, this may indicate beaconing, malware download, or data exfiltration over TLS/SSL.
 data_source:
     - Cisco Secure Firewall Threat Defense Connection Event
 search: |
@@ -25,16 +24,23 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
+
     The access policy must also enable logging.
-    This search also make use of lookup based on https://sslbl.abuse.ch/blacklist/sslblacklist.csv. Make sure its available
+
+    This search also make use of lookup based on https://sslbl.abuse.ch/blacklist/sslblacklist.csv. Make sure its available'
 known_false_positives: Certain SSL certificates may be flagged in threat intelligence feeds due to historical misuse, yet still be used by legitimate services, particularly in content delivery or shared hosting environments. Internal or self-signed certificates used in testing or development environments may inadvertently match known blacklisted fingerprints. It is recommended to validate the connection context (destination IP, domain, ClientApplication) and correlate with other indicators before taking action.
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
@@ -46,7 +52,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious SSL certificate fingerprint - [$SSL_CertFingerprint$] used in connections [ListingReason - $Reasons$] from $src$
     entity:
@@ -68,8 +74,8 @@ mitre_attack_id:
     - T1573.002
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___blocked_connection.yml b/detections/network/cisco_secure_firewall___blocked_connection.yml
index 58f115938fb..4de818cc5bd 100644
--- a/detections/network/cisco_secure_firewall___blocked_connection.yml
+++ b/detections/network/cisco_secure_firewall___blocked_connection.yml
@@ -10,20 +10,22 @@ description: The following analytic detects a blocked connection event by identi
 data_source:
     - Cisco Secure Firewall Threat Defense Connection Event
 search: |
-    `cisco_secure_firewall` EventType=ConnectionEvent action IN ("Block with reset", "Block", "blocked")
-    | stats count min(_time) as firstTime max(_time) as lastTime by src, dest, dest_port, transport, rule, url, EVE_Process, action
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___blocked_connection_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` action IN ("Block with reset", "Block", "blocked") | eval EVE_Process=EVE_Process, Potentially_Exfiltrated=initiator_mb | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port transport rule action url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___blocked_connection_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The access policy must also enable logging.
+
+    The access policy must also enable logging.'
 known_false_positives: Blocked connection events are generated via an Access Control policy on the Firewall management console. Hence no false positives should be present.
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
@@ -35,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/network/cisco_secure_firewall___citrix_netscaler_memory_overread_attempt.yml b/detections/network/cisco_secure_firewall___citrix_netscaler_memory_overread_attempt.yml
index 4af490925e7..7259c3551d9 100644
--- a/detections/network/cisco_secure_firewall___citrix_netscaler_memory_overread_attempt.yml
+++ b/detections/network/cisco_secure_firewall___citrix_netscaler_memory_overread_attempt.yml
@@ -6,46 +6,33 @@ modification_date: '2026-05-13'
 author: Michael Haag, Nasreddine Bencherchali, Splunk, Talos NTDR
 status: production
 type: TTP
-description: |
-    This analytic detects exploitation activity of CVE-2025-5777 using Cisco Secure Firewall Intrusion Events.
+description: 'This analytic detects exploitation activity of CVE-2025-5777 using Cisco Secure Firewall Intrusion Events.
+
     It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signature 65118 (Citrix NetScaler memory overread attempt) is triggered
-    If confirmed malicious, this behavior is highly indicative of a potential exploitation of CVE-2025-5777.
+
+    If confirmed malicious, this behavior is highly indicative of a potential exploitation of CVE-2025-5777.'
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
-    `cisco_secure_firewall`
-    EventType=IntrusionEvent
-    signature_id = 65118
-    | fillnull
-    | stats min(_time) as firstTime
-            max(_time) as lastTime
-            values(signature_id) as signature_id
-            values(signature) as signature
-            values(class_desc) as class_desc
-            values(MitreAttackGroups) as MitreAttackGroups
-            values(InlineResult) as InlineResult
-            values(InlineResultReason) as InlineResultReason
-            values(src) as src
-            values(dest_port) as dest_port
-            values(rule) as rule
-            values(transport) as transport
-            values(app) as app
-            by dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___citrix_netscaler_memory_overread_attempt_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` signature_id="65118" | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port signature signature_id rule transport app | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___citrix_netscaler_memory_overread_attempt_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The malware & file access policy must also enable logging.
-known_false_positives: |
-    Security testing or vulnerability scanners might trigger this. Investigate any potential
-    matches to determine if they're legitimate.
+
+    The malware & file access policy must also enable logging.'
+known_false_positives: 'Security testing or vulnerability scanners might trigger this. Investigate any potential
+
+    matches to determine if they''re legitimate.'
 references:
     - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
     - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
@@ -62,7 +49,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential exploitation of CVE-2025-5777 from $src$
     entity:
diff --git a/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml b/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml
index e107f64a16a..ba7314523b8 100644
--- a/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml
+++ b/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml
@@ -6,34 +6,33 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444, 2222, or 51820 to bypass standard monitoring and firewall rules. If confirmed malicious, this activity may represent command and control (C2) tunneling, lateral movement, or unauthorized remote access.
+description: The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444, 2222, or 51820 to bypass standard monitoring and firewall rules. If confirmed malicious, this activity may represent command and control (C2) tunneling, lateral movement, or unauthorized remote access.
 data_source:
     - Cisco Secure Firewall Threat Defense Connection Event
 search: |
-    `cisco_secure_firewall` EventType=ConnectionEvent dest_port IN ("888", "999", "2200", "2222", "4000", "4444", "6789", "8531", "50501", "51820") | fillnull value="unknown" url
-    | stats min(_time) as firstTime max(_time) as lastTime
-          values(src_port) as src_port
-          values(url) as url
-          values(rule) as rule
-          count by src, dest, dest_port, transport, action
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___communication_over_suspicious_ports_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` dest_port IN ("888", "999", "2200", "2222", "4000", "4444", "6789", "8531", "50501", "51820") | eval EVE_Process=EVE_Process, Potentially_Exfiltrated=initiator_mb | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port transport rule action url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___communication_over_suspicious_ports_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
+
     The access policy must also enable logging.
-    The search uses a hardcoded list of suspicious ports, you might want to tune those according to your environment
-known_false_positives: |
-    Some legitimate services or custom applications may use non-standard ports for development, remote management, or internal communication.
+
+    The search uses a hardcoded list of suspicious ports, you might want to tune those according to your environment'
+known_false_positives: 'Some legitimate services or custom applications may use non-standard ports for development, remote management, or internal communication.
+
     Ephemeral ports in test environments may occasionally overlap with ports used in this detection.
-    Additional context such as process name, user behavior, or endpoint telemetry should be used to validate suspicious sessions before escalation.
+
+    Additional context such as process name, user behavior, or endpoint telemetry should be used to validate suspicious sessions before escalation.'
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
 drilldown_searches:
@@ -44,7 +43,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -66,8 +65,8 @@ mitre_attack_id:
     - T1571
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml b/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml
index d485b736f6d..ee4d99d0594 100644
--- a/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml
+++ b/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml
@@ -6,36 +6,31 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services. While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. This analytic is valuable for identifying potential abuse of legitimate infrastructure as part of an attacker's kill chain. If confirmed malicious, this activity may indicate tool staging, credential dumping, or outbound data leaks over HTTP(S).
+description: The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services. While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. This analytic is valuable for identifying potential abuse of legitimate infrastructure as part of an attacker's kill chain. If confirmed malicious, this activity may indicate tool staging, credential dumping, or outbound data leaks over HTTP(S).
 data_source:
     - Cisco Secure Firewall Threat Defense Connection Event
 search: |
-    `cisco_secure_firewall` action IN ("Trust", "Allow", "allowed") EventType=ConnectionEvent url IN ("*//objects.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*", "*dl.dropboxusercontent.com*", "*ghostbin.co*", "*glitch.me*", "*gofile.io*", "*hastebin.com*", "*mediafire.com*", "*mega.nz*", "*onrender.com*", "*pages.dev*", "*paste.ee*", "*pastebin.com*", "*pastebin.pl*", "*pastetext.net*", "*privatlab.com*", "*privatlab.net*", "*send.exploit.in*", "*sendspace.com*", "*storage.googleapis.com*", "*storjshare.io*", "*supabase.co*", "*temp.sh*", "*transfer.sh*", "*trycloudflare.com*", "*ufile.io*", "*w3spaces.com*", "*workers.dev*")
-    | stats count min(_time) as firstTime max(_time) as lastTime
-      Values(src_port) as src_port
-      Values(dest) as dest
-      Values(dest_port) as dest_port
-      Values(rule) as rule
-      Values(url) as url
-      Values(EVE_Process) as EVE_Process
-      by src, transport, action
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___connection_to_file_sharing_domain_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` action IN ("Trust", "Allow", "allowed") url IN ("*//objects.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*", "*dl.dropboxusercontent.com*", "*ghostbin.co*", "*glitch.me*", "*gofile.io*", "*hastebin.com*", "*mediafire.com*", "*mega.nz*", "*onrender.com*", "*pages.dev*", "*paste.ee*", "*pastebin.com*", "*pastebin.pl*", "*pastetext.net*", "*privatlab.com*", "*privatlab.net*", "*send.exploit.in*", "*sendspace.com*", "*storage.googleapis.com*", "*storjshare.io*", "*supabase.co*", "*temp.sh*", "*transfer.sh*", "*trycloudflare.com*", "*ufile.io*", "*w3spaces.com*", "*workers.dev*") | eval EVE_Process=EVE_Process, Potentially_Exfiltrated=initiator_mb | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port transport rule action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___connection_to_file_sharing_domain_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The access policy must also enable logging.
-known_false_positives: |
-    Legitimate users and applications may use these domains for benign purposes such as file transfers, collaborative development, or storing public content.
+
+    The access policy must also enable logging.'
+known_false_positives: 'Legitimate users and applications may use these domains for benign purposes such as file transfers, collaborative development, or storing public content.
+
     Developer tools, browser extensions, or open-source software may connect to githubusercontent.com or cdn.discordapp.com as part of normal operation.
-    It is recommended to review the associated process (`EVE_Process`), user behavior, and frequency of access before classifying the activity as suspicious.
+
+    It is recommended to review the associated process (`EVE_Process`), user behavior, and frequency of access before classifying the activity as suspicious.'
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
 drilldown_searches:
@@ -46,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml b/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml
index a6b4cb4e230..4474a0fe996 100644
--- a/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml
+++ b/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml
@@ -6,8 +6,7 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects file transfers flagged as malware that occurred over non-standard ports (other than 80 and 443). Adversaries may attempt to bypass protocol-based detection or use alternate ports to blend in with other traffic. This analytic identifies these non-conventional flows and surfaces potential evasion techniques. If confirmed malicious this indicate potential malware delivery or other nefarious activity.
+description: The following analytic detects file transfers flagged as malware that occurred over non-standard ports (other than 80 and 443). Adversaries may attempt to bypass protocol-based detection or use alternate ports to blend in with other traffic. This analytic identifies these non-conventional flows and surfaces potential evasion techniques. If confirmed malicious this indicate potential malware delivery or other nefarious activity.
 data_source:
     - Cisco Secure Firewall Threat Defense File Event
 search: |
@@ -24,15 +23,21 @@ search: |
     | `security_content_ctime(lastTime)`
     | table firstTime lastTime src dest dest_port FileDirection FileType Description uri ClientApplication file_name file_hash SHA_Disposition ThreatName
     | `cisco_secure_firewall___file_download_over_uncommon_port_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The malware & file access policy must also enable logging.
+
+    The malware & file access policy must also enable logging.'
 known_false_positives: Some legitimate applications may download files over custom ports (e.g., CDN mirrors, APIs). Apply additional filters accordingly.
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
@@ -44,7 +49,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/network/cisco_secure_firewall___high_eve_threat_confidence.yml b/detections/network/cisco_secure_firewall___high_eve_threat_confidence.yml
index a904c8be987..cc278946e4c 100644
--- a/detections/network/cisco_secure_firewall___high_eve_threat_confidence.yml
+++ b/detections/network/cisco_secure_firewall___high_eve_threat_confidence.yml
@@ -6,32 +6,31 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. It leverages Cisco Secure Firewall Threat Defense logs and evaluates the EVE_ThreatConfidencePct field, which reflects the system's confidence in classifying encrypted sessions as threats based on machine learning models and behavioral analysis. A score equal to or greater than 80 suggests the connection is highly likely to be associated with malware command and control (C2), remote access tools, or suspicious tunneling behavior. If confirmed malicious, this may indicate covert communication over TLS from compromised hosts.
+description: The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. It leverages Cisco Secure Firewall Threat Defense logs and evaluates the EVE_ThreatConfidencePct field, which reflects the system's confidence in classifying encrypted sessions as threats based on machine learning models and behavioral analysis. A score equal to or greater than 80 suggests the connection is highly likely to be associated with malware command and control (C2), remote access tools, or suspicious tunneling behavior. If confirmed malicious, this may indicate covert communication over TLS from compromised hosts.
 data_source:
     - Cisco Secure Firewall Threat Defense Connection Event
 search: |
-    `cisco_secure_firewall` EventType=ConnectionEvent EVE_ThreatConfidencePct >= 80
-    | stats count min(_time) as firstTime max(_time) as lastTime
-        Values(rule) as rule
-        Values(url) as url
-        by EVE_Process, EVE_ThreatConfidencePct, src, dest, dest_port, transport, action
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___high_eve_threat_confidence_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` EVE_ThreatConfidencePct>=80 | eval EVE_Process=EVE_Process, Potentially_Exfiltrated=initiator_mb | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port transport rule action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___high_eve_threat_confidence_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The access policy must also enable logging.
-known_false_positives: |
-    Some benign applications may exhibit behaviors that resemble encrypted threat patterns, especially if they use uncommon encryption libraries or custom protocols.
+
+    The access policy must also enable logging.'
+known_false_positives: 'Some benign applications may exhibit behaviors that resemble encrypted threat patterns, especially if they use uncommon encryption libraries or custom protocols.
+
     Custom-developed or internal tools may trigger high EVE confidence scores depending on how they encrypt data.
-    It is recommended to validate the associated process (`EVE_Process`) and destination context, and correlate with other logs (e.g., endpoint or threat intel) before taking response action.
+
+    It is recommended to validate the associated process (`EVE_Process`) and destination context, and correlate with other logs (e.g., endpoint or threat intel) before taking response action.'
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
 drilldown_searches:
@@ -42,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -62,8 +61,8 @@ mitre_attack_id:
     - T1573.002
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___high_priority_intrusion_classification.yml b/detections/network/cisco_secure_firewall___high_priority_intrusion_classification.yml
index 382f5e80a16..4b71b9a5d67 100644
--- a/detections/network/cisco_secure_firewall___high_priority_intrusion_classification.yml
+++ b/detections/network/cisco_secure_firewall___high_priority_intrusion_classification.yml
@@ -6,48 +6,48 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
-description: |
-    This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs.
+description: 'This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs.
+
     It leverages Cisco Secure Firewall Threat Defense logs and focuses on events classified as:
 
+
     - A Network Trojan was Detected
+
     - Successful Administrator Privilege Gain
+
     - Successful User Privilege Gain
+
     - Attempt to Login By a Default Username and Password
+
     - Known malware command and control traffic
+
     - Known malicious file or file based exploit
+
     - Known client side exploit attempt
+
     - Large Scale Information Leak"
 
-    These classifications typically represent significant threats such as remote code execution, credential theft, lateral movement, or malware communication. Detection of these classifications should be prioritized for immediate investigation.
+
+    These classifications typically represent significant threats such as remote code execution, credential theft, lateral movement, or malware communication. Detection of these classifications should be prioritized for immediate investigation.'
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
-    `cisco_secure_firewall` EventType=IntrusionEvent
-            class_desc IN ("A Network Trojan was Detected", "Successful Administrator Privilege Gain", "Successful User Privilege Gain", "Attempt to Login By a Default Username and Password", "Known malware command and control traffic", "Known malicious file or file based exploit", "Known client side exploit attempt", "Large Scale Information Leak")
-    | fillnull
-    | stats count min(_time) as firstTime max(_time) as lastTime
-            values(signature_id) as signature_id
-            values(MitreAttackGroups) as MitreAttackGroups
-            values(InlineResult) as InlineResult
-            values(InlineResultReason) as InlineResultReason
-            values(dest_port) as dest_port
-            values(rule) as rule
-            values(transport) as transport
-            values(app) as app
-            by src, dest, signature, class_desc
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___high_priority_intrusion_classification_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` class_desc IN ("A Network Trojan was Detected", "Successful Administrator Privilege Gain", "Successful User Privilege Gain", "Attempt to Login By a Default Username and Password", "Known malware command and control traffic", "Known malicious file or file based exploit", "Known client side exploit attempt", "Large Scale Information Leak") | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port signature signature_id rule transport app | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___high_priority_intrusion_classification_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The intrusion access policy must also be configured.
+
+    The intrusion access policy must also be configured.'
 known_false_positives: Some intrusion events that are linked to these classifications might be noisy in certain environments. Apply a combination of filters for specific snort IDs and other indicators.
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
@@ -59,7 +59,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A high priority intrusion event with classification ($class_desc$) was detected from $src$ to $dest$, indicating potential suspicious activity.
     entity:
@@ -82,8 +82,8 @@ mitre_attack_id:
     - T1078
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml b/detections/network/cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml
index d3e1e344bd9..7b06e3fc64f 100644
--- a/detections/network/cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml
+++ b/detections/network/cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml
@@ -6,8 +6,7 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects internal systems that generate an unusually high volume of intrusion detections within a 30-minute window. It leverages Cisco Secure Firewall Threat Defense logs, specifically focusing on the IntrusionEvent event type, to identify hosts that trigger more than 15 Snort-based signatures during that time. A sudden spike in intrusion alerts originating from a single host may indicate suspicious or malicious activity such as malware execution, command-and-control communication, vulnerability scanning, or lateral movement. In some cases, this behavior may also be caused by misconfigured or outdated software repeatedly tripping detection rules. Systems exhibiting this pattern should be triaged promptly, as repeated Snort rule matches from a single source are often early indicators of compromise, persistence, or active exploitation attempts.
+description: The following analytic detects internal systems that generate an unusually high volume of intrusion detections within a 30-minute window. It leverages Cisco Secure Firewall Threat Defense logs, specifically focusing on the IntrusionEvent event type, to identify hosts that trigger more than 15 Snort-based signatures during that time. A sudden spike in intrusion alerts originating from a single host may indicate suspicious or malicious activity such as malware execution, command-and-control communication, vulnerability scanning, or lateral movement. In some cases, this behavior may also be caused by misconfigured or outdated software repeatedly tripping detection rules. Systems exhibiting this pattern should be triaged promptly, as repeated Snort rule matches from a single source are often early indicators of compromise, persistence, or active exploitation attempts.
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
@@ -23,17 +22,22 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_secure_firewall___high_volume_of_intrusion_events_per_host_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The intrusion access policy must also be configured.
-known_false_positives: |
-    False positives can occur in environments where vulnerability scanners or malware sandboxes are actively generating simulated attacks. Additionally, noisy or overly aggressive Snort rules may produce bursts of alerts from legitimate applications. Review host context before escalating.
+
+    The intrusion access policy must also be configured.'
+known_false_positives: False positives can occur in environments where vulnerability scanners or malware sandboxes are actively generating simulated attacks. Additionally, noisy or overly aggressive Snort rules may produce bursts of alerts from legitimate applications. Review host context before escalating.
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
 drilldown_searches:
@@ -44,7 +48,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -58,13 +62,13 @@ analytic_story:
     - Cisco Secure Firewall Threat Defense Analytics
 asset_type: Network
 mitre_attack_id:
-    - T1059 # Command and Scripting Interpreter
-    - T1071 # Application Layer Protocol
-    - T1595.002 # Active Scanning: Vulnerability Scanning
+    - T1059
+    - T1071
+    - T1595.002
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml b/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml
index 518f8f97ff4..e0879a809eb 100644
--- a/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml
+++ b/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml
@@ -6,35 +6,58 @@ modification_date: '2026-09-22'
 author: Bhavin Patel, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects intrusion events from known threat activity using Cisco Secure Firewall Intrusion Events.
+description: 'This analytic detects intrusion events from known threat activity using Cisco Secure Firewall Intrusion Events.
+
     It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where one or multiple Snort signatures
+
     associated with a known threat or threat actor activity have been triggered within a one-hour time window. The detection uses a
+
     lookup table (cisco_snort_ids_to_threat_mapping) to map Snort signature IDs to known threat actors and their techniques.
+
     When multiple signatures associated with the same threat actor are triggered within the time window, and the count of
+
     unique signatures matches or exceeds the expected number of signatures for that threat technique, an alert is generated.
+
     This helps identify potential coordinated threat activity in your network environment by correlating related intrusion
+
     events that occur in close temporal proximity.
 
+
     Currently, this detection will alert on the following threat actors or malware families as defined in the cisco_snort_ids_to_threat_mapping lookup:
 
+
     * AgentTesla
+
     * Amadey
+
     * ArcaneDoor
+
     * AsyncRAT
+
     * CastleRAT
+
     * Chafer
+
     * DCRAT
+
     * LokiBot
+
     * Lumma Stealer
+
     * Nobelium
+
     * Quasar
+
     * Remcos
+
     * Snake
+
     * Static Tundra
+
     * Xworm
 
-    To add or update threat actors, update the cisco_snort_ids_to_threat_mapping.csv lookup file with new or modified threat names and associated Snort signature IDs.
+
+    To add or update threat actors, update the cisco_snort_ids_to_threat_mapping.csv lookup file with new or modified threat names and associated Snort signature IDs.'
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
@@ -48,15 +71,21 @@ search: |
     | table _time, dest, src, threat, category, message, description, signature_id, signature, snort_rule_groups, sig_count, distinct_count_snort_ids, connection_id, rule, dest_port, transport, app
     | where sig_count >= distinct_count_snort_ids
     | `cisco_secure_firewall___intrusion_events_by_threat_activity_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The intrusion access policy must also be configured. This detection is based on the cisco_snort_ids_to_threat_mapping.csv mapping file - please update the lookup file with the latest Snort IDs to Threat Actors if you would like to modify the distinct count of Snort IDs needed to trigger the detection or if you would like to add new Snort IDs to Threat Actors.
+
+    The intrusion access policy must also be configured. This detection is based on the cisco_snort_ids_to_threat_mapping.csv mapping file - please update the lookup file with the latest Snort IDs to Threat Actors if you would like to modify the distinct count of Snort IDs needed to trigger the detection or if you would like to add new Snort IDs to Threat Actors.'
 known_false_positives: False positives may occur due to legitimate security testing or research activities.
 references:
     - https://www.cisco.com/c/en/us/products/security/firewalls/index.html
@@ -69,7 +98,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$""
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -88,8 +117,8 @@ mitre_attack_id:
     - T1573.002
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___lumma_stealer_activity.yml b/detections/network/cisco_secure_firewall___lumma_stealer_activity.yml
index d1dd29005a0..942ec8a0d87 100644
--- a/detections/network/cisco_secure_firewall___lumma_stealer_activity.yml
+++ b/detections/network/cisco_secure_firewall___lumma_stealer_activity.yml
@@ -6,10 +6,11 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk, Talos NTDR
 status: production
 type: TTP
-description: |
-    This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events.
+description: 'This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events.
+
     It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where four of the following Snort signature IDs 64793, 64794, 64797, 64798, 64799, 64800, 64801, 62709, 64167, 64168, 64169, 64796, 62710, 62711, 62712, 62713, 62714, 62715, 62716, 62717, 64812, 64810, 64811 occurs in the span of 15 minutes from the same host.
-    If confirmed malicious, this behavior is highly indicative of a successful infection of Lumma Stealer.
+
+    If confirmed malicious, this behavior is highly indicative of a successful infection of Lumma Stealer.'
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
@@ -35,15 +36,21 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_secure_firewall___lumma_stealer_activity_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The intrusion access policy must also be configured.
+
+    The intrusion access policy must also be configured.'
 known_false_positives: False positives should be very unlikely.
 references:
     - https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
@@ -55,7 +62,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Lumma Stealer Activity on host $dest$ origniating from $src$
     entity:
@@ -78,8 +85,8 @@ mitre_attack_id:
     - T1204
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___lumma_stealer_download_attempt.yml b/detections/network/cisco_secure_firewall___lumma_stealer_download_attempt.yml
index e2ab67381b5..9fbd25e54b5 100644
--- a/detections/network/cisco_secure_firewall___lumma_stealer_download_attempt.yml
+++ b/detections/network/cisco_secure_firewall___lumma_stealer_download_attempt.yml
@@ -6,28 +6,28 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk, Talos NTDR
 status: production
 type: Anomaly
-description: |
-    This analytic detects Lumma Stealer download attempts using Cisco Secure Firewall Intrusion Events.
-    It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with IDs 64797, 64798, 64799, 64800, 64801, 64167, 64168, 64169 have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.
+description: 'This analytic detects Lumma Stealer download attempts using Cisco Secure Firewall Intrusion Events.
+
+    It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with IDs 64797, 64798, 64799, 64800, 64801, 64167, 64168, 64169 have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.'
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
-    `cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (62710, 62711, 62712, 62713, 62714, 62715, 62716, 62717, 64810, 64811)
-    | fillnull
-    | stats min(_time) as firstTime max(_time) as lastTime
-            by src dest dest_port transport signature_id signature class_desc MitreAttackGroups rule InlineResult InlineResultReason app
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___lumma_stealer_download_attempt_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` signature_id IN ("62710", "62711", "62712", "62713", "62714", "62715", "62716", "62717", "64810", "64811") | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port signature signature_id rule transport app | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___lumma_stealer_download_attempt_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The intrusion access policy must also be configured.
+
+    The intrusion access policy must also be configured.'
 known_false_positives: False positives should be unlikely.
 references:
     - https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
@@ -39,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -60,8 +60,8 @@ mitre_attack_id:
     - T1573.002
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml b/detections/network/cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml
index 3d31b8bff58..821b2adc561 100644
--- a/detections/network/cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml
+++ b/detections/network/cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml
@@ -6,28 +6,28 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk, Talos NTDR
 status: production
 type: Anomaly
-description: |
-    This analytic detects Lumma Stealer outbound connection attempts using Cisco Secure Firewall Intrusion Events.
-    It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with IDs 64797, 64798, 64799, 64800, 64801, 64167, 64168, 64169, 62709 have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.
+description: 'This analytic detects Lumma Stealer outbound connection attempts using Cisco Secure Firewall Intrusion Events.
+
+    It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with IDs 64797, 64798, 64799, 64800, 64801, 64167, 64168, 64169, 62709 have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.'
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
-    `cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (64797, 64798, 64799, 64800, 64801, 64167, 64168, 64169, 62709)
-    | fillnull
-    | stats min(_time) as firstTime max(_time) as lastTime
-            by src dest dest_port transport signature_id signature class_desc MitreAttackGroups rule InlineResult InlineResultReason app
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___lumma_stealer_outbound_connection_attempt_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` signature_id IN ("64797", "64798", "64799", "64800", "64801", "64167", "64168", "64169", "62709") | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port signature signature_id rule transport app | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___lumma_stealer_outbound_connection_attempt_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The intrusion access policy must also be configured.
+
+    The intrusion access policy must also be configured.'
 known_false_positives: False positives should be unlikely.
 references:
     - https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
@@ -39,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -60,8 +60,8 @@ mitre_attack_id:
     - T1573.002
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___malware_file_downloaded.yml b/detections/network/cisco_secure_firewall___malware_file_downloaded.yml
index b32cf7b6ae5..100a6905889 100644
--- a/detections/network/cisco_secure_firewall___malware_file_downloaded.yml
+++ b/detections/network/cisco_secure_firewall___malware_file_downloaded.yml
@@ -6,8 +6,7 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects file downloads that were classified as malware by Cisco Secure Firewall Threat Defense. It relies on the `SHA_Disposition` field with a value of "Malware" and includes metadata such as file name, file_hash hash, and threat classification. This analytic is critical for surfacing file-based threats that are identified via Cisco's AMP or Threat Grid integrations. If confirmed malicious, this could indicate delivery of malware.
+description: The following analytic detects file downloads that were classified as malware by Cisco Secure Firewall Threat Defense. It relies on the `SHA_Disposition` field with a value of "Malware" and includes metadata such as file name, file_hash hash, and threat classification. This analytic is critical for surfacing file-based threats that are identified via Cisco's AMP or Threat Grid integrations. If confirmed malicious, this could indicate delivery of malware.
 data_source:
     - Cisco Secure Firewall Threat Defense File Event
 search: |
@@ -22,15 +21,21 @@ search: |
     | `security_content_ctime(lastTime)`
     | table firstTime lastTime src dest dest_port FileDirection FileType Description uri file_name file_hash app ClientApplication ThreatName SHA_Disposition
     | `cisco_secure_firewall___malware_file_downloaded_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The malware & file access policy must also enable logging.
+
+    The malware & file access policy must also enable logging.'
 known_false_positives: Malicious verdicts could be outdated or incorrect due to retroactive threat intel.
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
@@ -42,7 +47,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/network/cisco_secure_firewall___oracle_e_business_suite_correlation.yml b/detections/network/cisco_secure_firewall___oracle_e_business_suite_correlation.yml
index 7a864774c20..dd113bb22e9 100644
--- a/detections/network/cisco_secure_firewall___oracle_e_business_suite_correlation.yml
+++ b/detections/network/cisco_secure_firewall___oracle_e_business_suite_correlation.yml
@@ -6,11 +6,13 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk, Talos NTDR
 status: production
 type: TTP
-description: |
-    This correlation rule identifies potential exploitation attempts of Oracle E-Business Suite vulnerabilities (CVE-2025-61882 and CVE-2025-61884) by correlating multiple intrusion signatures from Cisco Secure Firewall Threat Defense logs.
+description: 'This correlation rule identifies potential exploitation attempts of Oracle E-Business Suite vulnerabilities (CVE-2025-61882 and CVE-2025-61884) by correlating multiple intrusion signatures from Cisco Secure Firewall Threat Defense logs.
+
     The detection looks for specific signatures that indicate attempts to exploit the TemplatePreview functionality and vulnerable SyncServlet endpoints as well as post compromise activity involving Cl0p.
+
     By correlating these signatures, the analytic aims to identify coordinated exploitation attempts that may indicate an attacker is targeting Oracle E-Business Suite installations.
-    Security teams should investigate any instances of these correlated signatures, especially if they are found in conjunction with other suspicious network activity or on systems that should not be exposed to such threats.
+
+    Security teams should investigate any instances of these correlated signatures, especially if they are found in conjunction with other suspicious network activity or on systems that should not be exposed to such threats.'
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
@@ -56,15 +58,21 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_secure_firewall___oracle_e_business_suite_correlation_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The intrusion access policy must also be configured.
+
+    The intrusion access policy must also be configured.'
 known_false_positives: False positives should be very unlikely.
 references:
     - https://www.oracle.com/security-alerts/alert-cve-2025-61882.html
@@ -79,7 +87,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Multiple Oracle E-Business Suite exploitation signatures $signature_id$ detected from source IP $src$ to destination IP $dest$
     entity:
@@ -102,8 +110,8 @@ mitre_attack_id:
     - T1190
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___oracle_e_business_suite_exploitation.yml b/detections/network/cisco_secure_firewall___oracle_e_business_suite_exploitation.yml
index ddbf8a59ada..e03166d6769 100644
--- a/detections/network/cisco_secure_firewall___oracle_e_business_suite_exploitation.yml
+++ b/detections/network/cisco_secure_firewall___oracle_e_business_suite_exploitation.yml
@@ -6,44 +6,34 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk, Talos NTDR
 status: production
 type: TTP
-description: |
-    This analytic detects vulnerability exploitation and post-compromise activity associated with Oracle E-Business Suite web-application vulnerabilities, CVE-2025-61882 and CVE-2025-61884.
+description: 'This analytic detects vulnerability exploitation and post-compromise activity associated with Oracle E-Business Suite web-application vulnerabilities, CVE-2025-61882 and CVE-2025-61884.
+
     SIDs 65413-65415 detect detect Java.Backdoor.Cl0p variant payload downloads and Java.Backdoor.Cl0p outbound
+
     command-and-control connection attempts.
+
     SIDs 65456, 65377 and 65378 detect attempts to exploit these vulnerabilities.
-    Security teams should investigate any instances of these signatures, especially if they are found in conjunction with other suspicious network activity or on systems that should not be exposed to such threats.
+
+    Security teams should investigate any instances of these signatures, especially if they are found in conjunction with other suspicious network activity or on systems that should not be exposed to such threats.'
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
-    `cisco_secure_firewall`
-    EventType=IntrusionEvent
-    signature_id IN (65377, 65378, 65413, 65414, 65415, 65456)
-    | fillnull
-    | stats values(signature_id) as signature_id
-            values(signature) as signature
-            values(class_desc) as class_desc
-            values(MitreAttackGroups) as MitreAttackGroups
-            values(InlineResult) as InlineResult
-            values(InlineResultReason) as InlineResultReason
-            values(dest_port) as dest_port
-            values(rule) as rule
-            values(transport) as transport
-            values(app) as app
-            min(_time) as firstTime
-            max(_time) as lastTime
-      by src dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___oracle_e_business_suite_exploitation_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` signature_id IN ("65377", "65378", "65413", "65414", "65415", "65456") | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port signature signature_id rule transport app | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___oracle_e_business_suite_exploitation_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The intrusion access policy must also be configured.
+
+    The intrusion access policy must also be configured.'
 known_false_positives: False positives should be unlikely.
 references:
     - https://www.oracle.com/security-alerts/alert-cve-2025-61882.html
@@ -58,7 +48,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Network activity associated with Oracle E-Business Suite exploitation detected from source IP $src$ to destination IP $dest$.
     entity:
@@ -78,8 +68,8 @@ mitre_attack_id:
     - T1190
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___possibly_compromised_host.yml b/detections/network/cisco_secure_firewall___possibly_compromised_host.yml
index c153c6388d4..421b1c47676 100644
--- a/detections/network/cisco_secure_firewall___possibly_compromised_host.yml
+++ b/detections/network/cisco_secure_firewall___possibly_compromised_host.yml
@@ -6,30 +6,28 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: experimental
 type: Anomaly
-description: |
-    The following analytic highlights high-impact intrusion events assigned by Cisco Secure Firewall.
-    This detection leverages Cisco Secure Firewall Threat Defense logs and specifically the IntrusionEvent event type and `Impact` field assigned by Cisco Secure Firewall looking for an impact score of 1 or 2. If confirmed malicious this may indicate a potential compromised host.
+description: 'The following analytic highlights high-impact intrusion events assigned by Cisco Secure Firewall.
+
+    This detection leverages Cisco Secure Firewall Threat Defense logs and specifically the IntrusionEvent event type and `Impact` field assigned by Cisco Secure Firewall looking for an impact score of 1 or 2. If confirmed malicious this may indicate a potential compromised host.'
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
-    `cisco_secure_firewall` EventType=IntrusionEvent Impact IN (1,2)
-    | stats count as TotalDetections values(signature_id) as signature_id
-            values(signature) as signature
-            values(rule) as rule
-            min(_time) as firstTime max(_time) as lastTime
-            by src dest dest_port transport Impact app impact_desc class_desc MitreAttackGroups InlineResult InlineResultReason
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___possibly_compromised_host_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` Impact IN ("1", "2") | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port signature signature_id rule transport app | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___possibly_compromised_host_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The intrusion access policy must also be configured.
+
+    The intrusion access policy must also be configured.'
 known_false_positives: False positives are directly related to their snort rules triggering and the firewall scoring. Apply additional filters if the rules are too noisy by disabling them or simply ignoring certain IP ranges that trigger it.
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
@@ -41,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -60,7 +58,7 @@ mitre_attack_id:
     - T1587.001
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
diff --git a/detections/network/cisco_secure_firewall___potential_data_exfiltration.yml b/detections/network/cisco_secure_firewall___potential_data_exfiltration.yml
index 626fe3aa7a6..ec31a4e0f95 100644
--- a/detections/network/cisco_secure_firewall___potential_data_exfiltration.yml
+++ b/detections/network/cisco_secure_firewall___potential_data_exfiltration.yml
@@ -6,37 +6,33 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects potentially suspicious large volumes of data sent by the connection initiator on flows from internal to external networks. It leverages Cisco Secure Firewall Threat Defense ConnectionEvent logs and thresholds on InitiatorBytes (bytes transmitted by the initiator), which for typical inside-initiated client sessions approximates upload or outbound payload from the internal host and avoids flagging large downloads where most bytes appear in ResponderBytes. Connections where the initiator sent at least 100 MB are flagged, as these may indicate unauthorized data exfiltration, especially if associated with unusual users, hosts, or processes. This analytic is scoped to inside-to-outside flows using a macro (cisco_secure_firewall_inside_to_outside) to abstract environment-specific zone definitions. If confirmed malicious, this behavior may reflect data staging and exfiltration over an encrypted or stealthy transport.
+description: The following analytic detects potentially suspicious large volumes of data sent by the connection initiator on flows from internal to external networks. It leverages Cisco Secure Firewall Threat Defense ConnectionEvent logs and thresholds on InitiatorBytes (bytes transmitted by the initiator), which for typical inside-initiated client sessions approximates upload or outbound payload from the internal host and avoids flagging large downloads where most bytes appear in ResponderBytes. Connections where the initiator sent at least 100 MB are flagged, as these may indicate unauthorized data exfiltration, especially if associated with unusual users, hosts, or processes. This analytic is scoped to inside-to-outside flows using a macro (cisco_secure_firewall_inside_to_outside) to abstract environment-specific zone definitions. If confirmed malicious, this behavior may reflect data staging and exfiltration over an encrypted or stealthy transport.
 data_source:
     - Cisco Secure Firewall Threat Defense Connection Event
 search: |
-    `cisco_secure_firewall` EventType=ConnectionEvent `cisco_secure_firewall_inside_to_outside`
-    | eval initiator_mb = round(InitiatorBytes / 1024 / 1024, 2)
-    | where initiator_mb >= 100
-    | eval Potentially_Exfiltrated = initiator_mb + " MB"
-    | stats min(_time) as firstTime max(_time) as lastTime
-        Values(url) as url
-        Values(rule) as rule
-        Values(dest_port) as dest_port
-        by src, dest, Potentially_Exfiltrated, transport, action
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___potential_data_exfiltration_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` IngressZone="inside" EgressZone="outside" | eval EVE_Process=EVE_Process, Potentially_Exfiltrated=initiator_mb | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port transport rule action url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___potential_data_exfiltration_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the ConnectionEvent EventType. This search uses two input macros named `cisco_secure_firewall` and `cisco_secure_firewall_inside_to_outside`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definitions
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The access policy must also enable logging.
-known_false_positives: |
-    Large initiator-side transfers may occur due to legitimate activities such as cloud backups, file syncing, or developer build deployments.
+
+    The access policy must also enable logging.'
+known_false_positives: 'Large initiator-side transfers may occur due to legitimate activities such as cloud backups, file syncing, or developer build deployments.
+
     Backup servers, CI/CD pipelines, and enterprise sync tools (e.g., OneDrive, Dropbox) may exhibit similar patterns.
+
     Uncommon connection initiation (e.g., certain server-initiated or asymmetric paths) can change which side is logged as the initiator; tune or filter those scenarios if needed.
-    Additional validation using user context, scheduled task windows, or endpoint telemetry is recommended to reduce false positives.
+
+    Additional validation using user context, scheduled task windows, or endpoint telemetry is recommended to reduce false positives.'
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
 drilldown_searches:
@@ -47,7 +43,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -66,8 +62,8 @@ mitre_attack_id:
     - T1048.003
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___privileged_command_execution_via_http.yml b/detections/network/cisco_secure_firewall___privileged_command_execution_via_http.yml
index 0e7f5795002..21cdec3c204 100644
--- a/detections/network/cisco_secure_firewall___privileged_command_execution_via_http.yml
+++ b/detections/network/cisco_secure_firewall___privileged_command_execution_via_http.yml
@@ -6,45 +6,29 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects HTTP requests to privileged execution paths on Cisco routers, specifically targeting the `/level/15/exec/-/*` endpoint using Cisco Secure Firewall Intrusion Events.
-    This detection leverages Snort signature 65370 to identify requests to these sensitive endpoints, which when combined with other indicators may signal active exploitation or post-compromise activity.
+description: 'This analytic detects HTTP requests to privileged execution paths on Cisco routers, specifically targeting the `/level/15/exec/-/*` endpoint using Cisco Secure Firewall Intrusion Events.
+
+    This detection leverages Snort signature 65370 to identify requests to these sensitive endpoints, which when combined with other indicators may signal active exploitation or post-compromise activity.'
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
-    `cisco_secure_firewall`
-    EventType=IntrusionEvent
-    signature_id=65370
-    | fillnull
-    | stats dc(signature_id) as unique_signature_count
-            values(signature_id) as signature_id
-            values(signature) as signature
-            values(class_desc) as class_desc
-            values(MitreAttackGroups) as MitreAttackGroups
-            values(InlineResult) as InlineResult
-            values(InlineResultReason) as InlineResultReason
-            values(src) as src
-            values(dest_port) as dest_port
-            values(rule) as rule
-            values(transport) as transport
-            values(app) as app
-            min(_time) as firstTime
-            max(_time) as lastTime
-            by dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___privileged_command_execution_via_http_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` signature_id="65370" | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port signature signature_id rule transport app | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___privileged_command_execution_via_http_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The malware & file access policy must also enable logging.
-known_false_positives: |
-    No false positives have been identified yet.
+
+    The malware & file access policy must also enable logging.'
+known_false_positives: No false positives have been identified yet.
 references:
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
 drilldown_searches:
@@ -55,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml b/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml
index 4264fff29d7..0abc639cb4f 100644
--- a/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml
+++ b/detections/network/cisco_secure_firewall___rare_snort_rule_triggered.yml
@@ -6,34 +6,26 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Hunting
-description: |
-    This analytic identifies Snort signatures that have triggered only once in the past 7 days across all Cisco Secure Firewall IntrusionEvent logs. While these rules typically do not trigger in day-to-day network activity, their sudden appearance may indicate early-stage compromise, previously unseen malware, or reconnaissance activity against less commonly exposed services. Investigating these outliers can provide valuable insight into new or low-noise adversary behaviors.
+description: This analytic identifies Snort signatures that have triggered only once in the past 7 days across all Cisco Secure Firewall IntrusionEvent logs. While these rules typically do not trigger in day-to-day network activity, their sudden appearance may indicate early-stage compromise, previously unseen malware, or reconnaissance activity against less commonly exposed services. Investigating these outliers can provide valuable insight into new or low-noise adversary behaviors.
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
-    `cisco_secure_firewall` EventType=IntrusionEvent earliest=-7d
-    | stats dc(_time) as TriggerCount min(_time) as firstTime max(_time) as lastTime
-            values(signature) as signature
-            values(src) as src
-            values(dest) as dest
-            values(dest_port) as dest_port
-            values(transport) as transport
-            values(app) as app
-            values(rule) as rule
-            by signature_id class_desc MitreAttackGroups InlineResult InlineResultReason
-    | where TriggerCount = 1
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___rare_snort_rule_triggered_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` earliest="-7d" | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port signature signature_id rule transport app | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___rare_snort_rule_triggered_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The intrusion access policy must also be configured.
+
+    The intrusion access policy must also be configured.'
 known_false_positives: False positives may occur with certain rare activity. Apply additional filters where required.
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
@@ -45,8 +37,8 @@ mitre_attack_id:
     - T1583.006
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___react_server_components_rce_attempt.yml b/detections/network/cisco_secure_firewall___react_server_components_rce_attempt.yml
index 4d904581850..b14914a705f 100644
--- a/detections/network/cisco_secure_firewall___react_server_components_rce_attempt.yml
+++ b/detections/network/cisco_secure_firewall___react_server_components_rce_attempt.yml
@@ -6,46 +6,33 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk, Talos NTDR
 status: production
 type: TTP
-description: |
-    This analytic detects exploitation activity of CVE-2025-55182 using Cisco Secure Firewall Intrusion Events.
+description: 'This analytic detects exploitation activity of CVE-2025-55182 using Cisco Secure Firewall Intrusion Events.
+
     It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signature 65554 (React Server Components remote code execution attempt) is triggered
-    If confirmed malicious, this behavior could be indicative of a potential exploitation of CVE-2025-55182.
+
+    If confirmed malicious, this behavior could be indicative of a potential exploitation of CVE-2025-55182.'
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
-    `cisco_secure_firewall`
-    EventType=IntrusionEvent
-    signature_id = 65554
-    | fillnull
-    | stats min(_time) as firstTime
-            max(_time) as lastTime
-            values(signature_id) as signature_id
-            values(signature) as signature
-            values(class_desc) as class_desc
-            values(MitreAttackGroups) as MitreAttackGroups
-            values(InlineResult) as InlineResult
-            values(InlineResultReason) as InlineResultReason
-            values(src) as src
-            values(dest_port) as dest_port
-            values(rule) as rule
-            values(transport) as transport
-            values(app) as app
-            by dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___react_server_components_rce_attempt_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` signature_id="65554" | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port signature signature_id rule transport app | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___react_server_components_rce_attempt_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The malware & file access policy must also enable logging.
-known_false_positives: |
-    Security testing or vulnerability scanners might trigger this. Investigate any potential
-    matches to determine if they're legitimate.
+
+    The malware & file access policy must also enable logging.'
+known_false_positives: 'Security testing or vulnerability scanners might trigger this. Investigate any potential
+
+    matches to determine if they''re legitimate.'
 references:
     - https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
     - https://nextjs.org/blog/CVE-2025-66478
@@ -60,7 +47,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential exploitation of CVE-2025-65554 from $src$
     entity:
diff --git a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml
index 8b32c0275e8..2be0941bec2 100644
--- a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml
+++ b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml
@@ -6,13 +6,17 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects network traffic associated with known remote access software applications
+description: 'The following analytic detects network traffic associated with known remote access software applications
+
     that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
+
     It leverages Cisco Secure Firewall Threat Defense Connection Event.
+
     This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.
+
     If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate
-    data, or deploy additional malware, posing a severe threat to the organization's security.
+
+    data, or deploy additional malware, posing a severe threat to the organization''s security.'
 data_source:
     - Cisco Secure Firewall Threat Defense Connection Event
 search: |
@@ -30,19 +34,26 @@ search: |
     | search category IN ("remote administration", "remote desktop control")
     | `remote_access_software_usage_exceptions`
     | `cisco_secure_firewall___remote_access_software_usage_traffic_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
+
     The access policy must also enable logging.
+
     The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions"
-    that lets you track and maintain device- based exceptions for this set of detections.
-known_false_positives: |
-    It is possible that legitimate remote access software is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
+
+    that lets you track and maintain device- based exceptions for this set of detections.'
+known_false_positives: It is possible that legitimate remote access software is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
 references:
     - https://attack.mitre.org/techniques/T1219/
     - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -55,7 +66,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/network/cisco_secure_firewall___repeated_blocked_connections.yml b/detections/network/cisco_secure_firewall___repeated_blocked_connections.yml
index 3558d267f6c..430a45da16f 100644
--- a/detections/network/cisco_secure_firewall___repeated_blocked_connections.yml
+++ b/detections/network/cisco_secure_firewall___repeated_blocked_connections.yml
@@ -6,8 +6,7 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. It leverages Cisco Secure Firewall Threat Defense logs and identifies connections where the action is set to Block, and the number of occurrences reaches or exceeds a threshold of ten within a one-minute span. This pattern may indicate a misconfigured application, unauthorized access attempts, or early stages of a brute-force or scanning operation. If confirmed malicious, this behavior may represent an attacker probing the network, attempting lateral movement, or testing firewall rules for weaknesses.
+description: The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. It leverages Cisco Secure Firewall Threat Defense logs and identifies connections where the action is set to Block, and the number of occurrences reaches or exceeds a threshold of ten within a one-minute span. This pattern may indicate a misconfigured application, unauthorized access attempts, or early stages of a brute-force or scanning operation. If confirmed malicious, this behavior may represent an attacker probing the network, attempting lateral movement, or testing firewall rules for weaknesses.
 data_source:
     - Cisco Secure Firewall Threat Defense Connection Event
 search: |
@@ -21,19 +20,26 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_secure_firewall___repeated_blocked_connections_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The access policy must also enable logging.
-known_false_positives: |
-    Misconfigured applications or automated scripts may generate repeated blocked traffic, particularly if attempting to reach decommissioned or restricted resources.
+
+    The access policy must also enable logging.'
+known_false_positives: 'Misconfigured applications or automated scripts may generate repeated blocked traffic, particularly if attempting to reach decommissioned or restricted resources.
+
     Vulnerability scanners or penetration testing tools running in authorized environments may trigger this alert.
-    Tuning may be required to exclude known internal tools or scanner IPs from detection.
+
+    Tuning may be required to exclude known internal tools or scanner IPs from detection.'
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
 drilldown_searches:
@@ -44,7 +50,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -65,8 +71,8 @@ mitre_attack_id:
     - T1595.002
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml b/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml
index 972b7aeb41c..776b777fe7b 100644
--- a/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml
+++ b/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml
@@ -6,8 +6,7 @@ modification_date: '2026-09-22'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. It leverages Cisco Secure Firewall Threat Defense logs and identifies `FileEvent` events with a `SHA_Disposition` of "Malware" and `FileDirection` set to "Download". If ten or more such events occur from the same host within five minutes, this analytic will trigger. This activity may indicate the host is compromised and repeatedly retrieving malicious content either due to command-and-control, malware staging, or automation. If confirmed malicious, this behavior may represent an infection in progress, persistence mechanism, or a malicious downloader.
+description: The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. It leverages Cisco Secure Firewall Threat Defense logs and identifies `FileEvent` events with a `SHA_Disposition` of "Malware" and `FileDirection` set to "Download". If ten or more such events occur from the same host within five minutes, this analytic will trigger. This activity may indicate the host is compromised and repeatedly retrieving malicious content either due to command-and-control, malware staging, or automation. If confirmed malicious, this behavior may represent an infection in progress, persistence mechanism, or a malicious downloader.
 data_source:
     - Cisco Secure Firewall Threat Defense File Event
 search: |
@@ -30,15 +29,21 @@ search: |
     | `security_content_ctime(lastTime)`
     | table firstTime lastTime src dest dest_port FileDirection FileType Description uri file_name file_hash app ClientApplication ThreatName SHA_Disposition
     | `cisco_secure_firewall___repeated_malware_downloads_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The malware & file access policy must also enable logging.
+
+    The malware & file access policy must also enable logging.'
 known_false_positives: False positives should be minimal here, tuning may be required to exclude known test machines or development hosts.
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
@@ -50,7 +55,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -71,8 +76,8 @@ mitre_attack_id:
     - T1027
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml b/detections/network/cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml
index 5b606b2af36..af2e9d5b1e0 100644
--- a/detections/network/cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml
+++ b/detections/network/cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml
@@ -6,8 +6,7 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. It leverages Cisco Secure Firewall Threat Defense logs and focuses on the IntrusionEvent event type to detect activity that may indicate broad targeting or mass exploitation attempts. This behavior is often associated with opportunistic scanning, worm propagation, or automated exploitation of known vulnerabilities across multiple systems. If confirmed malicious, this could represent the early phase of a coordinated attack aiming to gain a foothold on several hosts or move laterally across the environment.
+description: This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. It leverages Cisco Secure Firewall Threat Defense logs and focuses on the IntrusionEvent event type to detect activity that may indicate broad targeting or mass exploitation attempts. This behavior is often associated with opportunistic scanning, worm propagation, or automated exploitation of known vulnerabilities across multiple systems. If confirmed malicious, this could represent the early phase of a coordinated attack aiming to gain a foothold on several hosts or move laterally across the environment.
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
@@ -25,15 +24,21 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The intrusion access policy must also be configured.
+
+    The intrusion access policy must also be configured.'
 known_false_positives: False positives should be minimal. Simultaneous vulnerability scanning across multiple internal hosts might trigger this, as well as some snort rules that are noisy. Disable those if necessary or increase the threshold.
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
@@ -45,7 +50,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$signature_id$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$signature_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -63,8 +68,8 @@ mitre_attack_id:
     - T1027
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___ssh_connection_to_non_standard_port.yml b/detections/network/cisco_secure_firewall___ssh_connection_to_non_standard_port.yml
index 54bfe78c28e..56b9d719820 100644
--- a/detections/network/cisco_secure_firewall___ssh_connection_to_non_standard_port.yml
+++ b/detections/network/cisco_secure_firewall___ssh_connection_to_non_standard_port.yml
@@ -6,45 +6,29 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects inbound SSH connections to non-standard ports on network devices using Cisco Secure Firewall Intrusion Events. APT actors have been observed enabling SSH servers on high, non-default TCP ports to maintain encrypted remote access to compromised network infrastructure.
-    This detection leverages Snort signature 65369 to identify SSH protocol traffic on unusual ports, which may indicate persistence mechanisms or backdoor access established by threat actors.
+description: 'This analytic detects inbound SSH connections to non-standard ports on network devices using Cisco Secure Firewall Intrusion Events. APT actors have been observed enabling SSH servers on high, non-default TCP ports to maintain encrypted remote access to compromised network infrastructure.
+
+    This detection leverages Snort signature 65369 to identify SSH protocol traffic on unusual ports, which may indicate persistence mechanisms or backdoor access established by threat actors.'
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
-    `cisco_secure_firewall`
-    EventType=IntrusionEvent
-    signature_id=65369
-    | fillnull
-    | stats dc(signature_id) as unique_signature_count
-            values(signature_id) as signature_id
-            values(signature) as signature
-            values(class_desc) as class_desc
-            values(MitreAttackGroups) as MitreAttackGroups
-            values(InlineResult) as InlineResult
-            values(InlineResultReason) as InlineResultReason
-            values(src) as src
-            values(dest_port) as dest_port
-            values(rule) as rule
-            values(transport) as transport
-            values(app) as app
-            min(_time) as firstTime
-            max(_time) as lastTime
-            by dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___ssh_connection_to_non_standard_port_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` signature_id="65369" | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port signature signature_id rule transport app | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___ssh_connection_to_non_standard_port_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The malware & file access policy must also enable logging.
-known_false_positives: |
-    No false positives have been identified yet.
+
+    The malware & file access policy must also enable logging.'
+known_false_positives: No false positives have been identified yet.
 references:
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
 drilldown_searches:
@@ -55,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/network/cisco_secure_firewall___ssh_connection_to_sshd_operns.yml b/detections/network/cisco_secure_firewall___ssh_connection_to_sshd_operns.yml
index cd8bebc0e53..77c1fdbb823 100644
--- a/detections/network/cisco_secure_firewall___ssh_connection_to_sshd_operns.yml
+++ b/detections/network/cisco_secure_firewall___ssh_connection_to_sshd_operns.yml
@@ -6,46 +6,31 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    This analytic detects inbound SSH connections to the sshd_operns service on network devices using Cisco Secure Firewall Intrusion Events.
+description: 'This analytic detects inbound SSH connections to the sshd_operns service on network devices using Cisco Secure Firewall Intrusion Events.
+
     APT actors have been observed enabling sshd_operns and opening it on non-standard ports to maintain encrypted remote access to compromised network infrastructure.
-    This detection leverages Snort signature 65368 to identify connections to this service, which when combined with other indicators may signal persistent access mechanisms established by threat actors.
+
+    This detection leverages Snort signature 65368 to identify connections to this service, which when combined with other indicators may signal persistent access mechanisms established by threat actors.'
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
-    `cisco_secure_firewall`
-    EventType=IntrusionEvent
-    signature_id=65368
-    | fillnull
-    | stats dc(signature_id) as unique_signature_count
-            values(signature_id) as signature_id
-            values(signature) as signature
-            values(class_desc) as class_desc
-            values(MitreAttackGroups) as MitreAttackGroups
-            values(InlineResult) as InlineResult
-            values(InlineResultReason) as InlineResultReason
-            values(src) as src
-            values(dest_port) as dest_port
-            values(rule) as rule
-            values(transport) as transport
-            values(app) as app
-            min(_time) as firstTime
-            max(_time) as lastTime
-            by dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___ssh_connection_to_sshd_operns_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` signature_id="65368" | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port signature signature_id rule transport app | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___ssh_connection_to_sshd_operns_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The malware & file access policy must also enable logging.
-known_false_positives: |
-    No false positives have been identified yet.
+
+    The malware & file access policy must also enable logging.'
+known_false_positives: No false positives have been identified yet.
 references:
     - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
 drilldown_searches:
@@ -56,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/network/cisco_secure_firewall___static_tundra_smart_install_abuse.yml b/detections/network/cisco_secure_firewall___static_tundra_smart_install_abuse.yml
index 7079b625eb0..87fb4c1c43f 100644
--- a/detections/network/cisco_secure_firewall___static_tundra_smart_install_abuse.yml
+++ b/detections/network/cisco_secure_firewall___static_tundra_smart_install_abuse.yml
@@ -6,12 +6,15 @@ modification_date: '2026-05-13'
 author: Bhavin Patel, Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    This analytic detects activity associated with "Static Tundra" threat actor abuse of the Cisco Smart Install (SMI) protocol
+description: 'This analytic detects activity associated with "Static Tundra" threat actor abuse of the Cisco Smart Install (SMI) protocol
+
     using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to
+
     identify occurrences of Smart Install exploitation and protocol abuse, including denial-of-service and buffer overflow
+
     attempts. The detection triggers when multiple Cisco Smart Install-related Snort signatures are observed in a short period from the
-    same source, which is indicative of active exploitation or reconnaissance against Cisco devices that expose SMI.
+
+    same source, which is indicative of active exploitation or reconnaissance against Cisco devices that expose SMI.'
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
@@ -37,14 +40,16 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_secure_firewall___static_tundra_smart_install_abuse_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense logs with IntrusionEvent data. It uses the `cisco_secure_firewall`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense logs with IntrusionEvent data. It uses the `cisco_secure_firewall`
+
     input macro; configure it to match your environment (index, source, sourcetype). Ensure your intrusion policies include the
+
     relevant Smart Install signatures and that events are collected via the Splunk Add-on for Cisco Security Cloud
-    (https://splunkbase.splunk.com/app/7404). The post-filter macro helps reduce known noise.
-known_false_positives: |
-    Network scanning or testing tools that probe Cisco Smart Install endpoints may trigger similar signatures.
-    Validate against maintenance windows or approved security assessments.
+
+    (https://splunkbase.splunk.com/app/7404). The post-filter macro helps reduce known noise.'
+known_false_positives: 'Network scanning or testing tools that probe Cisco Smart Install endpoints may trigger similar signatures.
+
+    Validate against maintenance windows or approved security assessments.'
 references:
     - https://blog.talosintelligence.com/static-tundra/
     - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
@@ -56,7 +61,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Smart Install exploitation or protocol abuse targeting $dest$ originating from $src$
     entity:
@@ -78,8 +83,8 @@ mitre_attack_id:
     - T1499
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___veeam_cve_2023_27532_exploitation_activity.yml b/detections/network/cisco_secure_firewall___veeam_cve_2023_27532_exploitation_activity.yml
index d2245e5355b..a707b954ebf 100644
--- a/detections/network/cisco_secure_firewall___veeam_cve_2023_27532_exploitation_activity.yml
+++ b/detections/network/cisco_secure_firewall___veeam_cve_2023_27532_exploitation_activity.yml
@@ -6,11 +6,13 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk, Talos NTDR
 status: production
 type: TTP
-description: |
-    This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events.
+description: 'This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events.
+
     It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signature 61514 (Veeam Backup and Replication credential dump attempt)
+
     is followed within a 5-minute window by 64795 (Veeam Backup and Replication xp_cmdshell invocation attempt), which detects the use of `xp_cmdshell`, a common post-exploitation technique.
-    If confirmed malicious, this behavior is highly indicative of a successful exploitation of CVE-2023-27532, followed by remote command execution or credential dumping.
+
+    If confirmed malicious, this behavior is highly indicative of a successful exploitation of CVE-2023-27532, followed by remote command execution or credential dumping.'
 data_source:
     - Cisco Secure Firewall Threat Defense Intrusion Event
 search: |
@@ -36,15 +38,21 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `cisco_secure_firewall___veeam_cve_2023_27532_exploitation_activity_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The intrusion access policy must also be configured.
+
+    The intrusion access policy must also be configured.'
 known_false_positives: False positives should be very unlikely.
 references:
     - https://nvd.nist.gov/vuln/detail/CVE-2023-27532
@@ -57,7 +65,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Exploitation attempt of Veeam CVE-2023-27532 on host $dest$ by $src$.
     entity:
@@ -79,8 +87,8 @@ mitre_attack_id:
     - T1003.001
 product:
     - Splunk Enterprise
-    - Splunk Cloud
     - Splunk Enterprise Security
+    - Splunk Cloud
 category: network
 security_domain: network
 tests:
diff --git a/detections/network/cisco_secure_firewall___wget_or_curl_download.yml b/detections/network/cisco_secure_firewall___wget_or_curl_download.yml
index d6511795999..adba5c28328 100644
--- a/detections/network/cisco_secure_firewall___wget_or_curl_download.yml
+++ b/detections/network/cisco_secure_firewall___wget_or_curl_download.yml
@@ -6,37 +6,31 @@ modification_date: '2026-05-13'
 author: Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects outbound connections initiated by command-line tools such as curl or wget. It leverages Cisco Secure Firewall Threat Defense logs and identifies allowed connections (action=Allow) where either the EVE_Process or ClientApplication fields indicate use of these utilities. While curl and wget are legitimate tools commonly used for software updates and scripting, adversaries often abuse them to download payloads, retrieve additional tools, or establish staging infrastructure from compromised systems. If confirmed malicious, this behavior may indicate the download phase of an attack chain or a command-and-control utility retrieval.
+description: The following analytic detects outbound connections initiated by command-line tools such as curl or wget. It leverages Cisco Secure Firewall Threat Defense logs and identifies allowed connections (action=Allow) where either the EVE_Process or ClientApplication fields indicate use of these utilities. While curl and wget are legitimate tools commonly used for software updates and scripting, adversaries often abuse them to download payloads, retrieve additional tools, or establish staging infrastructure from compromised systems. If confirmed malicious, this behavior may indicate the download phase of an attack chain or a command-and-control utility retrieval.
 data_source:
     - Cisco Secure Firewall Threat Defense Connection Event
 search: |
-    `cisco_secure_firewall` EventType=ConnectionEvent action IN ("Trust", "Allow", "allowed") AND
-    ( EVE_Process IN ("*curl*", "*wget*") OR ClientApplication IN ("cURL", "Wget") )
-    | stats count min(_time) as firstTime max(_time) as lastTime
-        Values(rule) as rule
-        Values(url) as url
-        Values(dest_port) as dest_port
-        Values(ClientApplicationVersion) as ClientApplicationVersion
-        Values(src_port) as src_port
-        by src, dest, transport, EVE_Process, ClientApplication, action
-    | table src src_port dest dest_port transport url EVE_Process ClientApplication ClientApplicationVersion rule firstTime lastTime
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_secure_firewall___wget_or_curl_download_filter`
-how_to_implement: |
-    This search requires Cisco Secure Firewall Threat Defense Logs, which
+    `cisco_secure_firewall` action IN ("Trust", "Allow", "allowed") EVE_Process IN ("*curl*", "*wget*") OR ClientApplication IN ("cURL", "Wget") | eval EVE_Process=EVE_Process, Potentially_Exfiltrated=initiator_mb | stats count min(_time) as firstTime max(_time) as lastTime by src dest dest_port transport rule action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___wget_or_curl_download_filter`
+how_to_implement: 'This search requires Cisco Secure Firewall Threat Defense Logs, which
+
     includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
+
     We strongly recommend that you specify your environment-specific configurations
+
     (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+
     with configurations for your Splunk environment. The search also uses a post-filter
+
     macro designed to filter out known false positives.
+
     The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
-    The access policy must also enable logging.
-known_false_positives: |
-    Developers, administrators, or automation tools may use `curl` or `wget` for legitimate purposes such as software installation, configuration scripts, or CI/CD tasks.
+
+    The access policy must also enable logging.'
+known_false_positives: 'Developers, administrators, or automation tools may use `curl` or `wget` for legitimate purposes such as software installation, configuration scripts, or CI/CD tasks.
+
     Security tools or health monitoring scripts may also use these utilities to check service availability or download updates.
-    Review the destination `url`, frequency, and process context to validate whether the download activity is authorized.
+
+    Review the destination `url`, frequency, and process context to validate whether the download activity is authorized.'
 references:
     - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
 drilldown_searches:
@@ -47,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/network/cisco_smart_install_oversized_packet_detection.yml b/detections/network/cisco_smart_install_oversized_packet_detection.yml
index ea991dbf57d..3f6bcd098d1 100644
--- a/detections/network/cisco_smart_install_oversized_packet_detection.yml
+++ b/detections/network/cisco_smart_install_oversized_packet_detection.yml
@@ -6,12 +6,15 @@ modification_date: '2026-05-13'
 author: Bhavin Patel, Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    This analytic detects oversized Cisco Smart Install (SMI) protocol messages by inspecting traffic to TCP port 4786
+description: 'This analytic detects oversized Cisco Smart Install (SMI) protocol messages by inspecting traffic to TCP port 4786
+
     within the Network_Traffic data model. Abnormally large SMI payloads have been associated with exploitation and
+
     protocol abuse (e.g., CVE-2018-0171; activity reported by the "Static Tundra" threat actor). Monitoring message
+
     sizes over time can help identify possible attempts at remote code execution, denial of service, or reconnaissance
-    against Cisco devices exposing Smart Install.
+
+    against Cisco devices exposing Smart Install.'
 data_source:
     - Splunk Stream TCP
 search: |
@@ -25,15 +28,18 @@ search: |
     | where max_bytes > 500
     | eval severity=case(max_bytes>1400, "critical", max_bytes>1000, "high", 1=1, "medium")
     | `cisco_smart_install_oversized_packet_detection_filter`
-how_to_implement: |
-    To implement this search, ingest network traffic into the Network_Traffic data model (e.g., via Splunk Stream with
+how_to_implement: 'To implement this search, ingest network traffic into the Network_Traffic data model (e.g., via Splunk Stream with
+
     sourcetype "stream:tcp"). The search analyzes TCP traffic to destination port 4786 (Cisco Smart Install) over hourly
+
     buckets, flags sessions with unusually large maximum bytes, and assigns a basic severity based on size thresholds.
+
     You may tune thresholds or restrict to perimeter-facing traffic. Consider blocking or disabling Smart Install where
-    not required.
-known_false_positives: |
-    Legitimate Smart Install operations (e.g., image/config transfers) can produce larger payloads. Baseline typical sizes
-    for your environment and allowlist known management stations when appropriate.
+
+    not required.'
+known_false_positives: 'Legitimate Smart Install operations (e.g., image/config transfers) can produce larger payloads. Baseline typical sizes
+
+    for your environment and allowlist known management stations when appropriate.'
 references:
     - https://blog.talosintelligence.com/static-tundra/
     - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
@@ -45,7 +51,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Buffer overflow attempt detected in Cisco Smart Install message to $dest_ip$ from $src_ip$
     entity:
@@ -72,6 +78,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/cisco/cisco_smart_install/stream_tcp.log
-          sourcetype: stream:tcp
           source: stream:tcp
+          sourcetype: stream:tcp
       test_type: unit
diff --git a/detections/network/cisco_smart_install_port_discovery_and_status.yml b/detections/network/cisco_smart_install_port_discovery_and_status.yml
index c436f00926e..ffc153c7528 100644
--- a/detections/network/cisco_smart_install_port_discovery_and_status.yml
+++ b/detections/network/cisco_smart_install_port_discovery_and_status.yml
@@ -9,7 +9,7 @@ type: TTP
 description: This analytic detects network traffic to TCP port 4786, which is used by the Cisco Smart Install protocol. Smart Install is a plug-and-play configuration and image-management feature that helps customers to deploy Cisco switches. This protocol has been exploited via CVE-2018-0171, a vulnerability that allows unauthenticated remote attackers to execute arbitrary code or cause denial of service conditions. Recently, Cisco Talos reported that a Russian state-sponsored threat actor called "Static Tundra" has been actively exploiting this vulnerability to compromise unpatched and end-of-life network devices. Monitoring for traffic to this port can help identify potential exploitation attempts or unauthorized Smart Install activity.
 data_source:
     - Splunk Stream TCP
-search: |-
+search: |
     | tstats `security_content_summariesonly` count values(All_Traffic.src_ip) as src_ip values(All_Traffic.src_port) as src_port values(All_Traffic.dest_ip) as dest_ip earliest(_time) as firstTime latest(_time) as lastTime FROM datamodel=Network_Traffic
       WHERE All_Traffic.dest_port=4786
         AND
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Detected network traffic to Cisco Smart Install port (4786) on $dest_ip$. Possible access to Cisco Smart Install.
     entity:
@@ -62,6 +62,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/cisco/cisco_smart_install/stream_tcp.log
-          sourcetype: stream:tcp
           source: stream:tcp
+          sourcetype: stream:tcp
       test_type: unit
diff --git a/detections/network/cisco_snmp_community_string_configuration_changes.yml b/detections/network/cisco_snmp_community_string_configuration_changes.yml
index f54e9cd18ec..86b86ea9218 100644
--- a/detections/network/cisco_snmp_community_string_configuration_changes.yml
+++ b/detections/network/cisco_snmp_community_string_configuration_changes.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This analytic detects changes to SNMP community strings on Cisco devices, which could indicate an attacker establishing persistence or attempting to extract credentials. After gaining initial access to network devices, threat actors like Static Tundra often modify SNMP configurations to enable unauthorized monitoring and data collection. This detection specifically looks for the configuration of SNMP community strings with read-write (rw) or read-only (ro) permissions, as well as the configuration of SNMP hosts that may be used to exfiltrate data. These activities are particularly concerning as they may represent attempts to establish persistent access or extract sensitive information from compromised devices.
 data_source:
     - Cisco IOS Logs
-search: |-
+search: |
     | tstats `security_content_summariesonly` count values(All_Changes.command) as command min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes
       WHERE (
             (All_Changes.command="*snmp-server community*rw*")
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -71,6 +71,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/cisco/cisco_smart_install/cisco_ios.log
-          sourcetype: cisco:ios
           source: cisco:ios
+          sourcetype: cisco:ios
       test_type: unit
diff --git a/detections/network/cisco_tftp_server_configuration_for_data_exfiltration.yml b/detections/network/cisco_tftp_server_configuration_for_data_exfiltration.yml
index f79cab942a8..6c3b092344a 100644
--- a/detections/network/cisco_tftp_server_configuration_for_data_exfiltration.yml
+++ b/detections/network/cisco_tftp_server_configuration_for_data_exfiltration.yml
@@ -9,7 +9,7 @@ type: TTP
 description: This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
 data_source:
     - Cisco IOS Logs
-search: |-
+search: |
     | tstats `security_content_summariesonly` count values(All_Changes.command) as command min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes
       WHERE (
             All_Changes.command="*tftp-server*"
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious TFTP server configuration detected on Cisco device $dest$ by user $user$, potentially exposing sensitive configuration files
     entity:
@@ -69,6 +69,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/cisco/cisco_smart_install/cisco_ios.log
-          sourcetype: cisco:ios
           source: cisco:ios
+          sourcetype: cisco:ios
       test_type: unit
diff --git a/detections/network/detect_arp_poisoning.yml b/detections/network/detect_arp_poisoning.yml
index 4704fa0bb92..932aea3f118 100644
--- a/detections/network/detect_arp_poisoning.yml
+++ b/detections/network/detect_arp_poisoning.yml
@@ -9,14 +9,8 @@ type: TTP
 description: The following analytic detects ARP Poisoning attacks by monitoring for Dynamic ARP Inspection (DAI) errors on Cisco network devices. It leverages logs from Cisco devices, specifically looking for events where the ARP inspection feature has disabled an interface due to suspicious activity. This activity is significant because ARP Poisoning can allow attackers to intercept, modify, or disrupt network traffic, leading to potential data breaches or denial of service. If confirmed malicious, this could enable attackers to perform man-in-the-middle attacks, compromising the integrity and confidentiality of network communications.
 data_source:
     - Cisco IOS Logs
-search: |-
-    `cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection"
-      | eval src_interface=src_int_prefix_long+src_int_suffix
-      | stats min(_time) AS firstTime max(_time) AS lastTime count
-        BY host src_interface
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `detect_arp_poisoning_filter`
+search: |
+    `cisco_ios` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection" | eval host=host | stats count min(_time) as firstTime max(_time) as lastTime by user dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_arp_poisoning_filter`
 how_to_implement: This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with DHCP Snooping (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) and Dynamic ARP Inspection (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-2_2_e/security/configuration_guide/b_sec_1522e_2960x_cg/b_sec_1522e_2960x_cg_chapter_01111.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.
 known_false_positives: This search might be prone to high false positives if DHCP Snooping or ARP inspection has been incorrectly configured, or if a device normally sends many ARP packets (unlikely).
 references: []
diff --git a/detections/network/detect_dns_query_to_decommissioned_s3_bucket.yml b/detections/network/detect_dns_query_to_decommissioned_s3_bucket.yml
index 7094a11cb2d..75bdd7991a5 100644
--- a/detections/network/detect_dns_query_to_decommissioned_s3_bucket.yml
+++ b/detections/network/detect_dns_query_to_decommissioned_s3_bucket.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This detection identifies DNS queries to domains that match previously decommissioned S3 buckets. This activity is significant because attackers may attempt to recreate deleted S3 buckets that were previously public to hijack them for malicious purposes. If successful, this could allow attackers to host malicious content or exfiltrate data through compromised bucket names that may still be referenced by legitimate applications.
 data_source:
     - Sysmon EventID 22
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Resolution
       WHERE DNS.message_type=QUERY
       BY DNS.answer DNS.answer_count DNS.query
@@ -61,12 +61,12 @@ tests:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/decommissioned_buckets/cloudtrail.json
           source: cloudtrail
           sourcetype: aws:cloudtrail
-      test_type: experimental
       description: This test is a legacy experimental test and may not be accurate.
+      test_type: experimental
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/decommissioned_buckets/dns.log
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
-      test_type: experimental
       description: This test is a legacy experimental test and may not be accurate.
+      test_type: experimental
diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml
index c3a4f069d99..8b5a53a236d 100644
--- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml
+++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml
@@ -23,7 +23,7 @@ search: |
     | eval isDynDNS = coalesce(isDynDNS_local,isDynDNS_default)
     |fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
     | `detect_hosts_connecting_to_dynamic_domain_providers_filter`
-how_to_implement: "First, you'll need to ingest data from your DNS operations. This can be done by ingesting logs from your server or data, collected passively by Splunk Stream or a similar solution. Specifically, data that contains the domain that is being queried and the IP of the host originating the request must be populating the `Network_Resolution` data model. This search also leverages a lookup file, `dynamic_dns_providers_default.csv`, which contains a non-exhaustive list of Dynamic DNS providers. Please consider updating the local lookup periodically by adding new domains to the list of `dynamic_dns_providers_local.csv`.\n This search produces fields (query, answer, isDynDNS) that are not yet supported by Mission Control Queue and therefore cannot be viewed when a finding is raised. These fields contribute additional context to the finding. To see the additional metadata, add the following fields, if not already present, to Mission Control Queue. Event Attributes (Configure > Findings and Investigations > Add New field):\n* **Label:** DNS Query, **Field:** query\n* **Label:** DNS Answer, **Field:** answer\n* **Label:** IsDynamicDNS, **Field:** isDynDNS\n"
+how_to_implement: "First, you'll need to ingest data from your DNS operations. This can be done by ingesting logs from your server or data, collected passively by Splunk Stream or a similar solution. Specifically, data that contains the domain that is being queried and the IP of the host originating the request must be populating the `Network_Resolution` data model. This search also leverages a lookup file, `dynamic_dns_providers_default.csv`, which contains a non-exhaustive list of Dynamic DNS providers. Please consider updating the local lookup periodically by adding new domains to the list of `dynamic_dns_providers_local.csv`.\n This search produces fields (query, answer, isDynDNS) that are not yet supported by Mission Control Queue and therefore cannot be viewed when a finding is raised. These fields contribute additional context to the finding. To see the additional metadata, add the following fields, if not already present, to Mission Control Queue. Event Attributes (Configure > Findings and Investigations > Add New field):\n* **Label:** DNS Query, **Field:** query\n* **Label:** DNS Answer, **Field:** answer\n* **Label:** IsDynamicDNS, **Field:** isDynDNS"
 known_false_positives: Some users and applications may leverage Dynamic DNS to reach out to some domains on the Internet since dynamic DNS by itself is not malicious, however this activity must be verified.
 references: []
 drilldown_searches:
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A dns query $query$ from your infra connecting to suspicious domain
     entity:
diff --git a/detections/network/detect_ipv6_network_infrastructure_threats.yml b/detections/network/detect_ipv6_network_infrastructure_threats.yml
index 6b0509d80c9..d4082a2b09a 100644
--- a/detections/network/detect_ipv6_network_infrastructure_threats.yml
+++ b/detections/network/detect_ipv6_network_infrastructure_threats.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects IPv6 network infrastructure threats by identifying suspicious activities such as IP and MAC address theft or packet drops. It leverages logs from Cisco network devices configured with First Hop Security measures like RA Guard and DHCP Guard. This activity is significant as it can indicate attempts to compromise network integrity and security. If confirmed malicious, attackers could manipulate network traffic, leading to potential data interception, unauthorized access, or network disruption.
 data_source:
     - Cisco IOS Logs
-search: |-
-    `cisco_networks` facility="SISF" mnemonic IN ("IP_THEFT","MAC_THEFT","MAC_AND_IP_THEFT","PAK_DROP")
-      | eval src_interface=src_int_prefix_long+src_int_suffix
-      | eval dest_interface=dest_int_prefix_long+dest_int_suffix
-      | stats min(_time) AS firstTime max(_time) AS lastTime values(src_mac) AS src_mac values(src_vlan) AS src_vlan values(mnemonic) AS mnemonic values(vendor_explanation) AS vendor_explanation values(src_ip) AS src_ip values(dest_ip) AS dest_ip values(dest_interface) AS dest_interface values(action) AS action count
-        BY host src_interface
-      | table host src_interface dest_interface src_mac src_ip dest_ip src_vlan mnemonic vendor_explanation action count
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `detect_ipv6_network_infrastructure_threats_filter`
+search: |
+    `cisco_ios` facility="SISF" mnemonic IN ("IP_THEFT", "MAC_THEFT", "MAC_AND_IP_THEFT", "PAK_DROP") | eval host=host | stats count min(_time) as firstTime max(_time) as lastTime by user dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_ipv6_network_infrastructure_threats_filter`
 how_to_implement: This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with one or more First Hop Security measures such as RA Guard, DHCP Guard and/or device tracking. See References for more information. The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.
 known_false_positives: No false positives have been identified at this time.
 references:
diff --git a/detections/network/detect_outbound_ldap_traffic.yml b/detections/network/detect_outbound_ldap_traffic.yml
index 2f68051ffff..7e15eadf611 100644
--- a/detections/network/detect_outbound_ldap_traffic.yml
+++ b/detections/network/detect_outbound_ldap_traffic.yml
@@ -11,35 +11,10 @@ data_source:
     - Palo Alto Network Traffic
     - Cisco Secure Firewall Threat Defense Connection Event
     - Cisco Secure Access Firewall
-search: |-
-    | tstats `security_content_summariesonly`
-             count min(_time) as firstTime
-                   max(_time) as lastTime
-                   values(All_Traffic.dest_ip) as dest_ip
-    FROM datamodel=Network_Traffic.All_Traffic WHERE
-
-    All_Traffic.dest_port IN (
-        389,
-        636
-    )
-    NOT ( All_Traffic.dest_ip IN `non_public_ip_blocks`
-    OR All_Traffic.dest IN `non_public_ip_blocks`
-    )
-    by All_Traffic.action All_Traffic.app All_Traffic.bytes
-       All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest
-       All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc
-       All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src
-       All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport
-       All_Traffic.user All_Traffic.vendor_product All_Traffic.rule
-    | `drop_dm_object_name("All_Traffic")`
-    | where src_ip != dest_ip OR src != dest
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `detect_outbound_ldap_traffic_filter`
-how_to_implement: |
-    In order to properly run this search, Splunk needs to ingest data from Next Generation Firewalls like, Cisco Secure Firewall Threat Defense, Palo Alto Networks Firewalls or other network control devices that mediate the traffic allowed into an environment. The search requires the Network_Traffic data model to be populated.
-known_false_positives: |
-    No false positives have been identified at this time. allowed outbound through your perimeter firewall. Please check those servers to verify if the activity is legitimate.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=All_Traffic where All_Traffic.dest_port IN ("389", "636") NOT (All_Traffic.dest_ip IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10", "127.0.0.0/8", "::1", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "198.51.100.0/24", "203.0.113.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "192.175.48.0/24", "198.18.0.0/15", "224.0.0.0/4", "240.0.0.0/4")) by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product | `drop_dm_object_name(All_Traffic)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_outbound_ldap_traffic_filter`
+how_to_implement: In order to properly run this search, Splunk needs to ingest data from Next Generation Firewalls like, Cisco Secure Firewall Threat Defense, Palo Alto Networks Firewalls or other network control devices that mediate the traffic allowed into an environment. The search requires the Network_Traffic data model to be populated.
+known_false_positives: No false positives have been identified at this time. allowed outbound through your perimeter firewall. Please check those servers to verify if the activity is legitimate.
 references:
     - https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
 analytic_story:
@@ -62,8 +37,8 @@ tests:
     - name: Palo Alto True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log
-          sourcetype: pan:traffic
           source: not_applicable
+          sourcetype: pan:traffic
       test_type: unit
     - name: Cisco Secure Firewall True Positive Test
       attack_data:
diff --git a/detections/network/detect_outbound_smb_traffic.yml b/detections/network/detect_outbound_smb_traffic.yml
index 5d2609bc23f..90cf12aa89d 100644
--- a/detections/network/detect_outbound_smb_traffic.yml
+++ b/detections/network/detect_outbound_smb_traffic.yml
@@ -44,7 +44,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An outbound SMB connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$
     entity:
diff --git a/detections/network/detect_port_security_violation.yml b/detections/network/detect_port_security_violation.yml
index fc0caff3b66..8f15b0ba9ad 100644
--- a/detections/network/detect_port_security_violation.yml
+++ b/detections/network/detect_port_security_violation.yml
@@ -9,14 +9,8 @@ type: TTP
 description: The following analytic detects port security violations on Cisco switches. It leverages logs from Cisco network devices, specifically looking for events with mnemonics indicating port security violations. This activity is significant because it indicates an unauthorized device attempting to connect to a secured port, potentially bypassing network access controls. If confirmed malicious, this could allow an attacker to gain unauthorized access to the network, leading to data exfiltration, network disruption, or further lateral movement within the environment.
 data_source:
     - Cisco IOS Logs
-search: |-
-    `cisco_networks` (facility="PM" mnemonic="ERR_DISABLE" disable_cause="psecure-violation") OR (facility="PORT_SECURITY" mnemonic="PSECURE_VIOLATION" OR mnemonic="PSECURE_VIOLATION_VLAN")
-      | eval src_interface=src_int_prefix_long+src_int_suffix
-      | stats min(_time) AS firstTime max(_time) AS lastTime values(disable_cause) AS disable_cause values(src_mac) AS src_mac values(src_vlan) AS src_vlan values(action) AS action count
-        BY host src_interface
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `detect_port_security_violation_filter`
+search: |
+    `cisco_ios` (facility="PM" mnemonic="ERR_DISABLE" disable_cause="psecure-violation") OR (facility="PORT_SECURITY" mnemonic="PSECURE_VIOLATION") OR mnemonic="PSECURE_VIOLATION_VLAN" | eval host=host | stats count min(_time) as firstTime max(_time) as lastTime by user dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_port_security_violation_filter`
 how_to_implement: This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with Port Security and Error Disable for this to work (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.
 known_false_positives: This search might be prone to high false positives if you have malfunctioning devices connected to your ethernet ports or if end users periodically connect physical devices to the network.
 references: []
diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml
index dc927f67a6f..5e8da0a51af 100644
--- a/detections/network/detect_remote_access_software_usage_dns.yml
+++ b/detections/network/detect_remote_access_software_usage_dns.yml
@@ -42,7 +42,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate traffic to $query$
       search: '| from datamodel:Network_Resolution.DNS | search src=$src$ query=$query$'
       earliest_offset: $info_min_time$
diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml
index f0883920752..9ba26d5af6d 100644
--- a/detections/network/detect_remote_access_software_usage_traffic.yml
+++ b/detections/network/detect_remote_access_software_usage_traffic.yml
@@ -6,10 +6,11 @@ modification_date: '2026-09-22'
 author: Steven Dick
 status: production
 type: Anomaly
-description: |
-    The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
+description: 'The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
+
     It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.
-    If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
+
+    If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization''s security.'
 data_source:
     - Palo Alto Network Traffic
 search: |
@@ -49,7 +50,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate application traffic for $app$
       search: '| from datamodel:Network_Traffic.All_Traffic | search src=$src$ app=$app$'
       earliest_offset: $info_min_time$
diff --git a/detections/network/detect_rogue_dhcp_server.yml b/detections/network/detect_rogue_dhcp_server.yml
index f24a1d281b9..a395271228c 100644
--- a/detections/network/detect_rogue_dhcp_server.yml
+++ b/detections/network/detect_rogue_dhcp_server.yml
@@ -9,13 +9,8 @@ type: TTP
 description: The following analytic identifies the presence of unauthorized DHCP servers on the network. It leverages logs from Cisco network devices with DHCP Snooping enabled, specifically looking for events where DHCP leases are issued from untrusted ports. This activity is significant because rogue DHCP servers can facilitate Man-in-the-Middle attacks, leading to potential data interception and network disruption. If confirmed malicious, this could allow attackers to redirect network traffic, capture sensitive information, and compromise the integrity of the network.
 data_source:
     - Cisco IOS Logs
-search: |-
-    `cisco_networks` facility="DHCP_SNOOPING" mnemonic="DHCP_SNOOPING_UNTRUSTED_PORT"
-      | stats min(_time) AS firstTime max(_time) AS lastTime count values(message_type) AS message_type values(src_mac) AS src_mac
-        BY host
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `detect_rogue_dhcp_server_filter`
+search: |
+    `cisco_ios` facility="DHCP_SNOOPING" mnemonic="DHCP_SNOOPING_UNTRUSTED_PORT" | eval host=host | stats count min(_time) as firstTime max(_time) as lastTime by user dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rogue_dhcp_server_filter`
 how_to_implement: This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with DHCP Snooping enabled (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.
 known_false_positives: This search might be prone to high false positives if DHCP Snooping has been incorrectly configured or in the unlikely event that the DHCP server has been moved to another network interface.
 references: []
diff --git a/detections/network/detect_snicat_sni_exfiltration.yml b/detections/network/detect_snicat_sni_exfiltration.yml
index 847d2be1e16..356def00ad8 100644
--- a/detections/network/detect_snicat_sni_exfiltration.yml
+++ b/detections/network/detect_snicat_sni_exfiltration.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic identifies the use of SNICat tool commands within the TLS SNI field, indicating potential data exfiltration attempts. It leverages Zeek SSL data to detect specific SNICat commands such as LIST, LS, SIZE, LD, CB, EX, ALIVE, EXIT, WHERE, and finito in the server_name field. This activity is significant as SNICat is a known tool for covert data exfiltration using TLS. If confirmed malicious, this could allow attackers to exfiltrate sensitive data undetected, posing a severe threat to data confidentiality and integrity.
 data_source: []
-search: |-
+search: |
     `zeek_ssl`
     | rex field=server_name "(?<snicat>(LIST|LS|SIZE|LD|CB|CD|EX|ALIVE|EXIT|WHERE|finito)-[A-Za-z0-9]{16}\.)"
     | stats count BY src_ip dest_ip server_name snicat
diff --git a/detections/network/detect_software_download_to_network_device.yml b/detections/network/detect_software_download_to_network_device.yml
index c9a46bf7cc2..d1916edaf2e 100644
--- a/detections/network/detect_software_download_to_network_device.yml
+++ b/detections/network/detect_software_download_to_network_device.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic identifies unauthorized software downloads to network devices via TFTP, FTP, or SSH/SCP. It detects this activity by analyzing network traffic events on specific ports (69, 21, 22) from devices categorized as network, router, or switch. This activity is significant because adversaries may exploit netbooting to load unauthorized operating systems, potentially compromising network integrity. If confirmed malicious, this could lead to unauthorized control over network devices, enabling further attacks, data exfiltration, or persistent access within the network.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic
       WHERE (
             All_Traffic.transport=udp
diff --git a/detections/network/detect_traffic_mirroring.yml b/detections/network/detect_traffic_mirroring.yml
index 064bd8e7826..874f07b4812 100644
--- a/detections/network/detect_traffic_mirroring.yml
+++ b/detections/network/detect_traffic_mirroring.yml
@@ -9,13 +9,8 @@ type: TTP
 description: The following analytic detects the initiation of traffic mirroring sessions on Cisco network devices. It leverages logs with specific mnemonics and facilities related to traffic mirroring, such as "ETH_SPAN_SESSION_UP" and "PKTCAP_START." This activity is significant because adversaries may use traffic mirroring to exfiltrate data by duplicating and forwarding network traffic to an external destination. If confirmed malicious, this could allow attackers to capture sensitive information, monitor network communications, and potentially compromise the integrity and confidentiality of the network.
 data_source:
     - Cisco IOS Logs
-search: |-
-    `cisco_networks` (facility="MIRROR" mnemonic="ETH_SPAN_SESSION_UP") OR (facility="SPAN" mnemonic="SESSION_UP") OR (facility="SPAN" mnemonic="PKTCAP_START") OR (mnemonic="CFGLOG_LOGGEDCMD" command="monitor session*")
-      | stats min(_time) AS firstTime max(_time) AS lastTime count
-        BY host facility mnemonic
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `detect_traffic_mirroring_filter`
+search: |
+    `cisco_ios` (facility="MIRROR" mnemonic="ETH_SPAN_SESSION_UP") OR (facility="SPAN" mnemonic="SESSION_UP") OR (facility="SPAN" mnemonic="PKTCAP_START") OR (mnemonic="CFGLOG_LOGGEDCMD" command="monitor session*") | eval host=host | stats count min(_time) as firstTime max(_time) as lastTime by user dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_traffic_mirroring_filter`
 how_to_implement: This search uses a standard SPL query on logs from Cisco Network devices. The network devices must log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices and that the devices have been configured according to the documentation of the Cisco Networks Add-on. Also note that an attacker may disable logging from the device prior to enabling traffic mirroring.
 known_false_positives: This search will return false positives for any legitimate traffic captures by network administrators.
 references: []
diff --git a/detections/network/detect_unauthorized_assets_by_mac_address.yml b/detections/network/detect_unauthorized_assets_by_mac_address.yml
index 0b29328bdd5..6f07cb33b4c 100644
--- a/detections/network/detect_unauthorized_assets_by_mac_address.yml
+++ b/detections/network/detect_unauthorized_assets_by_mac_address.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic identifies unauthorized devices attempting to connect to the organization's network by inspecting DHCP request packets. It detects this activity by comparing the MAC addresses in DHCP requests against a list of known authorized devices stored in the assets_by_str.csv file. This activity is significant for a SOC because unauthorized devices can pose security risks, including potential data breaches or network disruptions. If confirmed malicious, this activity could allow an attacker to gain unauthorized network access, potentially leading to further exploitation or data exfiltration.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` count FROM datamodel=Network_Sessions
       WHERE nodename=All_Sessions.DHCP All_Sessions.tag=dhcp
       BY All_Sessions.dest_ip All_Sessions.dest_mac
diff --git a/detections/network/detect_zerologon_via_zeek.yml b/detections/network/detect_zerologon_via_zeek.yml
index 78bab2ceb0a..57ddc795d3d 100644
--- a/detections/network/detect_zerologon_via_zeek.yml
+++ b/detections/network/detect_zerologon_via_zeek.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: 'The following analytic detects attempts to exploit the Zerologon CVE-2020-1472 vulnerability via Zeek RPC. It leverages Zeek DCE-RPC data to identify specific operations: NetrServerPasswordSet2, NetrServerReqChallenge, and NetrServerAuthenticate3. This activity is significant because it indicates an attempt to gain unauthorized access to a domain controller, potentially leading to a complete takeover of an organization''s IT infrastructure. If confirmed malicious, the impact could be severe, including data theft, ransomware deployment, or other devastating outcomes. Immediate investigation of the identified IP addresses and RPC operations is crucial.'
 data_source: []
-search: |-
+search: |
     `zeek_rpc` operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3)
       | bin span=5m _time
       | stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerReqChallenge")) as challenge count(eval(operation=="NetrServerAuthenticate3")) as authcount count(eval(operation=="NetrServerPasswordSet2")) as passcount count as totalcount
diff --git a/detections/network/dns_kerberos_coercion.yml b/detections/network/dns_kerberos_coercion.yml
index 3b6869045af..b71aa4e0662 100644
--- a/detections/network/dns_kerberos_coercion.yml
+++ b/detections/network/dns_kerberos_coercion.yml
@@ -10,17 +10,8 @@ description: Detects DNS-based Kerberos coercion attacks where adversaries injec
 data_source:
     - Suricata
     - Sysmon EventID 22
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(DNS.src) as src values(DNS.dest) as dest FROM datamodel=Network_Resolution
-      WHERE DNS.query="*1UWhRC*" DNS.query="*AAAAA*" DNS.query="*YBAAAA*"
-      BY DNS.answer DNS.answer_count DNS.query
-         DNS.query_count DNS.reply_code_id DNS.src
-         DNS.vendor_product
-    | `drop_dm_object_name(DNS)`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | table firstTime lastTime query count src dest
-    | `dns_kerberos_coercion_filter`
+search: |
+    `suricata` DNS.query="*1UWhRC*" DNS.query="*AAAAA*" DNS.query="*YBAAAA*" | eval process_name=process_name, dvc=dvc, dest=Computer, QueryName=QueryName | stats count min(_time) as firstTime max(_time) as lastTime by query src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dns_kerberos_coercion_filter`
 how_to_implement: To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.
 known_false_positives: It's unlikely that a DNS entry contains the specific structure used by this attack. Filter as needed for your organization.
 references:
@@ -35,16 +26,14 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A dns query $query$ with marshalled CREDENTIAL_TARGET_INFORMATION seen from $src$
     entity:
         field: src
         type: system
         score: 50
-threat_objects:
-    - field: query
-      type: dns_query
+threat_objects: []
 analytic_story:
     - Compromised Windows Host
     - Suspicious DNS Traffic
diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml
index dda634d4343..52e2ac3d5cc 100644
--- a/detections/network/dns_query_length_with_high_standard_deviation.yml
+++ b/detections/network/dns_query_length_with_high_standard_deviation.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies DNS queries with unusually large lengths by computing the standard deviation of query lengths and filtering those exceeding two times the standard deviation. It leverages DNS query data from the Network_Resolution data model, focusing on the length of the domain names being resolved. This activity is significant as unusually long DNS queries can indicate data exfiltration or command-and-control communication attempts. If confirmed malicious, this activity could allow attackers to stealthily transfer data or maintain persistent communication channels within the network.
 data_source:
     - Sysmon EventID 22
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Resolution
       WHERE NOT DNS.record_type IN ("Pointer","PTR","SOA", "SRV") DNS.query != *.
       BY DNS.answer DNS.answer_count DNS.query
@@ -41,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/network/excessive_dns_failures.yml b/detections/network/excessive_dns_failures.yml
index 055d0d1343d..bbad5f4cdf3 100644
--- a/detections/network/excessive_dns_failures.yml
+++ b/detections/network/excessive_dns_failures.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies excessive DNS query failures by counting DNS responses that do not indicate success, triggering when there are more than 50 occurrences. It leverages the Network_Resolution data model, focusing on DNS reply codes that signify errors. This activity is significant because a high number of DNS failures can indicate potential network misconfigurations, DNS poisoning attempts, or malware communication issues. If confirmed malicious, this activity could lead to disrupted network services, hindered communication, or data exfiltration attempts by attackers.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` count FROM datamodel=Network_Resolution
       WHERE nodename=DNS "DNS.reply_code"!="No Error" "DNS.reply_code"!="NoError" DNS.reply_code!="unknown" NOT "DNS.query"="*.arpa" "DNS.query"="*.*"
       BY "DNS.src" "DNS.query" "DNS.reply_code"
diff --git a/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml b/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml
index c055a4f48b8..3ef11a0497a 100644
--- a/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml
+++ b/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml
@@ -6,31 +6,19 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects attempts to exploit the F5 BIG-IP iControl REST API vulnerability (CVE-2022-1388) for unauthenticated remote code execution.
+description: 'The following analytic detects attempts to exploit the F5 BIG-IP iControl REST API vulnerability (CVE-2022-1388) for unauthenticated remote code execution.
+
     It identifies suspicious URI paths and POST HTTP methods, along with specific request headers containing potential commands in the `utilcmdargs` field and a random base64 encoded value in the `X-F5-Auth-Token` field.
+
     This activity is significant as it targets a critical vulnerability that can allow attackers to execute arbitrary commands on the affected system.
-    If confirmed malicious, this could lead to full system compromise and unauthorized access to sensitive data.
+
+    If confirmed malicious, this could lead to full system compromise and unauthorized access to sensitive data.'
 data_source:
     - Palo Alto Network Threat
-search: |-
-    | tstats `security_content_summariesonly`
-             count min(_time) as firstTime
-                   max(_time) as lastTime
-    FROM datamodel=Web WHERE
-    Web.url="*/mgmt/tm/util/bash*"
-    Web.http_method="POST"
-    BY Web.http_user_agent Web.http_method
-       Web.url Web.url_length
-       Web.src Web.dest
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388_filter`
-how_to_implement: |
-    To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
-known_false_positives: |
-    False positives may be present if the activity is blocked or was not successful. Filter known vulnerability scanners. Filter as needed.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/mgmt/tm/util/bash*" Web.http_method="POST" by Web.http_user_agent Web.http_method Web.url Web.url_length Web.src Web.dest | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
+known_false_positives: False positives may be present if the activity is blocked or was not successful. Filter known vulnerability scanners. Filter as needed.
 references:
     - https://github.com/dk4trin/templates-nuclei/blob/main/CVE-2022-1388.yaml
     - https://www.randori.com/blog/vulnerability-analysis-cve-2022-1388/
@@ -45,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An attempt to exploit CVE-2022-1388 against an F5 appliance $dest$ has occurred.
     entity:
diff --git a/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml b/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
index a3bb0c066f5..58632eed23c 100644
--- a/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
+++ b/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
@@ -6,8 +6,7 @@ modification_date: '2026-05-13'
 author: Bhavin Patel, Splunk
 status: experimental
 type: Anomaly
-description: |
-    The following analytic identifies hosts receiving an unusually high volume of network traffic from an email server. It leverages the Network_Traffic data model to sum incoming bytes to clients from email servers, comparing current traffic against historical averages and standard deviations. This activity is significant as it may indicate data exfiltration by a malicious actor using the email server. If confirmed malicious, this could lead to unauthorized data access and potential data breaches, compromising sensitive information and impacting organizational security.
+description: The following analytic identifies hosts receiving an unusually high volume of network traffic from an email server. It leverages the Network_Traffic data model to sum incoming bytes to clients from email servers, comparing current traffic against historical averages and standard deviations. This activity is significant as it may indicate data exfiltration by a malicious actor using the email server. If confirmed malicious, this could lead to unauthorized data access and potential data breaches, compromising sensitive information and impacting organizational security.
 data_source: []
 search: |
     | tstats `security_content_summariesonly` sum(All_Traffic.bytes_in) as bytes_in from datamodel=Network_Traffic where All_Traffic.dest_category=email_server by All_Traffic.src_ip _time span=1d | `drop_dm_object_name("All_Traffic")` | eventstats avg(bytes_in) as avg_bytes_in stdev(bytes_in) as stdev_bytes_in | eventstats count as num_data_samples avg(eval(if(_time < relative_time(now(), "@d"), bytes_in, null))) as per_source_avg_bytes_in stdev(eval(if(_time < relative_time(now(), "@d"), bytes_in, null))) as per_source_stdev_bytes_in by src_ip | eval minimum_data_samples = 4, deviation_threshold = 3
diff --git a/detections/network/http_c2_framework_user_agent.yml b/detections/network/http_c2_framework_user_agent.yml
index db8c77cf01a..21167f303e4 100644
--- a/detections/network/http_c2_framework_user_agent.yml
+++ b/detections/network/http_c2_framework_user_agent.yml
@@ -9,7 +9,7 @@ type: TTP
 description: This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of c2 frameworks. This activity can signify malicious actors attempting to interact with hosts on the network using known default configurations of command and control tools.
 data_source:
     - Suricata
-search: |-
+search: |
     | tstats  `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
       WHERE Web.http_user_agent != null
       BY Web.http_user_agent Web.http_method, Web.url,
@@ -37,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A known C2 Framework user agent $http_user_agent$ was performing a request from $src$ to $dest$.
     entity:
@@ -71,6 +71,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.001/http_user_agents/suricata_c2.log
-          sourcetype: suricata
           source: not_applicable
+          sourcetype: suricata
       test_type: unit
diff --git a/detections/network/http_malware_user_agent.yml b/detections/network/http_malware_user_agent.yml
index 5490fc528f5..3d8ecafe19e 100644
--- a/detections/network/http_malware_user_agent.yml
+++ b/detections/network/http_malware_user_agent.yml
@@ -9,7 +9,7 @@ type: TTP
 description: This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of malware. This activity can signify possible compromised hosts on the network.
 data_source:
     - Suricata
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
       WHERE Web.http_user_agent != null
       BY Web.http_user_agent Web.http_method, Web.url,
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A known malware user agent $http_user_agent$ was performing a request from $src$.
     entity:
@@ -65,6 +65,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.001/http_user_agents/suricata_malware.log
-          sourcetype: suricata
           source: not_applicable
+          sourcetype: suricata
       test_type: unit
diff --git a/detections/network/http_post_request_with_encoded_payload.yml b/detections/network/http_post_request_with_encoded_payload.yml
index f05fb1a082d..8f59c5eae1d 100644
--- a/detections/network/http_post_request_with_encoded_payload.yml
+++ b/detections/network/http_post_request_with_encoded_payload.yml
@@ -6,45 +6,23 @@ modification_date: '2026-10-12'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings.
+description: 'The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings.
+
     It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups.
-    This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads.
+
+    This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads.'
 data_source:
     - Zeek HTTP
-search: |-
-    `zeek_http`
-    method="POST"
-    post_body="*"
-
-    | eval dest_port=coalesce(dest_port, 'id.resp_p'),
-           dest=coalesce(dest, dest_ip, 'id.resp_h'),
-           src=coalesce(src, src_ip, 'id.orig_h')
-
-    | eval _hex=if(match(post_body, "(?:\\\\x[0-9a-fA-F]{2}){8,}|(?:%[0-9a-fA-F]{2}){8,}"), 1, 0)
-    | eval _b64=if(match(post_body, "(?:[A-Za-z0-9+/]{4}){16,}={0,2}"), 1, 0)
-
-    | where _hex=1 OR _b64=1
+search: |
+    `zeek_http` method="POST" post_body="*" | stats count min(_time) as firstTime max(_time) as lastTime by orig_h resp_h resp_p uri method status_code src encoding_type dest dest_port | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `http_post_request_with_encoded_payload_filter`
+how_to_implement: 'Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466).
 
-    | eval encoding_type=case(_hex=1 AND _b64=1, "Hexadecimal + Base64", _hex=1, "Hexadecimal", _b64=1, "Base64")
-
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-                  values(encoding_type) as encoding_type
-                  values(post_body) as post_body
+    The "post_body" field must be populated, which requires Zeek to be configured with the HTTP post body extraction policy.
 
-      by src dest dest_port uri method status_code
+    Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on.'
+known_false_positives: 'Legitimate applications may POST base64-encoded data, particularly APIs that transmit binary content.
 
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `http_post_request_with_encoded_payload_filter`
-how_to_implement: |-
-    Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466).
-    The "post_body" field must be populated, which requires Zeek to be configured with the HTTP post body extraction policy.
-    Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on.
-known_false_positives: |-
-    Legitimate applications may POST base64-encoded data, particularly APIs that transmit binary content.
-    Review the destination, URI, and post body content to confirm whether the activity is expected.
+    Review the destination, URI, and post body content to confirm whether the activity is expected.'
 references:
     - https://attack.mitre.org/techniques/T1071/001/
     - https://attack.mitre.org/techniques/T1132/001/
@@ -57,16 +35,14 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$id.orig_h$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
           type: system
           score: 20
           message: An HTTP POST request with an encoded body of type [$encoding_type$] was detected from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$].
-threat_objects:
-    - field: uri
-      type: uri
+threat_objects: []
 analytic_story:
     - Command And Control
     - Data Exfiltration
@@ -84,6 +60,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.001/zeek_http_encoded_post/http.log
-          sourcetype: zeek:http
           source: http.log
+          sourcetype: zeek:http
       test_type: unit
diff --git a/detections/network/http_pua_user_agent.yml b/detections/network/http_pua_user_agent.yml
index b05dd3386e3..b96add2bc9f 100644
--- a/detections/network/http_pua_user_agent.yml
+++ b/detections/network/http_pua_user_agent.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of unwanted applications. This activity can signify possible compromised hosts on the network.
 data_source:
     - Suricata
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
       WHERE Web.http_user_agent != null
       BY Web.http_user_agent Web.http_method, Web.url,
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -63,6 +63,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.001/http_user_agents/suricata_pua.log
-          sourcetype: suricata
           source: not_applicable
+          sourcetype: suricata
       test_type: unit
diff --git a/detections/network/http_rmm_user_agent.yml b/detections/network/http_rmm_user_agent.yml
index 1ad50d30cb3..5d36111e517 100644
--- a/detections/network/http_rmm_user_agent.yml
+++ b/detections/network/http_rmm_user_agent.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of Remote Monitoring and Mangement applications. This activity can signify possible compromised hosts on the network.
 data_source:
     - Suricata
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
       WHERE Web.http_user_agent != null
       BY Web.http_user_agent Web.http_method, Web.url,
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -62,6 +62,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.001/http_user_agents/suricata_rmm.log
-          sourcetype: suricata
           source: not_applicable
+          sourcetype: suricata
       test_type: unit
diff --git a/detections/network/internal_horizontal_port_scan.yml b/detections/network/internal_horizontal_port_scan.yml
index 96140adb60f..94766389593 100644
--- a/detections/network/internal_horizontal_port_scan.yml
+++ b/detections/network/internal_horizontal_port_scan.yml
@@ -10,7 +10,7 @@ description: This analytic identifies instances where an internal host has attem
 data_source:
     - AWS CloudWatchLogs VPCflow
     - Cisco Secure Firewall Threat Defense Connection Event
-search: |-
+search: |
     | tstats `security_content_summariesonly` values(All_Traffic.action) as action values(All_Traffic.src_category) as src_category values(All_Traffic.dest_zone) as dest_zone values(All_Traffic.src_zone) as src_zone values(All_Traffic.src_port) as src_port count FROM datamodel=Network_Traffic
       WHERE All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16")
       BY All_Traffic.src_ip All_Traffic.dest_port All_Traffic.dest_ip
@@ -39,7 +39,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $src_ip$ has scanned for ports $dest_ports$ across $totalDestIPCount$ destination IPs
     entity:
diff --git a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml
index 800abe5718a..3fc4042a05d 100644
--- a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml
+++ b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml
@@ -70,7 +70,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for $src_ip$
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($src_ip$) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $src_ip$ has scanned for ports $dest_ports$ across $totalDestIPCount$ destination IPs
     entity:
diff --git a/detections/network/internal_vertical_port_scan.yml b/detections/network/internal_vertical_port_scan.yml
index 381f606cbf8..e4659c12ad1 100644
--- a/detections/network/internal_vertical_port_scan.yml
+++ b/detections/network/internal_vertical_port_scan.yml
@@ -64,7 +64,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: $src_ip$ has scanned $totalDestPortCount$ ports on $dest_ip$
     entity:
diff --git a/detections/network/internal_vulnerability_scan.yml b/detections/network/internal_vulnerability_scan.yml
index 8cbd8f3f7fb..561eb6d7c3a 100644
--- a/detections/network/internal_vulnerability_scan.yml
+++ b/detections/network/internal_vulnerability_scan.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: This analytic detects internal hosts triggering multiple IDS signatures, which may include either more than 25 signatures against a single host or a single signature across over 25 destination IP addresses. Such patterns can indicate active vulnerability scanning activities within the network. By monitoring IDS logs, this detection helps identify and respond to potential vulnerability scanning attempts, enhancing the network's security posture and preventing potential exploits.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` values(IDS_Attacks.action) as action values(IDS_Attacks.src_category) as src_category values(IDS_Attacks.dest_category) as dest_category count FROM datamodel=Intrusion_Detection.IDS_Attacks
       WHERE IDS_Attacks.src IN (10.0.0.0/8,192.168.0.0/16,172.16.0.0/12) IDS_Attacks.severity IN (critical, high, medium)
       BY IDS_Attacks.src IDS_Attacks.severity IDS_Attacks.signature
diff --git a/detections/network/large_volume_of_dns_any_queries.yml b/detections/network/large_volume_of_dns_any_queries.yml
index 1ce1c9d257c..698e1c1fa5d 100644
--- a/detections/network/large_volume_of_dns_any_queries.yml
+++ b/detections/network/large_volume_of_dns_any_queries.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies a large volume of DNS ANY queries, which may indicate a DNS amplification attack. It leverages the Network_Resolution data model to count DNS queries of type "ANY" directed to specific destinations. This activity is significant because DNS amplification attacks can overwhelm network resources, leading to Denial of Service (DoS) conditions. If confirmed malicious, this activity could disrupt services, degrade network performance, and potentially be part of a larger Distributed Denial of Service (DDoS) attack, impacting the availability of critical infrastructure.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` count FROM datamodel=Network_Resolution
       WHERE nodename=DNS "DNS.message_type"="QUERY" "DNS.record_type"="ANY"
       BY "DNS.dest"
diff --git a/detections/network/ngrok_reverse_proxy_on_network.yml b/detections/network/ngrok_reverse_proxy_on_network.yml
index d5169ae7c1b..f2ecac98272 100644
--- a/detections/network/ngrok_reverse_proxy_on_network.yml
+++ b/detections/network/ngrok_reverse_proxy_on_network.yml
@@ -9,16 +9,8 @@ type: Anomaly
 description: The following analytic detects DNS queries to common Ngrok domains, indicating potential use of the Ngrok reverse proxy tool. It leverages the Network Resolution datamodel to identify queries to domains such as "*.ngrok.com" and "*.ngrok.io". While Ngrok usage is not inherently malicious, it has been increasingly adopted by adversaries for covert communication and data exfiltration. If confirmed malicious, this activity could allow attackers to bypass network defenses, establish persistent connections, and exfiltrate sensitive data, posing a significant threat to the network's security.
 data_source:
     - Sysmon EventID 22
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Resolution
-      WHERE DNS.query IN ("*.ngrok.com","*.ngrok.io", "ngrok.*.tunnel.com", "korgn.*.lennut.com")
-      BY DNS.answer DNS.answer_count DNS.query
-         DNS.query_count DNS.reply_code_id DNS.src
-         DNS.vendor_product
-    | `drop_dm_object_name("DNS")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `ngrok_reverse_proxy_on_network_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=DNS where DNS.query IN (".ngrok.com", ".ngrok.io", "ngrok.*.tunnel.com", "korgn.*.lennut.com") by DNS.answer DNS.answer_count DNS.query DNS.query_count DNS.reply_code_id DNS.src DNS.vendor_product | `drop_dm_object_name(DNS)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ngrok_reverse_proxy_on_network_filter`
 how_to_implement: The Network Resolution Datamodel will need to have data mapped to it regarding DNS queries. Modify query as needed to use another source.
 known_false_positives: False positives will be present based on organizations that allow the use of Ngrok. Filter or monitor as needed.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml
index d305d4f139f..d74f074fd7d 100644
--- a/detections/network/prohibited_network_traffic_allowed.yml
+++ b/detections/network/prohibited_network_traffic_allowed.yml
@@ -6,14 +6,16 @@ modification_date: '2026-09-22'
 author: Rico Valdez, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed.
+description: 'The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed.
+
     It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies.
+
     This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration.
-    If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture.
+
+    If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization''s security posture.'
 data_source:
     - Cisco Secure Firewall Threat Defense Connection Event
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -42,12 +44,12 @@ search: |-
     | `security_content_ctime(lastTime)`
     | `drop_dm_object_name("All_Traffic")`
     | `prohibited_network_traffic_allowed_filter`
-how_to_implement: |-
-    In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment.
-    This is necessary so that the search can identify an 'action' taken on the traffic of interest.
-    The search also requires the Network_Traffic data model be populated.
-known_false_positives: |-
-    The "interesting_ports_lookup" lookup considers communication to ports like 20, 21 for FTP, 23 for Telnet, 110 for POP3, etc. as prohibited traffic. Which may result in a lot of alerts in certain environments that still rely on these ports for legitimate traffic. Tune as needed.
+how_to_implement: 'In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment.
+
+    This is necessary so that the search can identify an ''action'' taken on the traffic of interest.
+
+    The search also requires the Network_Traffic data model be populated.'
+known_false_positives: The "interesting_ports_lookup" lookup considers communication to ports like 20, 21 for FTP, 23 for Telnet, 110 for POP3, etc. as prohibited traffic. Which may result in a lot of alerts in certain environments that still rely on these ports for legitimate traffic. Tune as needed.
 references:
     - https://securityscorecard.com/blog/ftp-security-risks/
     - https://secoraconsulting.com/blog/telnet-security-risks/
@@ -59,7 +61,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src_ip
diff --git a/detections/network/protocol_or_port_mismatch.yml b/detections/network/protocol_or_port_mismatch.yml
index ecf8fe90c68..b19ca8e98b2 100644
--- a/detections/network/protocol_or_port_mismatch.yml
+++ b/detections/network/protocol_or_port_mismatch.yml
@@ -55,7 +55,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src_ip
diff --git a/detections/network/protocols_passing_authentication_in_cleartext.yml b/detections/network/protocols_passing_authentication_in_cleartext.yml
index d5443a08996..920f75e085d 100644
--- a/detections/network/protocols_passing_authentication_in_cleartext.yml
+++ b/detections/network/protocols_passing_authentication_in_cleartext.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies the use of cleartext protocols that risk leaking sensitive information. It detects network traffic on legacy protocols such as Telnet (port 23), POP3 (port 110), IMAP (port 143), and non-anonymous FTP (port 21). The detection leverages the Network_Traffic data model to identify TCP traffic on these ports. Monitoring this activity is crucial as it can expose credentials and other sensitive data to interception. If confirmed malicious, attackers could capture authentication details, leading to unauthorized access and potential data breaches.
 data_source:
     - Cisco Secure Firewall Threat Defense Connection Event
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic
       WHERE NOT All_Traffic.action IN ("blocked", "block")
         AND
@@ -43,7 +43,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/network/remote_desktop_network_traffic.yml b/detections/network/remote_desktop_network_traffic.yml
index 58760dfab6c..ef83cbba9ab 100644
--- a/detections/network/remote_desktop_network_traffic.yml
+++ b/detections/network/remote_desktop_network_traffic.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects unusual Remote Desktop Protocol (RDP) traffic on TCP/3389 by filtering out known RDP sources and destinations, focusing on atypical connections within the network. This detection leverages network traffic data to identify potentially unauthorized RDP access. Monitoring this activity is crucial for a SOC as unauthorized RDP access can indicate an attacker's attempt to control networked systems, leading to data theft, ransomware deployment, or further network compromise. If confirmed malicious, this activity could result in significant data breaches or complete system and network control loss.
 data_source:
     - Zeek Conn
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic
       WHERE All_Traffic.dest_port=3389
         AND
@@ -36,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -69,7 +69,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.001/remote_desktop_connection/zeek_conn.log
-          sourcetype: bro:conn:json
           source: conn.log
+          sourcetype: bro:conn:json
       description: PORTED MANUAL TEST - This detection uses builtin lookup from Enterprise Security.
       test_type: experimental
diff --git a/detections/network/rundll32_dnsquery.yml b/detections/network/rundll32_dnsquery.yml
index 66c5ed04473..1b8f2193361 100644
--- a/detections/network/rundll32_dnsquery.yml
+++ b/detections/network/rundll32_dnsquery.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects a suspicious `rundll32.exe` process making HTTP connections and performing DNS queries to web domains. It leverages Sysmon EventCode 22 logs to identify these activities. This behavior is significant as it is commonly associated with IcedID malware, where `rundll32.exe` checks internet connectivity and communicates with C&C servers to download configurations and other components. If confirmed malicious, this activity could allow attackers to establish persistence, download additional payloads, and exfiltrate sensitive data, posing a severe threat to the network.
 data_source:
     - Sysmon EventID 22
-search: |-
-    `sysmon` EventCode=22 process_name="rundll32.exe"
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY answer answer_count dvc
-           process_exec process_guid process_name
-           query query_count reply_code_id
-           signature signature_id src
-           user_id vendor_product QueryName
-           QueryResults QueryStatus
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `rundll32_dnsquery_filter`
+search: |
+    `sysmon` EventCode=22 process_name="rundll32.exe" | eval process_name=process_name, dvc=dvc, dest=Computer, QueryName=QueryName | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count query query_count reply_code_id src vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_dnsquery_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: rundll32 process $process_name$ made a DNS query for $query$ from host $dvc$
     entity:
diff --git a/detections/network/smb_traffic_spike.yml b/detections/network/smb_traffic_spike.yml
index b90ac0d9e8d..b075d6c92c5 100644
--- a/detections/network/smb_traffic_spike.yml
+++ b/detections/network/smb_traffic_spike.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Anomaly
 description: The following analytic detects spikes in Server Message Block (SMB) traffic connections, which are used for sharing files and resources between computers. It leverages network traffic logs to monitor connections on ports 139 and 445, and SMB application usage. By calculating the average and standard deviation of SMB connections over the past 70 minutes, it identifies sources exceeding two standard deviations from the average. This activity is significant as it may indicate potential SMB-based attacks, such as ransomware or data theft. If confirmed malicious, attackers could exfiltrate data or spread malware within the network.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic
       WHERE All_Traffic.dest_port=139
         OR
diff --git a/detections/network/ssl_certificates_with_punycode.yml b/detections/network/ssl_certificates_with_punycode.yml
index 7695dd12527..c9656e93e15 100644
--- a/detections/network/ssl_certificates_with_punycode.yml
+++ b/detections/network/ssl_certificates_with_punycode.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Hunting
 description: The following analytic detects SSL certificates with Punycode domains in the SSL issuer email domain, identified by the prefix "xn--". It leverages the Certificates Datamodel to flag these domains and uses CyberChef for decoding. This activity is significant as Punycode can be used for domain spoofing and phishing attacks. If confirmed malicious, attackers could deceive users and systems, potentially leading to unauthorized access and data breaches.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Certificates.All_Certificates
       BY All_Certificates.SSL.ssl_issuer_email_domain All_Certificates.SSL.ssl_issuer All_Certificates.SSL.ssl_subject_email
          All_Certificates.SSL.dest All_Certificates.SSL.src All_Certificates.SSL.sourcetype
diff --git a/detections/network/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/network/suspicious_process_dns_query_known_abuse_web_services.yml
index 08b241f2254..991be8feeb9 100644
--- a/detections/network/suspicious_process_dns_query_known_abuse_web_services.yml
+++ b/detections/network/suspicious_process_dns_query_known_abuse_web_services.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects a suspicious process making DNS queries to known, abused text-paste web services, VoIP, instant messaging, and digital distribution platforms. It leverages Sysmon EventID 22 logs to identify queries from processes like cmd.exe, powershell.exe, and others. This activity is significant as it may indicate an attempt to download malicious files, a common initial access technique. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the target host.
 data_source:
     - Sysmon EventID 22
-search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*api.telegram*","*t.me*") process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe","cscript.exe") OR Image IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*") | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count dvc process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_dns_query_known_abuse_web_services_filter`'
+search: |
+    `sysmon` EventCode=22 (QueryName IN ("*pastebin*", "*discord*", "*api.telegram*", "*t.me*") process_name IN ("cmd.exe", "powershell", "pwsh.exe", "wscript.exe", "cscript.exe")) OR Image IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*") | eval process_name=process_name, dvc=dvc, dest=Computer, QueryName=QueryName | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count query query_count reply_code_id src vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_dns_query_known_abuse_web_services_filter`
 how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query. We suggest you run this detection at least once a day over the last 14 days.
 known_false_positives: Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed.
 references:
@@ -23,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious process $process_name$ made a DNS query for $QueryName$ on $dvc$
     entity:
diff --git a/detections/network/suspicious_process_with_discord_dns_query.yml b/detections/network/suspicious_process_with_discord_dns_query.yml
index 152991165b0..8c2d1fc52c1 100644
--- a/detections/network/suspicious_process_with_discord_dns_query.yml
+++ b/detections/network/suspicious_process_with_discord_dns_query.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic identifies a process making a DNS query to Discord, excluding legitimate Discord application paths. It leverages Sysmon logs with Event ID 22 to detect DNS queries containing "discord" in the QueryName field. This activity is significant because Discord can be abused by adversaries to host and download malicious files, as seen in the WhisperGate campaign. If confirmed malicious, this could indicate malware attempting to download additional payloads from Discord, potentially leading to further code execution and compromise of the affected system.
 data_source:
     - Sysmon EventID 22
-search: '`sysmon` EventCode=22 QueryName IN ("*discord*") Image != "*\\AppData\\Local\\Discord\\*" AND Image != "*\\Program Files*" AND Image != "discord.exe" | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count dvc process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter`'
+search: |
+    `sysmon` EventCode=22 QueryName="*discord*" NOT Image="*\\AppData\\Local\\Discord\\*" NOT Image="*\\Program Files*" NOT Image="discord.exe" | eval process_name=process_name, dvc=dvc, dest=Computer, QueryName=QueryName | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count query query_count reply_code_id src vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter`
 how_to_implement: his detection relies on sysmon logs with the Event ID 22, DNS Query.
 known_false_positives: Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dvc
diff --git a/detections/network/tor_traffic.yml b/detections/network/tor_traffic.yml
index dfc88729116..87e0ce9f74c 100644
--- a/detections/network/tor_traffic.yml
+++ b/detections/network/tor_traffic.yml
@@ -6,32 +6,20 @@ modification_date: '2026-05-13'
 author: David Dorsey, Bhavin Patel, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic identifies allowed network traffic to The Onion Router (TOR), an anonymity network often exploited for malicious activities.
+description: 'The following analytic identifies allowed network traffic to The Onion Router (TOR), an anonymity network often exploited for malicious activities.
+
     It leverages data from Next Generation Firewalls, using the Network_Traffic data model to detect traffic where the application is TOR and the action is allowed.
+
     This activity is significant as TOR can be used to bypass conventional monitoring, facilitating hacking, data breaches, and illicit content dissemination.
-    If confirmed malicious, this could lead to unauthorized access, data exfiltration, and severe compliance violations, compromising the integrity and security of the network.
+
+    If confirmed malicious, this could lead to unauthorized access, data exfiltration, and severe compliance violations, compromising the integrity and security of the network.'
 data_source:
     - Palo Alto Network Traffic
     - Cisco Secure Firewall Threat Defense Connection Event
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic WHERE
-    All_Traffic.app=tor
-    All_Traffic.action IN ("allowed", "allow")
-    BY All_Traffic.action All_Traffic.app All_Traffic.bytes
-       All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest
-       All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc
-       All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src
-       All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport
-       All_Traffic.user All_Traffic.vendor_product All_Traffic.rule
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `drop_dm_object_name("All_Traffic")`
-    | `tor_traffic_filter`
-how_to_implement: |
-    In order to properly run this search, Splunk needs to ingest data from Next Generation Firewalls like, Cisco Secure Firewall Threat Defense, Palo Alto Networks Firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model to be populated.
-known_false_positives: |
-    No false positives have been identified at this time.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=All_Traffic where All_Traffic.app="tor" All_Traffic.action IN ("allowed", "allow") by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product | `drop_dm_object_name(All_Traffic)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `tor_traffic_filter`
+how_to_implement: In order to properly run this search, Splunk needs to ingest data from Next Generation Firewalls like, Cisco Secure Firewall Threat Defense, Palo Alto Networks Firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model to be populated.
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRtCAK
     - https://unit42.paloaltonetworks.com/tor-traffic-enterprise-networks/#:~:text=For%20enterprises%20concerned%20about%20the,the%20most%20important%20security%20risks.
@@ -43,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Suspicious network traffic allowed using TOR has been detected from $src_ip$ to $dest_ip$
     entity:
diff --git a/detections/network/unusual_ssh_client_banner.yml b/detections/network/unusual_ssh_client_banner.yml
index 5bd366d59ea..2e82011aa2d 100644
--- a/detections/network/unusual_ssh_client_banner.yml
+++ b/detections/network/unusual_ssh_client_banner.yml
@@ -6,60 +6,21 @@ modification_date: '2026-10-12'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs.
-    Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.
+description: 'The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs.
+
+    Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.'
 data_source:
     - Zeek SSH
-search: |-
-    `zeek_ssh`
-    client="*"
-    NOT client IN (
-        "SSH-2.0-AsyncSSH*",
-        "SSH-2.0-Bitvise*",
-        "SSH-2.0-Cisco*",
-        "SSH-2.0-CyberArk*",
-        "SSH-2.0-dropbear*",
-        "SSH-2.0-FileZilla*",
-        "SSH-2.0-Go*",
-        "SSH-2.0-JSCH*",
-        "SSH-2.0-Juniper*",
-        "SSH-2.0-libssh*",
-        "SSH-2.0-MobaXterm*",
-        "SSH-2.0-OpenSSH*",
-        "SSH-2.0-paramiko*",
-        "SSH-2.0-PuTTY*",
-        "SSH-2.0-Renci.SshNet*",
-        "SSH-2.0-SecureCRT*",
-        "SSH-2.0-ssh2*",
-        "SSH-2.0-TTSSH*",
-        "SSH-2.0-WinSCP*",
-        "SSH-2.0-Xshell*"
-    )
-
-    | eval dest_port=coalesce(dest_port, 'id.resp_p'),
-           dest=coalesce(dest, dest_ip, 'id.resp_h'),
-           src=coalesce(src, src_ip, 'id.orig_h')
+search: |
+    `zeek_ssh` client="*" NOT (client IN ("SSH-2.0-AsyncSSH*", "SSH-2.0-Bitvise*", "SSH-2.0-Cisco*", "SSH-2.0-CyberArk*", "SSH-2.0-dropbear*", "SSH-2.0-FileZilla*", "SSH-2.0-Go*", "SSH-2.0-JSCH*", "SSH-2.0-Juniper*", "SSH-2.0-libssh*", "SSH-2.0-MobaXterm*", "SSH-2.0-OpenSSH*", "SSH-2.0-paramiko*", "SSH-2.0-PuTTY*", "SSH-2.0-Renci.SshNet*", "SSH-2.0-SecureCRT*", "SSH-2.0-ssh2*", "SSH-2.0-TTSSH*", "SSH-2.0-WinSCP*", "SSH-2.0-Xshell*")) | stats count min(_time) as firstTime max(_time) as lastTime by orig_h resp_h resp_p client src dest dest_port | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `unusual_ssh_client_banner_filter`
+how_to_implement: 'Zeek SSH logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466).
 
-    | fillnull value=NULL
-
-    | stats count min(_time) as firstTime
-                  max(_time) as lastTime
-                  values(client) as client
-                  values(post_body) as post_body
+    The client field should be populated from the SSH handshake banner.
 
-      by src dest dest_port
+    Configure the `zeek_ssh` macro to match the sourcetype used by your Zeek add-on.'
+known_false_positives: 'Legitimate but uncommon SSH client software not included will generate false positives.
 
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `unusual_ssh_client_banner_filter`
-how_to_implement: |-
-    Zeek SSH logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466).
-    The client field should be populated from the SSH handshake banner.
-    Configure the `zeek_ssh` macro to match the sourcetype used by your Zeek add-on.
-known_false_positives: |-
-    Legitimate but uncommon SSH client software not included will generate false positives.
-    Review the client banner and tune the filter accordingly.
+    Review the client banner and tune the filter accordingly.'
 references:
     - https://docs.zeek.org/en/master/logs/ssh.html
     - https://attack.mitre.org/techniques/T1021/004/
@@ -72,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$id.orig_h$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
@@ -97,6 +58,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/zeek_ssh_unusual_client/ssh.log
-          sourcetype: zeek:ssh
           source: ssh.log
+          sourcetype: zeek:ssh
       test_type: unit
diff --git a/detections/network/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/network/wermgr_process_connecting_to_ip_check_web_services.yml
index 4034d3e848c..7ffdae7247a 100644
--- a/detections/network/wermgr_process_connecting_to_ip_check_web_services.yml
+++ b/detections/network/wermgr_process_connecting_to_ip_check_web_services.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects the wermgr.exe process attempting to connect to known IP check web services. It leverages Sysmon EventCode 22 to identify DNS queries made by wermgr.exe to specific IP check services. This activity is significant because wermgr.exe is typically used for Windows error reporting, and its connection to these services may indicate malicious code injection, often associated with malware like Trickbot. If confirmed malicious, this behavior could allow attackers to recon the infected machine's IP address, aiding in further exploitation and evasion tactics.
 data_source:
     - Sysmon EventID 22
-search: |-
-    `sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net")
-      | stats  min(_time) as firstTime max(_time) as lastTime count
-        BY answer answer_count dvc
-           process_exec process_guid process_name
-           query query_count reply_code_id
-           signature signature_id src
-           user_id vendor_product QueryName
-           QueryResults QueryStatus
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `wermgr_process_connecting_to_ip_check_web_services_filter`
+search: |
+    `sysmon` EventCode=22 process_name="wermgr.exe" QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com", "*api.ip.sb", "*ident.me", "*www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org", "*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") | eval process_name=process_name, dvc=dvc, dest=Computer, QueryName=QueryName | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count query query_count reply_code_id src vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -34,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Wermgr.exe process connecting IP location web services on $dvc$
     entity:
diff --git a/detections/network/windows_abused_web_services.yml b/detections/network/windows_abused_web_services.yml
index 0e4bed220d1..0dcd690db90 100644
--- a/detections/network/windows_abused_web_services.yml
+++ b/detections/network/windows_abused_web_services.yml
@@ -9,57 +9,8 @@ type: Anomaly
 description: The following analytic detects a suspicious process making DNS queries to known, abused web services such as text-paste sites, VoIP, secure tunneling, instant messaging, and digital distribution platforms. This detection leverages Sysmon logs with Event ID 22, focusing on specific query names. This activity is significant as it may indicate an adversary attempting to download malicious files, a common initial access technique. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the target host.
 data_source:
     - Sysmon EventID 22
-search: |-
-    `sysmon`
-    EventCode=22
-    QueryName IN (
-        "*//objects.githubusercontent.com*",
-        "*anonfiles.com*",
-        "*.argotunnel.com*",
-        "*cdn.discordapp.com*",
-        "*ddns.net*",
-        "*dl.dropboxusercontent.com*",
-        "*duckdns.org*",
-        "*ghostbin.co*",
-        "*glitch.me*",
-        "*gofile.io*",
-        "*hastebin.com*",
-        "*mediafire.com*",
-        "*mega.nz*",
-        "*ngrok.io*",
-        "*onrender.com*",
-        "*pages.dev*",
-        "*paste.ee*",
-        "*pastebin.com*",
-        "*pastebin.pl*",
-        "*pasteio.com*",
-        "*pastetext.net*",
-        "*privatlab.com*",
-        "*privatlab.net*",
-        "*send.exploit.in*",
-        "*sendspace.com*",
-        "*storage.googleapis.com*",
-        "*storjshare.io*",
-        "*supabase.co*",
-        "*temp.sh*",
-        "*textbin*",
-        "*transfer.sh*",
-        "*trycloudflare.com*",
-        "*ufile.io*",
-        "*w3spaces.com*",
-        "*workers.dev*"
-    )
-    | eval answer=coalesce(answer,"none")
-    | eval answer_count=coalesce(answer_count,0)
-    | rename dvc as dest
-    | stats  min(_time) as firstTime max(_time) as lastTime count
-        BY answer answer_count dest process_exec process_guid
-           process_name query query_count reply_code_id signature
-           signature_id src user_id vendor_product
-           QueryName QueryResults QueryStatus
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_abused_web_services_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=DNS where DNS.query IN ("*//objects.githubusercontent.com*", "*anonfiles.com*", "*.argotunnel.com*", "*cdn.discordapp.com*", "*ddns.net*", "*dl.dropboxusercontent.com*", "*duckdns.org*", "*ghostbin.co*", "*glitch.me*", "*gofile.io*", "*hastebin.com*", "*mediafire.com*", "*mega.nz*", "*ngrok.io*", "*onrender.com*", "*pages.dev*", "*paste.ee*", "*pastebin.com*", "*pastebin.pl*", "*pasteio.com*", "*pastetext.net*", "*privatlab.com*", "*privatlab.net*", "*send.exploit.in*", "*sendspace.com*", "*storage.googleapis.com*", "*storjshare.io*", "*supabase.co*", "*temp.sh*", "*textbin*", "*transfer.sh*", "*trycloudflare.com*", "*ufile.io*", "*w3spaces.com*", "*workers.dev*") by DNS.answer DNS.answer_count DNS.query DNS.query_count DNS.reply_code_id DNS.src DNS.vendor_product DNS.dest DNS.QueryName DNS.process_name | `drop_dm_object_name(DNS)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_abused_web_services_filter`
 how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query. We suggest you run this detection at least once a day over the last 14 days.
 known_false_positives: Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed.
 references:
@@ -72,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/network/windows_ad_replication_service_traffic.yml b/detections/network/windows_ad_replication_service_traffic.yml
index 181cbc20a5f..eab9123d270 100644
--- a/detections/network/windows_ad_replication_service_traffic.yml
+++ b/detections/network/windows_ad_replication_service_traffic.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic identifies unexpected Active Directory replication traffic from non-domain controller sources. It leverages data from the Network Traffic datamodel, specifically looking for applications related to AD replication. This activity is significant because AD replication traffic should typically only occur between domain controllers. Detection of such traffic from other sources may indicate malicious activities like DCSync or DCShadow, which are used for credential dumping. If confirmed malicious, this could allow attackers to exfiltrate sensitive credentials, leading to unauthorized access and potential domain-wide compromise.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` count values(All_Traffic.transport) as transport values(All_Traffic.user) as user values(All_Traffic.src_category) as src_category values(All_Traffic.dest_category) as dest_category min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic
       WHERE All_Traffic.app IN ("ms-dc-replication","*drsr*","ad drs")
       BY All_Traffic.src All_Traffic.dest All_Traffic.app
diff --git a/detections/network/windows_ad_rogue_domain_controller_network_activity.yml b/detections/network/windows_ad_rogue_domain_controller_network_activity.yml
index 0346fbfff78..ab89b220a15 100644
--- a/detections/network/windows_ad_rogue_domain_controller_network_activity.yml
+++ b/detections/network/windows_ad_rogue_domain_controller_network_activity.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic identifies unauthorized replication RPC calls from non-domain controller devices. It leverages Zeek wire data to detect specific RPC operations like DrsReplicaAdd and DRSGetNCChanges, filtering out legitimate domain controllers. This activity is significant as it may indicate an attempt to introduce a rogue domain controller, which can compromise the integrity of the Active Directory environment. If confirmed malicious, this could allow attackers to manipulate directory data, escalate privileges, and persist within the network, posing a severe security risk.
 data_source: []
-search: |-
+search: |
     `zeek_rpc` DrsReplicaAdd OR DRSGetNCChanges
       | where NOT (dest_category="Domain Controller") OR NOT (src_category="Domain Controller")
       | fillnull value="Unknown" src_category, dest_category
diff --git a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml
index dc872242386..53247fabf4d 100644
--- a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml
+++ b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects the execution of a DNS query by a process to the associated Telegram API domain, which could indicate access via a Telegram bot commonly used by malware for command and control (C2) communications. By monitoring DNS queries related to Telegram's infrastructure, the detection identifies potential attempts to establish covert communication channels between a compromised system and external malicious actors. This behavior is often observed in cyberattacks where Telegram bots are used to receive commands or exfiltrate data, making it a key indicator of suspicious or malicious activity within a network.
 data_source:
     - Sysmon EventID 22
-search: |-
-    `sysmon` EventCode=22  query = "api.telegram.org" process_name != "telegram.exe"
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY answer answer_count dvc
-           process_exec process_guid process_name
-           query query_count reply_code_id
-           signature signature_id src
-           user_id vendor_product QueryName
-           QueryResults QueryStatus
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_dns_query_request_by_telegram_bot_api_filter`
+search: |
+    `sysmon` EventCode=22 QueryName="api.telegram.org" NOT process_name="telegram.exe" | eval process_name=process_name, dvc=dvc, dest=Computer, QueryName=QueryName | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count query query_count reply_code_id src vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dns_query_request_by_telegram_bot_api_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: a third part automation using telegram API.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dvc
diff --git a/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml b/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml
index 620ecb56d8f..3415af11f44 100644
--- a/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml
+++ b/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic detects processes attempting to connect to known IP check web services. This behavior is identified using Sysmon EventCode 22 logs, specifically monitoring DNS queries to services like "wtfismyip.com" and "ipinfo.io". This activity is significant as it is commonly used by malware, such as Trickbot, for reconnaissance to determine the infected machine's IP address. If confirmed malicious, this could allow attackers to gather network information, aiding in further attacks or lateral movement within the network.
 data_source:
     - Sysmon EventID 22
-search: |-
-    `sysmon` EventCode=22  QueryName IN ("*wtfismyip.com", "*checkip.*", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org", "*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net", "*iplogger.org*", "*ip-api.com*", "*geoip.*", "*icanhazip.*", "*ipwho.is*", "*ifconfig.me*", "*myip.com*", "*ipstack.com*", "*myexternalip.com*", "*ip-api.io*", "*trackip.net*", "*ipgeolocation.io*", "*ipfind.io*", "*freegeoip.app*", "*ipv4bot.whatismyipaddress.com*")
-      | stats  min(_time) as firstTime max(_time) as lastTime count
-        BY answer answer_count dvc
-           process_exec process_guid process_name
-           query query_count reply_code_id
-           signature signature_id src
-           user_id vendor_product QueryName
-           QueryResults QueryStatus
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_gather_victim_network_info_through_ip_check_web_services_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=DNS where DNS.query IN ("*wtfismyip.com", "*checkip.", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com", "*api.ip.sb", "*ident.me", "*www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org", "*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net", "*iplogger.org", "*ip-api.com", "*geoip.", "*icanhazip.", "*ipwho.is", "*ifconfig.me", "*myip.com", "*ipstack.com", "*myexternalip.com", "*ip-api.io", "*trackip.net", "*ipgeolocation.io", "*ipfind.io", "*freegeoip.app", "*ipv4bot.whatismyipaddress.com") by DNS.answer DNS.answer_count DNS.query DNS.query_count DNS.reply_code_id DNS.src DNS.vendor_product DNS.dvc DNS.process_name | `drop_dm_object_name(DNS)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_gather_victim_network_info_through_ip_check_web_services_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA.
 known_false_positives: Filter internet browser application to minimize the false positive of this detection.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dvc
diff --git a/detections/network/windows_multi_hop_proxy_tor_website_query.yml b/detections/network/windows_multi_hop_proxy_tor_website_query.yml
index 6bbdc975e22..8d8e57e64e6 100644
--- a/detections/network/windows_multi_hop_proxy_tor_website_query.yml
+++ b/detections/network/windows_multi_hop_proxy_tor_website_query.yml
@@ -9,18 +9,8 @@ type: Anomaly
 description: The following analytic identifies DNS queries to known TOR proxy websites, such as "*.torproject.org" and "www.theonionrouter.com". It leverages Sysmon EventCode 22 to detect these queries by monitoring DNS query events from endpoints. This activity is significant because adversaries often use TOR proxies to disguise the source of their malicious traffic, making it harder to trace their actions. If confirmed malicious, this behavior could indicate an attempt to obfuscate network traffic, potentially allowing attackers to exfiltrate data or communicate with command and control servers undetected.
 data_source:
     - Sysmon EventID 22
-search: |-
-    `sysmon` EventCode=22 QueryName IN ("*.torproject.org", "www.theonionrouter.com")
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY answer answer_count dvc
-           process_exec process_guid process_name
-           query query_count reply_code_id
-           signature signature_id src
-           user_id vendor_product QueryName
-           QueryResults QueryStatus
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `windows_multi_hop_proxy_tor_website_query_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=DNS where DNS.query IN ("*.torproject.org", "*www.theonionrouter.com") by DNS.answer DNS.answer_count DNS.query DNS.query_count DNS.reply_code_id DNS.src DNS.vendor_product DNS.dvc DNS.process_name DNS.QueryName | `drop_dm_object_name(DNS)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_multi_hop_proxy_tor_website_query_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 22 dns query events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: third party application may use this proxies if allowed in production environment. Filter is needed.
 references:
@@ -33,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dvc
diff --git a/detections/network/windows_remote_desktop_network_bruteforce_attempt.yml b/detections/network/windows_remote_desktop_network_bruteforce_attempt.yml
index 309c975fe17..a0db076543e 100644
--- a/detections/network/windows_remote_desktop_network_bruteforce_attempt.yml
+++ b/detections/network/windows_remote_desktop_network_bruteforce_attempt.yml
@@ -10,7 +10,7 @@ description: The following analytic identifies potential Remote Desktop Protocol
 data_source:
     - Sysmon EventID 3
     - Cisco Secure Access Firewall
-search: |-
+search: |
     | tstats `security_content_summariesonly` count, min(_time) as firstTime, max(_time) as lastTime values(Al_Traffic.src_port) as src_port FROM datamodel=Network_Traffic
       WHERE (
             All_Traffic.app=rdp
@@ -41,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/network/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml b/detections/network/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml
index 0955b26fe50..6577ec1d372 100644
--- a/detections/network/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml
+++ b/detections/network/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic identifies suspicious Office documents that connect to non-Microsoft Office domains. It leverages Sysmon EventCode 22 to detect processes like winword.exe or excel.exe making DNS queries to domains outside of *.office.com or *.office.net. This activity is significant as it may indicate a spearphishing attempt using malicious documents to download or connect to harmful content. If confirmed malicious, this could lead to unauthorized data access, malware infection, or further network compromise.
 data_source:
     - Sysmon EventID 22
-search: '`sysmon` EventCode=22 Image IN ("*\\winword.exe","*\\excel.exe","*\\powerpnt.exe","*\\mspub.exe","*\\visio.exe","*\\wordpad.exe","*\\wordview.exe","*\\onenote.exe", "*\\onenotem.exe","*\\onenoteviewer.exe","*\\onenoteim.exe", "*\\msaccess.exe") AND NOT(QueryName IN ("*.office.com", "*.office.net")) | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count dvc process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter`'
+search: |
+    `sysmon` EventCode=22 Image IN ("*\\winword.exe", "*\\excel.exe", "*\\powerpnt.exe", "*\\mspub.exe", "*\\visio.exe", "*\\wordpad.exe", "*\\wordview.exe", "*\\onenote.exe", "*\\onenotem.exe", "*\\onenoteviewer.exe", "*\\onenoteim.exe", "*\\msaccess.exe") NOT (QueryName IN ("*.office.com", "*.office.net")) | eval process_name=process_name, dvc=dvc, dest=Computer, QueryName=QueryName | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count query query_count reply_code_id src vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 known_false_positives: Windows Office document may contain legitimate url link other than MS office Domain. filter is needed
 references:
diff --git a/detections/network/zeek_x509_certificate_with_punycode.yml b/detections/network/zeek_x509_certificate_with_punycode.yml
index e9c933e6c85..fe893675c0e 100644
--- a/detections/network/zeek_x509_certificate_with_punycode.yml
+++ b/detections/network/zeek_x509_certificate_with_punycode.yml
@@ -8,7 +8,7 @@ status: experimental
 type: Hunting
 description: The following analytic detects the presence of punycode within x509 certificates using Zeek x509 logs. It identifies punycode in the subject alternative name email and other fields by searching for the "xn--" prefix. This activity is significant as punycode can be used in phishing attacks or to bypass domain filters, posing a security risk. If confirmed malicious, attackers could use these certificates to impersonate legitimate domains, potentially leading to unauthorized access or data breaches.
 data_source: []
-search: |-
+search: |
     `zeek_x509`
       | rex field=san.email{} "\@(?<domain_detected>xn--.*)"
       | rex field=san.other_fields{} "\@(?<domain_detected>xn--.*)"
diff --git a/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml b/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml
index 7820a9a8532..e3138858cd3 100644
--- a/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml
+++ b/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic identifies access to the /api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark endpoint, which is associated with CVE-2023-46805 and CVE-2024-21887 vulnerabilities. It detects this activity by monitoring for GET requests that receive a 403 Forbidden response with an empty body. This behavior is significant as it indicates potential exploitation attempts against Ivanti Connect Secure systems. If confirmed malicious, attackers could exploit these vulnerabilities to gain unauthorized access or control over the affected systems, leading to potential data breaches or system compromise.
 data_source:
     - Suricata
-search: |-
-    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE Web.url="*/api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark*" Web.http_method=GET Web.status=403
-      BY Web.src, Web.dest, Web.http_user_agent,
-         Web.status, Web.url source
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark*" Web.http_method="GET" Web.status="403" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint_filter`
 how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
 known_false_positives: This analytic is limited to HTTP Status 403; adjust as necessary. False positives may occur if the URI path is IP-restricted or externally blocked. It's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.
 references:
@@ -32,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible exploitation of CVE-2023-46805 and CVE-2024-21887 against $dest$.
     entity:
diff --git a/detections/web/adobe_coldfusion_access_control_bypass.yml b/detections/web/adobe_coldfusion_access_control_bypass.yml
index 9c68e027eb8..38582dda049 100644
--- a/detections/web/adobe_coldfusion_access_control_bypass.yml
+++ b/detections/web/adobe_coldfusion_access_control_bypass.yml
@@ -6,44 +6,23 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects potential exploitation attempts against Adobe ColdFusion vulnerabilities CVE-2023-29298 and CVE-2023-26360.
+description: 'The following analytic detects potential exploitation attempts against Adobe ColdFusion vulnerabilities CVE-2023-29298 and CVE-2023-26360.
+
     It monitors requests to specific ColdFusion Administrator endpoints, especially those with an unexpected additional forward slash, using the Web datamodel.
+
     This activity is significant for a SOC as it indicates attempts to bypass access controls, which can lead to unauthorized access to ColdFusion administration endpoints.
-    If confirmed malicious, this could result in data theft, brute force attacks, or further exploitation of other vulnerabilities, posing a serious security risk to the environment.
+
+    If confirmed malicious, this could result in data theft, brute force attacks, or further exploitation of other vulnerabilities, posing a serious security risk to the environment.'
 data_source:
     - Suricata
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Web WHERE
-
-    Web.url IN (
-        "*//CFIDE/adminapi*",
-        "*//CFIDE/administrator*",
-        "*//CFIDE/componentutils*",
-        "*//CFIDE/main*",
-        "*//CFIDE/restplay*",
-        "*//CFIDE/servermanager*",
-        "*//CFIDE/wizards*",
-        "*//restplay*",
-    )
-    Web.status=200
-
-    BY Web.http_user_agent Web.status Web.http_method
-       Web.url Web.url_length Web.src Web.dest
-
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `adobe_coldfusion_access_control_bypass_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url IN ("*//CFIDE/adminapi*", "*//CFIDE/administrator*", "*//CFIDE/componentutils*", "*//CFIDE/main*", "*//CFIDE/restplay*", "*//CFIDE/servermanager*", "*//CFIDE/wizards*", "*//restplay*") Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `adobe_coldfusion_access_control_bypass_filter`
 how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
-known_false_positives: |-
-    This analytic is limited to HTTP Status 200.
+known_false_positives: 'This analytic is limited to HTTP Status 200.
+
     False positives may occur if the URI path is IP-restricted or externally blocked.
-    It is recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.
+
+    It is recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.'
 references:
     - https://www.rapid7.com/blog/post/2023/07/11/cve-2023-29298-adobe-coldfusion-access-control-bypass/
 drilldown_searches:
@@ -54,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/web/adobe_coldfusion_unauthenticated_arbitrary_file_read.yml b/detections/web/adobe_coldfusion_unauthenticated_arbitrary_file_read.yml
index 4667f0fa1e0..8c79271e10a 100644
--- a/detections/web/adobe_coldfusion_unauthenticated_arbitrary_file_read.yml
+++ b/detections/web/adobe_coldfusion_unauthenticated_arbitrary_file_read.yml
@@ -6,41 +6,31 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read.
-    It monitors POST requests to the "/cf_scripts/scripts/ajax/ckeditor/*" endpoint using the Web datamodel.
-    This activity can be significant due to the vulnerability's high CVSS score of 9.8, indicating severe risk.
-    If confirmed malicious, it could lead to unauthorized data access, further attacks, or severe operational disruptions.
-data_source:
-    - Suricata
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
+description: 'The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read.
 
-    FROM datamodel=Web WHERE
-
-    Web.url="*/cf_scripts/scripts/ajax/ckeditor/*"
-    Web.status=200
-    Web.http_method=POST
+    It monitors POST requests to the "/cf_scripts/scripts/ajax/ckeditor/*" endpoint using the Web datamodel.
 
-    BY Web.http_user_agent Web.status Web.http_method
-       Web.url Web.url_length Web.src Web.dest
+    This activity can be significant due to the vulnerability''s high CVSS score of 9.8, indicating severe risk.
 
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `adobe_coldfusion_unauthenticated_arbitrary_file_read_filter`
+    If confirmed malicious, it could lead to unauthorized data access, further attacks, or severe operational disruptions.'
+data_source:
+    - Suricata
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/cf_scripts/scripts/ajax/ckeditor/*" Web.status="200" Web.http_method="POST" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `adobe_coldfusion_unauthenticated_arbitrary_file_read_filter`
 how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
-known_false_positives: |-
-    In the wild, we have observed three different types of attempts that could potentially trigger false positives if the HTTP status code is not in the query.
+known_false_positives: 'In the wild, we have observed three different types of attempts that could potentially trigger false positives if the HTTP status code is not in the query.
+
     These include:
 
+
     - "/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/iedit.cfc?method=wizardHash&_cfclient=true&returnFormat=wddx&inPassword=foo"
+
     - "/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/2U9Uyvv qwP4PGaZpjARz5VJGfpCk.jsp"
+
     - "/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm"
 
-    These could be legitimate requests depending on the context of your organization. Therefore, it is recommended to modify the analytic as needed to suit your specific environment.
+
+    These could be legitimate requests depending on the context of your organization. Therefore, it is recommended to modify the analytic as needed to suit your specific environment.'
 references:
     - https://www.rapid7.com/db/modules/auxiliary/gather/adobe_coldfusion_fileread_cve_2023_26360/
     - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26360.yaml
@@ -52,7 +42,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/web/cisco_ios_xe_implant_access.yml b/detections/web/cisco_ios_xe_implant_access.yml
index c27ea93414c..79c25737c32 100644
--- a/detections/web/cisco_ios_xe_implant_access.yml
+++ b/detections/web/cisco_ios_xe_implant_access.yml
@@ -6,34 +6,19 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic identifies the potential exploitation of the Cisco IOS XE vulnerability, CVE-2023-20198, in the Web User Interface.
+description: 'The following analytic identifies the potential exploitation of the Cisco IOS XE vulnerability, CVE-2023-20198, in the Web User Interface.
+
     It monitors POST requests to the "/webui/logoutconfirm.html?logon_hash=*" endpoint using the Web datamodel.
+
     This activity can be significant as it indicates potential access request to the implant
-    If confirmed malicious, attackers could maintain privileged access, compromising the device's integrity and security.
+
+    If confirmed malicious, attackers could maintain privileged access, compromising the device''s integrity and security.'
 data_source:
     - Suricata
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Web WHERE
-
-    Web.url="*/webui/logoutconfirm.html?logon_hash=*"
-    Web.http_method=POST
-    Web.status=200
-
-    BY Web.http_user_agent Web.status Web.http_method
-       Web.url Web.url_length Web.src Web.dest
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `cisco_ios_xe_implant_access_filter`
-how_to_implement: |-
-    This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, Suricata, or Splunk for Palo Alto.
-known_false_positives: |-
-    False positives may be present from vulnerability scanners or legitimate access requests. Apply appropriate filters as needed.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/webui/logoutconfirm.html*logon_hash=*" Web.http_method="POST" Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_ios_xe_implant_access_filter`
+how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, Suricata, or Splunk for Palo Alto.
+known_false_positives: False positives may be present from vulnerability scanners or legitimate access requests. Apply appropriate filters as needed.
 references:
     - https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/
     - https://github.com/vulncheck-oss/cisco-ios-xe-implant-scanner
@@ -45,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible exploitation of CVE-2023-20198 against $dest$ via $url$ by $src$.
     entity:
diff --git a/detections/web/citrix_adc_and_gateway_citrixbleed_2_memory_disclosure.yml b/detections/web/citrix_adc_and_gateway_citrixbleed_2_memory_disclosure.yml
index a892bf7efac..e612723e316 100644
--- a/detections/web/citrix_adc_and_gateway_citrixbleed_2_memory_disclosure.yml
+++ b/detections/web/citrix_adc_and_gateway_citrixbleed_2_memory_disclosure.yml
@@ -6,30 +6,23 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |
-    This detection identifies potential exploitation attempts of CVE-2025-5777 (CitrixBleed 2), a memory disclosure vulnerability in Citrix NetScaler ADC and Gateway.
+description: 'This detection identifies potential exploitation attempts of CVE-2025-5777 (CitrixBleed 2), a memory disclosure vulnerability in Citrix NetScaler ADC and Gateway.
+
     The vulnerability is triggered by sending POST requests with incomplete form data to the /p/u/doAuthentication.do endpoint, causing the device to leak memory contents including session tokens and authentication materials.
-    This search looks for POST requests to the vulnerable endpoint that may indicate scanning or exploitation attempts.
+
+    This search looks for POST requests to the vulnerable endpoint that may indicate scanning or exploitation attempts.'
 data_source:
     - Suricata
 search: |
-    | tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where
-    Web.url IN ("*/p/u/doAuthentication.do*")
-    Web.http_method="POST"
-    Web.status=200
-    by Web.http_user_agent, Web.status, Web.http_method,
-       Web.url, Web.url_length, Web.src, Web.dest, sourcetype
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `citrix_adc_and_gateway_citrixbleed_2_memory_disclosure_filter`
-how_to_implement: |
-    To implement this search, ensure that web traffic logs from Citrix NetScaler ADC and Gateway devices are being ingested into Splunk and mapped to the Web data model.
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/p/u/doAuthentication.do*" Web.http_method="POST" Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `citrix_adc_and_gateway_citrixbleed_2_memory_disclosure_filter`
+how_to_implement: 'To implement this search, ensure that web traffic logs from Citrix NetScaler ADC and Gateway devices are being ingested into Splunk and mapped to the Web data model.
+
     The logs should include URL paths, HTTP methods, status codes, source and destination IPs, and user agents.
-    Look specifically for POST requests to /p/u/doAuthentication.do endpoint which is the primary attack vector for CVE-2025-5777.
-known_false_positives: |
-    Legitimate authentication flows will trigger this detection as they access the doAuthentication.do endpoint. However, repeated automated requests, especially from HeadlessChrome user agents or with incomplete form data, should be investigated.
-    Focus on unusual patterns like multiple rapid requests or non-standard user agents.
+
+    Look specifically for POST requests to /p/u/doAuthentication.do endpoint which is the primary attack vector for CVE-2025-5777.'
+known_false_positives: 'Legitimate authentication flows will trigger this detection as they access the doAuthentication.do endpoint. However, repeated automated requests, especially from HeadlessChrome user agents or with incomplete form data, should be investigated.
+
+    Focus on unusual patterns like multiple rapid requests or non-standard user agents.'
 references:
     - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
     - https://www.netscaler.com/blog/news/critical-security-updates-for-netscaler-netscaler-gateway-and-netscaler-console/
@@ -45,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/web/citrix_adc_and_gateway_unauthorized_data_disclosure.yml b/detections/web/citrix_adc_and_gateway_unauthorized_data_disclosure.yml
index 5c74739874b..0d5a1e447b7 100644
--- a/detections/web/citrix_adc_and_gateway_unauthorized_data_disclosure.yml
+++ b/detections/web/citrix_adc_and_gateway_unauthorized_data_disclosure.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects attempts to exploit the Citrix Bleed vulnerability (CVE-2023-4966), which can lead to the leaking of session tokens. It identifies HTTP requests with a 200 status code targeting the /oauth/idp/.well-known/openid-configuration URL endpoint. By parsing web traffic and filtering based on user agent details, HTTP method, source and destination IPs, and sourcetype, it aims to identify potentially malicious requests. This activity is significant for a SOC because successful exploitation can allow attackers to impersonate legitimate users, bypass authentication, and access sensitive data. If confirmed malicious, it could lead to unauthorized data access, network propagation, and critical information exfiltration.
 data_source:
     - Suricata
-search: |-
-    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE Web.url IN ("*/oauth/idp/.well-known/openid-configuration*")  Web.status=200
-      BY Web.http_user_agent, Web.status Web.http_method,
-         Web.url, Web.url_length, Web.src,
-         Web.dest, sourcetype
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `citrix_adc_and_gateway_unauthorized_data_disclosure_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/oauth/idp/.well-known/openid-configuration*" Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `citrix_adc_and_gateway_unauthorized_data_disclosure_filter`
 how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto. We recommend hunting in the environment first to understand the scope of the issue and then deploying this detection to monitor for future exploitation attempts. Limit or restrict to Citrix devices only if possible.
 known_false_positives: False positives may be present based on organization use of Citrix ADC and Gateway. Filter, or restrict the analytic to Citrix devices only.
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible exploitation of Citrix Bleed vulnerability against $dest$ fron $src$.
     entity:
diff --git a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml
index f844c996807..3eaed5d65bd 100644
--- a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml
+++ b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml
@@ -6,37 +6,15 @@ modification_date: '2026-09-01'
 author: Michael Haag, Splunk
 status: production
 type: Hunting
-description: |
-    The following analytic identifies potential exploitation attempts against Citrix ADC related to CVE-2023-3519. It detects POST requests to specific web endpoints associated with this vulnerability by leveraging the Web datamodel.
+description: 'The following analytic identifies potential exploitation attempts against Citrix ADC related to CVE-2023-3519. It detects POST requests to specific web endpoints associated with this vulnerability by leveraging the Web datamodel.
+
     This activity is significant as CVE-2023-3519 involves a SAML processing overflow issue that can lead to memory corruption, posing a high risk.
-    If confirmed malicious, attackers could exploit this to execute arbitrary code, escalate privileges, or disrupt services, making it crucial for SOC analysts to monitor and investigate these alerts promptly.
+
+    If confirmed malicious, attackers could exploit this to execute arbitrary code, escalate privileges, or disrupt services, making it crucial for SOC analysts to monitor and investigate these alerts promptly.'
 data_source:
     - Palo Alto Network Threat
-search: |-
-    | tstats `security_content_summariesonly`
-             count min(_time) as firstTime
-                   max(_time) as lastTime
-    FROM datamodel=Web WHERE
-
-    Web.http_method=POST
-    Web.url IN (
-        "*/cgi/logout",
-        "*/cgi/samlart?samlart=*",
-        "*/cgi/samlauth",
-        "*/gwtest/formssso?event=start&target=*",
-        "*/netscaler/ns_gui/vpn/*",
-        "*/saml/activelogin",
-        "*/saml/login"
-    )
-
-    BY Web.http_user_agent Web.status
-       Web.http_method Web.url Web.url_length
-       Web.src Web.dest
-
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `citrix_adc_exploitation_cve_2023_3519_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.http_method="POST" Web.url IN ("*/cgi/logout", "*/cgi/samlart*samlart=", "*/cgi/samlauth", "*/gwtest/formssso*event=start&target=", "*/netscaler/ns_gui/vpn/", "*/saml/activelogin", "*/saml/login") by Web.http_user_agent Web.http_method Web.url Web.url_length Web.src Web.dest | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `citrix_adc_exploitation_cve_2023_3519_filter`
 how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
 known_false_positives: False positives may be present based on organization use of SAML utilities. Filter, or restrict the analytic to Citrix devices only.
 references:
diff --git a/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml b/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml
index 5fdf29e0a01..830a9a6cf63 100644
--- a/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml
+++ b/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml
@@ -9,37 +9,12 @@ type: Hunting
 description: The following analytic detects potentially malicious file upload attempts to Citrix ShareFile via specific suspicious URLs and the HTTP POST method. It leverages the Web datamodel to identify URL patterns such as "/documentum/upload.aspx?parentid=", "/documentum/upload.aspx?filename=", and "/documentum/upload.aspx?uploadId=*", combined with the HTTP POST method. This activity is significant for a SOC as it may indicate an attempt to upload harmful scripts or content, potentially compromising the Documentum application. If confirmed malicious, this could lead to unauthorized access, data breaches, and operational disruptions.
 data_source:
     - Suricata
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/documentum/upload.aspx**" Web.url IN ("*parentid=*", "*filename=*", "*uploadId=*") Web.url IN ("*unzip=*", "*raw=*") Web.http_method="POST" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `citrix_sharefile_exploitation_cve_2023_24489_filter`
+how_to_implement: Dependent upon the placement of the ShareFile application, ensure the latest Technology Add-On is eneabled. This detection requires the Web datamodel to be populated from a supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto. The ShareFile application is IIS based, therefore ingesting IIS logs and reviewing for the same pattern would identify this activity, successful or not.
+known_false_positives: 'False positives may be present, filtering may be needed.
 
-    FROM datamodel=Web WHERE
-
-    Web.url="*/documentum/upload.aspx?*"
-    Web.url IN (
-        "*parentid=*",
-        "*filename=*",
-        "*uploadId=*"
-    )
-    Web.url IN (
-        "*unzip=*",
-        "*raw=*"
-    )
-    Web.http_method=POST
-
-    BY Web.http_user_agent Web.status Web.http_method
-       Web.url Web.url_length Web.src Web.dest
-
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `citrix_sharefile_exploitation_cve_2023_24489_filter`
-how_to_implement: |-
-    Dependent upon the placement of the ShareFile application, ensure the latest Technology Add-On is eneabled. This detection requires the Web datamodel to be populated from a supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto. The ShareFile application is IIS based, therefore ingesting IIS logs and reviewing for the same pattern would identify this activity, successful or not.
-known_false_positives: |-
-    False positives may be present, filtering may be needed.
-    Also, restricting to known web servers running IIS or ShareFile will change this from Hunting to TTP.
+    Also, restricting to known web servers running IIS or ShareFile will change this from Hunting to TTP.'
 references:
     - https://blog.assetnote.io/2023/07/04/citrix-sharefile-rce/
 analytic_story:
diff --git a/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml b/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml
index 5443089e4af..df68a561ec8 100644
--- a/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml
+++ b/detections/web/confluence_cve_2023_22515_trigger_vulnerability.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic identifies potential exploitation attempts of the Confluence CVE-2023-22515 vulnerability. It detects successful accesses (HTTP status 200) to specific vulnerable endpoints by analyzing web logs within the Splunk 'Web' Data Model. This activity is significant for a SOC as it indicates possible privilege escalation attempts in Confluence. If confirmed malicious, attackers could gain unauthorized access or create accounts with escalated privileges, leading to potential data breaches or further exploitation within the environment.
 data_source:
     - Suricata
-search: |-
-    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE Web.url IN ("*/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false*","*/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0&*") Web.http_method=GET Web.status=200
-      BY Web.http_user_agent, Web.status Web.http_method,
-         Web.url, Web.url_length, Web.src,
-         Web.dest, sourcetype
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `confluence_cve_2023_22515_trigger_vulnerability_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url IN ("*/server-info.action*bootstrapStatusProvider.applicationConfig.setupComplete=false*", "*/server-info.action*bootstrapStatusProvider.applicationConfig.setupComplete=0&*") Web.http_method="GET" Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `confluence_cve_2023_22515_trigger_vulnerability_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. Tested with Suricata and nginx:plus:kv.
 known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to Confluence servers.
 references:
@@ -33,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential exploitation attempts on a known vulnerability in Atlassian Confluence detected. The source IP is $src$ and the destination hostname is $dest$.
     entity:
diff --git a/detections/web/confluence_data_center_and_server_privilege_escalation.yml b/detections/web/confluence_data_center_and_server_privilege_escalation.yml
index afadb4dd118..16b1945e0d6 100644
--- a/detections/web/confluence_data_center_and_server_privilege_escalation.yml
+++ b/detections/web/confluence_data_center_and_server_privilege_escalation.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic identifies potential exploitation attempts on a known vulnerability in Atlassian Confluence, specifically targeting the /setup/*.action* URL pattern. It leverages web logs within the Splunk 'Web' Data Model, filtering for successful accesses (HTTP status 200) to these endpoints. This activity is significant as it suggests attackers might be exploiting a privilege escalation flaw in Confluence. If confirmed malicious, it could result in unauthorized access or account creation with escalated privileges, leading to potential data breaches or further exploitation within the environment.
 data_source:
     - Nginx Access
-search: |-
-    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE Web.url IN ("*/setup/setupadministrator.action*", "*/setup/finishsetup.action*", "*/json/setup-restore-local.action*", "*/json/setup-restore-progress.action*", "*/json/setup-restore.action*", "*/bootstrap/selectsetupstep.action*") Web.status=200
-      BY Web.http_user_agent, Web.status Web.http_method,
-         Web.url, Web.url_length, Web.src,
-         Web.dest, sourcetype
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `confluence_data_center_and_server_privilege_escalation_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url IN ("*/setup/setupadministrator.action*", "*/setup/finishsetup.action*", "*/json/setup-restore-local.action*", "*/json/setup-restore-progress.action*", "*/json/setup-restore.action*", "*/bootstrap/selectsetupstep.action*") Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `confluence_data_center_and_server_privilege_escalation_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
 known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to confluence servers.
 references:
@@ -34,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential exploitation attempts on a known vulnerability in Atlassian Confluence detected. The source IP is $src$ and the destination hostname is $dest$.
     entity:
diff --git a/detections/web/confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527.yml b/detections/web/confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527.yml
index 047336629a1..9b39ad7fc80 100644
--- a/detections/web/confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527.yml
+++ b/detections/web/confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic identifies attempts to exploit a critical template injection vulnerability (CVE-2023-22527) in outdated Confluence Data Center and Server versions. It detects POST requests to the "/template/aui/text-inline.vm" endpoint with HTTP status codes 200 or 202, indicating potential OGNL injection attacks. This activity is significant as it allows unauthenticated attackers to execute arbitrary code remotely. If confirmed malicious, attackers could gain full control over the affected Confluence instance, leading to data breaches, system compromise, and further network infiltration. Immediate patching is essential to mitigate this threat.
 data_source:
     - Suricata
-search: |-
-    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE Web.url="*/template/aui/text-inline.vm*" Web.http_method=POST Web.status IN (200, 202)
-      BY Web.src, Web.dest, Web.http_user_agent,
-         Web.url, Web.status
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/template/aui/text-inline.vm*" Web.http_method="POST" Web.status IN ("200", "202") by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
 known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to confluence servers.
 references:
@@ -31,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Exploitation attempts on a known vulnerability in Atlassian Confluence detected. The source IP is $src$ and the destination hostname is $dest$.
     entity:
diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml
index 6ef1361b8d0..626255d3c89 100644
--- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml
+++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml
@@ -6,49 +6,13 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence. It leverages the Web datamodel to analyze network and CIM-compliant web logs, identifying suspicious URL patterns and parameters indicative of exploitation attempts. This activity is significant as it allows attackers to execute arbitrary code on the Confluence server without authentication, potentially leading to full system compromise. If confirmed malicious, this could result in unauthorized access, data exfiltration, and further lateral movement within the network. Immediate investigation and remediation are crucial to prevent extensive damage.
+description: The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence. It leverages the Web datamodel to analyze network and CIM-compliant web logs, identifying suspicious URL patterns and parameters indicative of exploitation attempts. This activity is significant as it allows attackers to execute arbitrary code on the Confluence server without authentication, potentially leading to full system compromise. If confirmed malicious, this could result in unauthorized access, data exfiltration, and further lateral movement within the network. Immediate investigation and remediation are crucial to prevent extensive damage.
 data_source:
     - Palo Alto Network Threat
-search: |-
-    | tstats `security_content_summariesonly`
-             count min(_time) as firstTime
-                   max(_time) as lastTime
-
-    FROM datamodel=Web WHERE
-
-    Web.url IN (
-        "*${*",
-        "*%2F%7B*"
-    )
-    AND
-    (
-        (
-            Web.url="*org.apache.commons.io.IOUtils*"
-            Web.url="*java.lang.Runtime@getRuntime().exec*"
-        )
-        OR
-        (
-            Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*"
-        )
-        OR
-        (
-            Web.url="*getEngineByName*"
-            Web.url="*nashorn*"
-            Web.url="*ProcessBuilder*"
-        )
-    )
-    BY Web.http_user_agent Web.http_method
-       Web.url,Web.url_length
-       Web.src, Web.dest sourcetype
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter`
-how_to_implement: |
-    This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache or Splunk for Nginx. In addition, network based logs or event data like PAN Threat.
-known_false_positives: |
-    Tune based on assets if possible, or restrict to known Confluence servers. Remove the ${ for a more broad query. To identify more exec, remove everything up to the last parameter (Runtime().exec) for a broad query.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*getEngineByName*" Web.url="*nashorn*" Web.url="*ProcessBuilder*") OR Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*" by Web.http_user_agent Web.http_method Web.url Web.url_length Web.src Web.dest | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter`
+how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache or Splunk for Nginx. In addition, network based logs or event data like PAN Threat.
+known_false_positives: Tune based on assets if possible, or restrict to known Confluence servers. Remove the ${ for a more broad query. To identify more exec, remove everything up to the last parameter (Runtime().exec) for a broad query.
 references:
     - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
     - https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html
@@ -62,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A URL was requested related to CVE-2022-26134, a unauthenticated remote code execution vulnerability,  on $dest$ by $src$.
     entity:
diff --git a/detections/web/connectwise_screenconnect_authentication_bypass.yml b/detections/web/connectwise_screenconnect_authentication_bypass.yml
index 6f3d4055046..c568cacc98b 100644
--- a/detections/web/connectwise_screenconnect_authentication_bypass.yml
+++ b/detections/web/connectwise_screenconnect_authentication_bypass.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows attackers to bypass authentication via an alternate path or channel. It leverages web request logs to identify access to the SetupWizard.aspx page, indicating potential exploitation. This activity is significant as it can lead to unauthorized administrative access and remote code execution. If confirmed malicious, attackers could create administrative users and gain full control over the affected system, posing severe security risks. Immediate remediation by updating to version 23.9.8 or above is recommended.
 data_source:
     - Suricata
-search: |-
+search: |
     | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
       WHERE Web.url IN ("*/SetupWizard.aspx/*","*/SetupWizard/") Web.status=200 Web.http_method=POST
       BY Web.src, Web.dest, Web.http_user_agent,
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An authentication bypass attempt against ScreenConnect has been detected on $dest$.
     entity:
@@ -60,6 +60,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/screenconnect/connectwise_auth_suricata.log
-          sourcetype: suricata
           source: not_applicable
+          sourcetype: suricata
       test_type: unit
diff --git a/detections/web/crushftp_authentication_bypass_exploitation.yml b/detections/web/crushftp_authentication_bypass_exploitation.yml
index 58545166f2e..128f3597b05 100644
--- a/detections/web/crushftp_authentication_bypass_exploitation.yml
+++ b/detections/web/crushftp_authentication_bypass_exploitation.yml
@@ -9,7 +9,8 @@ type: TTP
 description: The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). This detection identifies suspicious command execution patterns associated with exploitation of this vulnerability, such as executing mesch.exe with specific arguments like b64exec or fullinstall. This activity is indicative of an attacker exploiting CVE-2025-31161 to gain unauthorized access to the CrushFTP server and perform post-exploitation activities.
 data_source:
     - CrushFTP
-search: '`crushftp` | rex field=_raw "\\[HTTP:[^:]+:(?<user>[^:]+):(?<src_ip>[^\\]]+)\\]" | rex field=_raw "cmd:(?<process>[^\\*\\r\\n]+)" | where isnotnull(process) AND (match(process, "mesch\.exe") OR match(process, "b64exec") OR match(process, "fullinstall") OR match(process, "run")) | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, user, process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `crushftp_authentication_bypass_exploitation_filter`'
+search: |
+    `crushftp` | rex field=_raw "\\[HTTP:[^:]+:(?<user>[^:]+):(?<src_ip>[^\\]]+)\\]" | rex field=_raw "cmd:(?<process>[^\\*\\r\\n]+)" | where isnotnull(process) AND (match(process, "mesch\.exe") OR match(process, "b64exec") OR match(process, "fullinstall") OR match(process, "run")) | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, user, process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `crushftp_authentication_bypass_exploitation_filter`
 how_to_implement: To implement this detection, you need to ingest CrushFTP logs into your Splunk environment. Configure CrushFTP to forward logs to Splunk via a syslog forwarder or direct file monitoring. This detection searches for CrushFTP logs containing suspicious command execution patterns commonly associated with exploitation of the CVE-2025-31161 vulnerability.
 known_false_positives: False positives may occur if there are legitimate administrative commands being executed on the CrushFTP server that match the suspicious patterns. Review the commands being executed to determine if the activity is legitimate administrative work or potential malicious activity.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential CrushFTP authentication bypass exploitation from IP $src_ip$ as user $user$
     entity:
@@ -60,6 +61,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/crushftp/crushftp11_session.log
-          sourcetype: crushftp:sessionlogs
           source: crushftp
+          sourcetype: crushftp:sessionlogs
       test_type: unit
diff --git a/detections/web/crushftp_max_simultaneous_users_from_ip.yml b/detections/web/crushftp_max_simultaneous_users_from_ip.yml
index 58f97fc476a..bca654e3b91 100644
--- a/detections/web/crushftp_max_simultaneous_users_from_ip.yml
+++ b/detections/web/crushftp_max_simultaneous_users_from_ip.yml
@@ -9,7 +9,8 @@ type: Anomaly
 description: The following analytic identifies instances where CrushFTP has blocked access due to exceeding the maximum number of simultaneous connections from a single IP address. This activity may indicate brute force attempts, credential stuffing, or automated attacks against the CrushFTP server. This detection is particularly relevant following the discovery of CVE-2025-31161, an authentication bypass vulnerability in CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0.
 data_source:
     - CrushFTP
-search: '`crushftp` "*User access not allowed.  Max simultaneous users from your IP*" | rex field=_raw "SESSION\\|\\d+\\/\\d+\\/\\d+ \\d+:\\d+:\\d+\\.\\d+\\|\\[HTTP:[^:]+:(?<user>[^:]+):(?<src_ip>[0-9\\.]+)\\]" | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by src_ip | where count >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `crushftp_max_simultaneous_users_from_ip_filter`'
+search: |
+    `crushftp` "*User access not allowed.  Max simultaneous users from your IP*" | rex field=_raw "SESSION\\|\\d+\\/\\d+\\/\\d+ \\d+:\\d+:\\d+\\.\\d+\\|\\[HTTP:[^:]+:(?<user>[^:]+):(?<src_ip>[0-9\\.]+)\\]" | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by src_ip | where count >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `crushftp_max_simultaneous_users_from_ip_filter`
 how_to_implement: To implement this detection, you need to ingest CrushFTP logs into your Splunk environment. Configure CrushFTP to forward logs to Splunk via a syslog forwarder or direct file monitoring. Ensure the sourcetype is correctly set for the CrushFTP logs. The detection requires the SESSION field and the "[HTTP:*:user:IP]" format in the logs. Adjust the threshold in the "where count >= 3" clause based on your environment's normal behavior.
 known_false_positives: In environments where multiple users legitimately access CrushFTP from behind the same NAT or proxy, this may generate false positives. Tune the threshold based on your organization's usage patterns.
 references:
@@ -24,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src_ip
@@ -52,6 +53,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/crushftp/crushftp11_session.log
-          sourcetype: crushftp:sessionlogs
           source: crushftp
+          sourcetype: crushftp:sessionlogs
       test_type: unit
diff --git a/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml b/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml
index 7746659bcdd..3bf0289b0cf 100644
--- a/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml
+++ b/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic identifies specific GET or HEAD requests to web servers that indicate reconnaissance attempts to find vulnerable JBoss servers. It leverages data from the Web data model, focusing on HTTP methods and URLs associated with JBoss management interfaces. This activity is significant because it often precedes exploitation attempts using tools like JexBoss, which can compromise the server. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, or escalate privileges, leading to potential data breaches and system compromise.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
       WHERE (
             Web.http_method="GET"
diff --git a/detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml b/detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml
index 892d5d0dcdd..336ec100394 100644
--- a/detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml
+++ b/detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic identifies malicious HTTP requests targeting the jmx-console in JBoss servers. It detects unusually long URLs, indicative of embedded payloads, by analyzing web server logs for GET or HEAD requests with specific URL patterns and lengths. This activity is significant as it may indicate an attempt to exploit JBoss vulnerabilities, potentially leading to unauthorized remote code execution. If confirmed malicious, attackers could gain control over the server, escalate privileges, and compromise sensitive data, posing a severe threat to the organization's security.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
       WHERE (
             Web.http_method="GET"
diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml
index 228dd2e6a28..6501eb66f6f 100644
--- a/detections/web/detect_remote_access_software_usage_url.yml
+++ b/detections/web/detect_remote_access_software_usage_url.yml
@@ -6,10 +6,11 @@ modification_date: '2026-09-22'
 author: Steven Dick
 status: production
 type: Anomaly
-description: |
-    The following analytic detects the execution of known remote access software within the environment.
+description: 'The following analytic detects the execution of known remote access software within the environment.
+
     It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
-    This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, posing a severe security risk.
+
+    This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, posing a severe security risk.'
 data_source:
     - Palo Alto Network Threat
 search: |
@@ -40,10 +41,8 @@ search: |
     | search isutility = True
     | `remote_access_software_usage_exceptions`
     | `detect_remote_access_software_usage_url_filter`
-how_to_implement: |
-    The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections.
-known_false_positives: |
-    It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
+how_to_implement: The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections.
+known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
 references:
     - https://attack.mitre.org/techniques/T1219/
     - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -56,7 +55,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: Investigate traffic to $url_domain$
       search: '| from datamodel:Web | search src=$src$ url_domain=$url_domain$'
       earliest_offset: $info_min_time$
diff --git a/detections/web/detect_web_access_to_decommissioned_s3_bucket.yml b/detections/web/detect_web_access_to_decommissioned_s3_bucket.yml
index c1ba53696ca..9557a2fb364 100644
--- a/detections/web/detect_web_access_to_decommissioned_s3_bucket.yml
+++ b/detections/web/detect_web_access_to_decommissioned_s3_bucket.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This detection identifies web requests to domains that match previously decommissioned S3 buckets through web proxy logs. This activity is significant because attackers may attempt to access or recreate deleted S3 buckets that were previously public to hijack them for malicious purposes. If successful, this could allow attackers to host malicious content or exfiltrate data through compromised bucket names that may still be referenced by legitimate applications.
 data_source:
     - AWS Cloudfront
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Web.http_method) as http_method values(Web.http_user_agent) as http_user_agent values(Web.url) as url values(Web.user) as user FROM datamodel=Web
       WHERE Web.url_domain!=""
       BY Web.src Web.url_domain
@@ -63,12 +63,12 @@ tests:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/decommissioned_buckets/cloudtrail.json
           source: cloudtrail
           sourcetype: aws:cloudtrail
-      test_type: experimental
       description: This test is a legacy experimental test and may not be accurate.
+      test_type: experimental
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/decommissioned_buckets/web_cloudfront_access.log
           source: aws_cloudfront_accesslogs
           sourcetype: aws:cloudfront:accesslogs
-      test_type: experimental
       description: This test is a legacy experimental test and may not be accurate.
+      test_type: experimental
diff --git a/detections/web/exploit_public_facing_application_via_apache_commons_text.yml b/detections/web/exploit_public_facing_application_via_apache_commons_text.yml
index e05c85e1a5f..17f9e092c73 100644
--- a/detections/web/exploit_public_facing_application_via_apache_commons_text.yml
+++ b/detections/web/exploit_public_facing_application_via_apache_commons_text.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects attempts to exploit the CVE-2022-42889 vulnerability in the Apache Commons Text Library, known as Text4Shell. It leverages the Web datamodel to identify suspicious HTTP requests containing specific lookup keys (url, dns, script) that can lead to Remote Code Execution (RCE). This activity is significant as it targets a critical vulnerability that can allow attackers to execute arbitrary code on the server. If confirmed malicious, this could lead to full system compromise, data exfiltration, or further lateral movement within the network.
 data_source:
     - Nginx Access
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
       WHERE Web.http_method IN (POST, GET)
       BY Web.src Web.status Web.uri_path
@@ -42,7 +42,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/web/exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml b/detections/web/exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml
index c84a9b08289..531da53e0f9 100644
--- a/detections/web/exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml
+++ b/detections/web/exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml
@@ -6,33 +6,19 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects attempts to exploit the Fortinet FortiNAC CVE-2022-39952 vulnerability. It identifies HTTP POST requests to the URI configWizard/keyUpload.jsp with a payload.zip file.
+description: 'The following analytic detects attempts to exploit the Fortinet FortiNAC CVE-2022-39952 vulnerability. It identifies HTTP POST requests to the URI configWizard/keyUpload.jsp with a payload.zip file.
+
     The detection leverages the Web datamodel, analyzing fields such as URL, HTTP method, and user agent.
+
     This activity is significant as it indicates an attempt to exploit a known vulnerability, potentially leading to remote code execution.
-    If confirmed malicious, attackers could gain control over the affected system, schedule malicious tasks, and establish persistent access via a remote command and control (C2) server.
+
+    If confirmed malicious, attackers could gain control over the affected system, schedule malicious tasks, and establish persistent access via a remote command and control (C2) server.'
 data_source:
     - Palo Alto Network Threat
-search: |-
-    | tstats `security_content_summariesonly`
-             count min(_time) as firstTime
-                   max(_time) as lastTime
-
-    FROM datamodel=Web WHERE
-
-    Web.url IN ("*configWizard/keyUpload.jsp*")
-
-    BY Web.http_user_agent Web.status
-       Web.http_method Web.url Web.url_length
-       Web.src Web.dest
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `exploit_public_facing_fortinet_fortinac_cve_2022_39952_filter`
-how_to_implement: |
-    This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
-known_false_positives: |
-    False positives may be present. Modify the query as needed to POST, or add additional filtering (based on log source).
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*configWizard/keyUpload.jsp*" by Web.http_user_agent Web.http_method Web.url Web.url_length Web.src Web.dest | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `exploit_public_facing_fortinet_fortinac_cve_2022_39952_filter`
+how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
+known_false_positives: False positives may be present. Modify the query as needed to POST, or add additional filtering (based on log source).
 references:
     - https://github.com/horizon3ai/CVE-2022-39952
     - https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/
@@ -45,7 +31,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential CVE-2022-39952 against a Fortinet NAC may be occurring against $dest$.
     entity:
diff --git a/detections/web/f5_tmui_authentication_bypass.yml b/detections/web/f5_tmui_authentication_bypass.yml
index 916587c5cd6..ef79346a503 100644
--- a/detections/web/f5_tmui_authentication_bypass.yml
+++ b/detections/web/f5_tmui_authentication_bypass.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects attempts to exploit the CVE-2023-46747 vulnerability, an authentication bypass flaw in F5 BIG-IP's Configuration utility (TMUI). It identifies this activity by monitoring for specific URI paths such as "*/mgmt/tm/auth/user/*" with the PATCH method and a 200 status code. This behavior is significant for a SOC as it indicates potential unauthorized access attempts, leading to remote code execution. If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary code, steal data, disrupt systems, or conduct further malicious activities within the network.
 data_source:
     - Suricata
-search: |-
-    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE Web.url IN ("*/mgmt/tm/auth/user/*") Web.http_method=PATCH Web.status=200
-      BY Web.http_user_agent, Web.status Web.http_method,
-         Web.url, Web.url_length, Web.src,
-         Web.dest, sourcetype
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `f5_tmui_authentication_bypass_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/mgmt/tm/auth/user/*" Web.http_method="PATCH" Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `f5_tmui_authentication_bypass_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relevant for traffic into the `Web` datamodel.
 known_false_positives: False positives should be limited to as this is strict to active exploitation. Reduce noise by filtering to F5 devices with TMUI enabled or filter data as needed.
 references:
@@ -32,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential CVE-2023-46747 F5 TMUI Authentication Bypass may be occurring against $dest$ from $src$.
     entity:
diff --git a/detections/web/fortinet_appliance_auth_bypass.yml b/detections/web/fortinet_appliance_auth_bypass.yml
index 84c3b3fe49b..296591c27c3 100644
--- a/detections/web/fortinet_appliance_auth_bypass.yml
+++ b/detections/web/fortinet_appliance_auth_bypass.yml
@@ -6,37 +6,25 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects attempts to exploit CVE-2022-40684, a Fortinet appliance authentication bypass vulnerability.
+description: 'The following analytic detects attempts to exploit CVE-2022-40684, a Fortinet appliance authentication bypass vulnerability.
+
     It identifies REST API requests to the /api/v2/ endpoint using various HTTP methods (GET, POST, PUT, DELETE) that may indicate unauthorized modifications, such as adding SSH keys or creating new users.
+
     This detection leverages the Web datamodel to monitor specific URL patterns and HTTP methods.
+
     This activity is significant as it can lead to unauthorized access and control over the appliance.
-    If confirmed malicious, attackers could gain persistent access, reroute network traffic, or capture sensitive information.
+
+    If confirmed malicious, attackers could gain persistent access, reroute network traffic, or capture sensitive information.'
 data_source:
     - Palo Alto Network Threat
-search: |-
-    | tstats `security_content_summariesonly`
-             count min(_time) as firstTime
-                   max(_time) as lastTime
-
-    FROM datamodel=Web WHERE
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/api/v2/cmdb/system/admin*" Web.http_method IN ("GET", "PUT") by Web.http_user_agent Web.http_method Web.url Web.url_length Web.src Web.dest | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `fortinet_appliance_auth_bypass_filter`
+how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache. Splunk for Nginx, or Splunk for Palo Alto.
+known_false_positives: 'GET requests will be noisy and need to be filtered out or removed from the query based on volume.
 
-    Web.url = "*/api/v2/cmdb/system/admin*"
-    Web.http_method IN ("GET", "PUT")
-    BY Web.http_user_agent
-       Web.http_method Web.url
-       Web.url_length
-       Web.src Web.dest
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `fortinet_appliance_auth_bypass_filter`
-how_to_implement: |
-    This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache. Splunk for Nginx, or Splunk for Palo Alto.
-known_false_positives: |
-    GET requests will be noisy and need to be filtered out or removed from the query based on volume.
     Restrict analytic to known publicly facing Fortigates, or run analytic as a Hunt until properly tuned.
-    It is also possible the user agent may be filtered on Report Runner or Node.js only for the exploit, however, it is unknown at this if other user agents may be used.
+
+    It is also possible the user agent may be filtered on Report Runner or Node.js only for the exploit, however, it is unknown at this if other user agents may be used.'
 references:
     - https://www.wordfence.com/blog/2022/10/threat-advisory-cve-2022-40684-fortinet-appliance-auth-bypass/
     - https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/
@@ -52,7 +40,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential CVE-2022-40684 against a Fortinet appliance may be occurring against $dest$.
     entity:
diff --git a/detections/web/high_volume_of_bytes_out_to_url.yml b/detections/web/high_volume_of_bytes_out_to_url.yml
index 8c5b06ad706..47b2fc51762 100644
--- a/detections/web/high_volume_of_bytes_out_to_url.yml
+++ b/detections/web/high_volume_of_bytes_out_to_url.yml
@@ -9,13 +9,8 @@ type: Anomaly
 description: The following analytic detects a high volume of outbound web traffic, specifically over 1GB of data sent to a URL within a 2-minute window. It leverages the Web data model to identify significant uploads by analyzing the sum of bytes out. This activity is significant as it may indicate potential data exfiltration by malware or malicious insiders. If confirmed as malicious, this behavior could lead to unauthorized data transfer, resulting in data breaches and loss of sensitive information. Immediate investigation is required to determine the legitimacy of the transfer and mitigate any potential threats.
 data_source:
     - Nginx Access
-search: |-
-    | tstats  `security_content_summariesonly` count sum(Web.bytes_out) as sum_bytes_out values(Web.user) as user values(Web.app) as app values(Web.dest) as dest FROM datamodel=Web
-      BY _time span=2m Web.url
-         Web.src sourcetype
-    | search sum_bytes_out > 1070000000
-    | `drop_dm_object_name("Web")`
-    | `high_volume_of_bytes_out_to_url_filter`
+search: |
+    `nginx_access_logs` sum_bytes_out>1070000000 | eval dest='Web.dest' | stats count min(_time) as firstTime max(_time) as lastTime by sum_bytes_out src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `high_volume_of_bytes_out_to_url_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. Please adjust the threshold for the sum of bytes out as per your environment and user behavior.
 known_false_positives: This search may trigger false positives if there is a legitimate reason for a high volume of bytes out to a URL. We recommend to investigate these findings. Consider updating the filter macro to exclude the applications that are relevant to your environment.
 references:
@@ -30,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/web/http_duplicated_header.yml b/detections/web/http_duplicated_header.yml
index 6bd1e5c336e..fa1ecd9229f 100644
--- a/detections/web/http_duplicated_header.yml
+++ b/detections/web/http_duplicated_header.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: Detects when a request has more than one of the same header. This is commonly used in request smuggling and other web based attacks. HTTP Request Smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP requests by using ambiguous or malformed headers to hide malicious requests within legitimate ones. Attackers leverage duplicate headers, particularly Content-Length and Transfer-Encoding, to cause different servers in the chain to disagree on where one request ends and another begins. RFC7230 states that a sender MUST NOT generate multiple header fields with the same field name in a message unless either the entire field value for that header field is defined as a comma-separated list or the header field is a well-known exception.
 data_source:
     - Suricata
-search: |-
+search: |
     `suricata` http.request_headers{}.name="*"
       | rename dest_ip as dest
       | spath path=http.request_headers{}.name output=header_names
@@ -38,7 +38,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
@@ -64,6 +64,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/request_smuggling/suricata_request_smuggling.log
-          sourcetype: suricata
           source: not_applicable
+          sourcetype: suricata
       test_type: unit
diff --git a/detections/web/http_possible_request_smuggling.yml b/detections/web/http_possible_request_smuggling.yml
index de378fa4d0a..e5063d70d09 100644
--- a/detections/web/http_possible_request_smuggling.yml
+++ b/detections/web/http_possible_request_smuggling.yml
@@ -9,7 +9,7 @@ type: TTP
 description: HTTP request smuggling is a technique for interfering with the way a web site processes sequences of HTTP requests that are received from one or more users. Request smuggling vulnerabilities are often critical in nature, allowing an attacker to bypass security controls, gain unauthorized access to sensitive data, and directly compromise other application users. This detection identifies a common request smuggling technique of using both Content-Length and Transfer-Encoding headers to cause a parsing confusion between the frontend and backend.
 data_source:
     - Suricata
-search: |-
+search: |
     `suricata` (http.request_headers{}.name="*Content-Length*" http.request_headers{}.name="*Transfer-Encoding*") OR (http.request_headers{}.name="*Content-Length*" http.request_headers{}.value="*Transfer-Encoding*") OR (http.request_headers{}.value="*Content-Length*" http.request_headers{}.name="*Transfer-Encoding*") OR (http.request_headers{}.name="*Content-Length*" http.request_headers{}.value="0")
       | rename dest_ip as dest
       | rex field=_raw "request_headers.:\[(?<headers>.*)\]"
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible request smuggling against a web request was detected. The source IP is $src_ip$ and the destination is $dest$.
     entity:
@@ -60,6 +60,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/request_smuggling/suricata_request_smuggling.log
-          sourcetype: suricata
           source: not_applicable
+          sourcetype: suricata
       test_type: unit
diff --git a/detections/web/http_rapid_post_with_mixed_status_codes.yml b/detections/web/http_rapid_post_with_mixed_status_codes.yml
index 091004d01a7..990cc181b1e 100644
--- a/detections/web/http_rapid_post_with_mixed_status_codes.yml
+++ b/detections/web/http_rapid_post_with_mixed_status_codes.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This detection identifies rapid-fire POST request attacks where an attacker sends more than 20 POST requests within a 5-second window, potentially attempting to exploit race conditions or overwhelm request handling. The pattern is particularly suspicious when responses vary in size or status codes, indicating successful exploitation attempts or probing for vulnerable endpoints.
 data_source:
     - Nginx Access
-search: |-
+search: |
     `nginx_access_logs` http_method="POST"
       | bin _time span=5s
       | rename dest_ip as dest
@@ -34,7 +34,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/web/http_request_to_reserved_name_on_iis_server.yml b/detections/web/http_request_to_reserved_name_on_iis_server.yml
index 5e96182705a..63cfc8864dc 100644
--- a/detections/web/http_request_to_reserved_name_on_iis_server.yml
+++ b/detections/web/http_request_to_reserved_name_on_iis_server.yml
@@ -6,12 +6,12 @@ modification_date: '2026-05-13'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: |-
-    Detects attempts to exploit a request smuggling technique against IIS that leverages a Windows quirk where requests for reserved Windows device names such as "/con" trigger an early server response before the request body is received.
-    When combined with a Content-Length desynchronization, this behavior can lead to a parsing confusion between frontend and backend.
+description: 'Detects attempts to exploit a request smuggling technique against IIS that leverages a Windows quirk where requests for reserved Windows device names such as "/con" trigger an early server response before the request body is received.
+
+    When combined with a Content-Length desynchronization, this behavior can lead to a parsing confusion between frontend and backend.'
 data_source:
     - Suricata
-search: |-
+search: |
     | tstats `security_content_summariesonly`
       count min(_time) as firstTime
             max(_time) as lastTime
@@ -56,11 +56,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `http_request_to_reserved_name_on_iis_server_filter`
-how_to_implement: |-
-    To implement this analytic, ensure proper logging is occurring with IIS, Apache, or a Proxy server and that these logs are being ingested into Splunk. The analytic was written against Suricata. The proper TA will need to be enabled and should be mapped to CIM and the Web datamodel. Ingestion of the data source is required to utilize this detection. In addition, if it is not mapped to the datamodel, modify the query for your application logs to look for requests the same URI and investigate further.
-known_false_positives: |-
-    False positives are not expected on IIS servers, as the detection is based on the presence of web requests to reserved names, which is not a common page to be accessed by legitimate users.
-    Modify the query as needed to reduce false positives or hunt for additional indicators of compromise.
+how_to_implement: To implement this analytic, ensure proper logging is occurring with IIS, Apache, or a Proxy server and that these logs are being ingested into Splunk. The analytic was written against Suricata. The proper TA will need to be enabled and should be mapped to CIM and the Web datamodel. Ingestion of the data source is required to utilize this detection. In addition, if it is not mapped to the datamodel, modify the query for your application logs to look for requests the same URI and investigate further.
+known_false_positives: 'False positives are not expected on IIS servers, as the detection is based on the presence of web requests to reserved names, which is not a common page to be accessed by legitimate users.
+
+    Modify the query as needed to reduce false positives or hunt for additional indicators of compromise.'
 references:
     - https://portswigger.net/web-security/request-smuggling#what-is-http-request-smuggling
     - https://portswigger.net/research/http1-must-die
@@ -74,7 +73,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Known scripting tool was used against a web request. The source IP is $src$ and the destination is $dest$.
     entity:
@@ -100,6 +99,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/request_smuggling/suricata_reserved_names.log
-          sourcetype: suricata
           source: not_applicable
+          sourcetype: suricata
       test_type: unit
diff --git a/detections/web/http_scripting_tool_user_agent.yml b/detections/web/http_scripting_tool_user_agent.yml
index 2a3328ef834..c06de26e857 100644
--- a/detections/web/http_scripting_tool_user_agent.yml
+++ b/detections/web/http_scripting_tool_user_agent.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This Splunk query analyzes web access logs to identify and categorize non-browser user agents, detecting various types of security tools, scripting languages, automation frameworks, and suspicious patterns. This activity can signify malicious actors attempting to interact with web endpoints in non-standard ways.
 data_source:
     - Nginx Access
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
     from datamodel=Web where
     Web.http_user_agent =*
@@ -49,7 +49,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/web/hunting_for_log4shell.yml b/detections/web/hunting_for_log4shell.yml
index d2c918a53c8..a8966cabf56 100644
--- a/detections/web/hunting_for_log4shell.yml
+++ b/detections/web/hunting_for_log4shell.yml
@@ -9,7 +9,8 @@ type: Hunting
 description: The following analytic detects potential exploitation attempts of the Log4Shell vulnerability (CVE-2021-44228) by analyzing HTTP headers for specific patterns. It leverages the Web Datamodel and evaluates various indicators such as the presence of `{jndi:`, environment variables, and common URI paths. This detection is significant as Log4Shell allows remote code execution, posing a severe threat to systems. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and potentially compromise sensitive data, leading to extensive damage and data breaches.
 data_source:
     - Nginx Access
-search: '| from datamodel Web.Web | eval jndi=if(match(_raw, "(\{|%7B)[jJnNdDiI]{4}:"),4,0) | eval jndi_fastmatch=if(match(_raw, "[jJnNdDiI]{4}"),2,0) | eval jndi_proto=if(match(_raw,"(?i)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http|https):"),5,0) | eval all_match = if(match(_raw, "(?i)(%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{)(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)[^\n]+"),5,0) | eval env_var = if(match(_raw, "env:") OR match(_raw, "env:AWS_ACCESS_KEY_ID") OR match(_raw, "env:AWS_SECRET_ACCESS_KEY"),5,0) | eval uridetect = if(match(_raw, "(?i)Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass"),4,0) | eval keywords = if(match(_raw,"(?i)\$\{ctx\:loginId\}|\$\{map\:type\}|\$\{filename\}|\$\{date\:MM-dd-yyyy\}|\$\{docker\:containerId\}|\$\{docker\:containerName\}|\$\{docker\:imageName\}|\$\{env\:USER\}|\$\{event\:Marker\}|\$\{mdc\:UserId\}|\$\{java\:runtime\}|\$\{java\:vm\}|\$\{java\:os\}|\$\{jndi\:logging/context-name\}|\$\{hostName\}|\$\{docker\:containerId\}|\$\{k8s\:accountName\}|\$\{k8s\:clusterName\}|\$\{k8s\:containerId\}|\$\{k8s\:containerName\}|\$\{k8s\:host\}|\$\{k8s\:labels.app\}|\$\{k8s\:labels.podTemplateHash\}|\$\{k8s\:masterUrl\}|\$\{k8s\:namespaceId\}|\$\{k8s\:namespaceName\}|\$\{k8s\:podId\}|\$\{k8s\:podIp\}|\$\{k8s\:podName\}|\$\{k8s\:imageId\}|\$\{k8s\:imageName\}|\$\{log4j\:configLocation\}|\$\{log4j\:configParentLocation\}|\$\{spring\:spring.application.name\}|\$\{main\:myString\}|\$\{main\:0\}|\$\{main\:1\}|\$\{main\:2\}|\$\{main\:3\}|\$\{main\:4\}|\$\{main\:bar\}|\$\{name\}|\$\{marker\}|\$\{marker\:name\}|\$\{spring\:profiles.active[0]|\$\{sys\:logPath\}|\$\{web\:rootDir\}|\$\{sys\:user.name\}"),4,0) | eval obf = if(match(_raw, "(\$|%24)[^ /]*({|%7b)[^ /]*(j|%6a)[^ /]*(n|%6e)[^ /]*(d|%64)[^ /]*(i|%69)[^ /]*(:|%3a)[^ /]*(:|%3a)[^ /]*(/|%2f)"),5,0) | eval lookups = if(match(_raw, "(?i)({|%7b)(main|sys|k8s|spring|lower|upper|env|date|sd)"),4,0)  | addtotals fieldname=Score, jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, obf, lookups | where Score > 2 | stats values(Score) by  jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, lookups, obf, dest, src, http_method, _raw | `hunting_for_log4shell_filter`'
+search: |
+    | from datamodel Web.Web | eval jndi=if(match(_raw, "(\{|%7B)[jJnNdDiI]{4}:"),4,0) | eval jndi_fastmatch=if(match(_raw, "[jJnNdDiI]{4}"),2,0) | eval jndi_proto=if(match(_raw,"(?i)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http|https):"),5,0) | eval all_match = if(match(_raw, "(?i)(%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{)(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)[^\n]+"),5,0) | eval env_var = if(match(_raw, "env:") OR match(_raw, "env:AWS_ACCESS_KEY_ID") OR match(_raw, "env:AWS_SECRET_ACCESS_KEY"),5,0) | eval uridetect = if(match(_raw, "(?i)Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass"),4,0) | eval keywords = if(match(_raw,"(?i)\$\{ctx\:loginId\}|\$\{map\:type\}|\$\{filename\}|\$\{date\:MM-dd-yyyy\}|\$\{docker\:containerId\}|\$\{docker\:containerName\}|\$\{docker\:imageName\}|\$\{env\:USER\}|\$\{event\:Marker\}|\$\{mdc\:UserId\}|\$\{java\:runtime\}|\$\{java\:vm\}|\$\{java\:os\}|\$\{jndi\:logging/context-name\}|\$\{hostName\}|\$\{docker\:containerId\}|\$\{k8s\:accountName\}|\$\{k8s\:clusterName\}|\$\{k8s\:containerId\}|\$\{k8s\:containerName\}|\$\{k8s\:host\}|\$\{k8s\:labels.app\}|\$\{k8s\:labels.podTemplateHash\}|\$\{k8s\:masterUrl\}|\$\{k8s\:namespaceId\}|\$\{k8s\:namespaceName\}|\$\{k8s\:podId\}|\$\{k8s\:podIp\}|\$\{k8s\:podName\}|\$\{k8s\:imageId\}|\$\{k8s\:imageName\}|\$\{log4j\:configLocation\}|\$\{log4j\:configParentLocation\}|\$\{spring\:spring.application.name\}|\$\{main\:myString\}|\$\{main\:0\}|\$\{main\:1\}|\$\{main\:2\}|\$\{main\:3\}|\$\{main\:4\}|\$\{main\:bar\}|\$\{name\}|\$\{marker\}|\$\{marker\:name\}|\$\{spring\:profiles.active[0]|\$\{sys\:logPath\}|\$\{web\:rootDir\}|\$\{sys\:user.name\}"),4,0) | eval obf = if(match(_raw, "(\$|%24)[^ /]*({|%7b)[^ /]*(j|%6a)[^ /]*(n|%6e)[^ /]*(d|%64)[^ /]*(i|%69)[^ /]*(:|%3a)[^ /]*(:|%3a)[^ /]*(/|%2f)"),5,0) | eval lookups = if(match(_raw, "(?i)({|%7b)(main|sys|k8s|spring|lower|upper|env|date|sd)"),4,0)  | addtotals fieldname=Score, jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, obf, lookups | where Score > 2 | stats values(Score) by  jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, lookups, obf, dest, src, http_method, _raw | `hunting_for_log4shell_filter`
 how_to_implement: Out of the box, the Web datamodel is required to be pre-filled. However, tested was performed against raw httpd access logs. Change the first line to any dataset to pass the regex's against.
 known_false_positives: It is highly possible you will find false positives, however, the base score is set to 2 for _any_ jndi found in raw logs. tune and change as needed, include any filtering.
 references:
diff --git a/detections/web/ivanti_connect_secure_command_injection_attempts.yml b/detections/web/ivanti_connect_secure_command_injection_attempts.yml
index 733e059b4a8..dda46f8e796 100644
--- a/detections/web/ivanti_connect_secure_command_injection_attempts.yml
+++ b/detections/web/ivanti_connect_secure_command_injection_attempts.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic identifies attempts to exploit the CVE-2023-46805 and CVE-2024-21887 vulnerabilities in Ivanti Connect Secure. It detects POST requests to specific URIs that leverage command injection to execute arbitrary commands. The detection uses the Web datamodel to monitor for these requests and checks for a 200 OK response, indicating a successful exploit attempt. This activity is significant as it can lead to unauthorized command execution on the server. If confirmed malicious, attackers could gain control over the system, leading to potential data breaches or further network compromise.
 data_source:
     - Suricata
-search: |-
-    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE Web.url IN("*/api/v1/totp/user-backup-code/../../system/maintenance/archiving/cloud-server-test-connection*","*/api/v1/totp/user-backup-code/../../license/keys-status/*") Web.http_method IN ("POST", "GET") Web.status=200
-      BY Web.src, Web.dest, Web.http_user_agent,
-         Web.url, Web.http_method, Web.status
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `ivanti_connect_secure_command_injection_attempts_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url IN ("*/api/v1/totp/user-backup-code/../../system/maintenance/archiving/cloud-server-test-connection*", "*/api/v1/totp/user-backup-code/../../license/keys-status/*") Web.http_method IN ("POST", "GET") Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ivanti_connect_secure_command_injection_attempts_filter`
 how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
 known_false_positives: This analytic is limited to HTTP Status 200; adjust as necessary. False positives may occur if the URI path is IP-restricted or externally blocked. It's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.
 references:
@@ -35,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible exploitation of CVE-2023-46805 and CVE-2024-21887 against $dest$.
     entity:
diff --git a/detections/web/ivanti_connect_secure_ssrf_in_saml_component.yml b/detections/web/ivanti_connect_secure_ssrf_in_saml_component.yml
index 1ba591a666d..0dd5ab3d79e 100644
--- a/detections/web/ivanti_connect_secure_ssrf_in_saml_component.yml
+++ b/detections/web/ivanti_connect_secure_ssrf_in_saml_component.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic identifies POST requests targeting endpoints vulnerable to the SSRF issue (CVE-2024-21893) in Ivanti's products. It leverages the Web data model, focusing on endpoints such as /dana-ws/saml20.ws, /dana-ws/saml.ws, /dana-ws/samlecp.ws, and /dana-na/auth/saml-logout.cgi. The detection filters for POST requests that received an HTTP 200 OK response, indicating successful execution. This activity is significant as it may indicate an attempt to exploit SSRF vulnerabilities, potentially allowing attackers to access internal services or sensitive data. If confirmed malicious, this could lead to unauthorized access and data exfiltration.
 data_source:
     - Suricata
-search: |-
-    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE Web.url IN ("*/dana-ws/saml20.ws*","*/dana-ws/saml.ws*","*/dana-ws/samlecp.ws*","*/dana-na/auth/saml-logout.cgi/*") Web.http_method=POST Web.status=200
-      BY Web.src, Web.dest, Web.http_user_agent,
-         Web.url, Web.status, Web.http_method
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `ivanti_connect_secure_ssrf_in_saml_component_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url IN ("*/dana-ws/saml20.ws*", "*/dana-ws/saml.ws*", "*/dana-ws/samlecp.ws*", "*/dana-na/auth/saml-logout.cgi/*") Web.http_method="POST" Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ivanti_connect_secure_ssrf_in_saml_component_filter`
 how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
 known_false_positives: This analytic is limited to HTTP Status 200; adjust as necessary. False positives may occur if the HTTP Status is removed, as most failed attempts result in a 301. It's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.
 references:
@@ -31,7 +24,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible exploitation of CVE-2024-21893 against $dest$ from $src$.
     entity:
diff --git a/detections/web/ivanti_connect_secure_system_information_access_via_auth_bypass.yml b/detections/web/ivanti_connect_secure_system_information_access_via_auth_bypass.yml
index 01c9e79261b..e14100bd3fe 100644
--- a/detections/web/ivanti_connect_secure_system_information_access_via_auth_bypass.yml
+++ b/detections/web/ivanti_connect_secure_system_information_access_via_auth_bypass.yml
@@ -9,15 +9,8 @@ type: Anomaly
 description: The following analytic identifies attempts to exploit the CVE-2023-46805 and CVE-2024-21887 vulnerabilities in Ivanti Connect Secure. It detects GET requests to the /api/v1/totp/user-backup-code/../../system/system-information URI, which leverage an authentication bypass to access system information. The detection uses the Web datamodel to identify requests with a 200 OK response, indicating a successful exploit attempt. This activity is significant as it reveals potential unauthorized access to sensitive system information. If confirmed malicious, attackers could gain critical insights into the system, facilitating further exploitation and compromise.
 data_source:
     - Suricata
-search: |-
-    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE Web.url="*/api/v1/totp/user-backup-code/../../system/system-information*" Web.http_method=GET Web.status=200
-      BY Web.src, Web.dest, Web.http_user_agent,
-         Web.url
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `ivanti_connect_secure_system_information_access_via_auth_bypass_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/api/v1/totp/user-backup-code/../../system/system-information*" Web.http_method="GET" Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ivanti_connect_secure_system_information_access_via_auth_bypass_filter`
 how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
 known_false_positives: This analytic is limited to HTTP Status 200; adjust as necessary. False positives may occur if the URI path is IP-restricted or externally blocked. It's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.
 references:
@@ -32,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/web/ivanti_epm_sql_injection_remote_code_execution.yml b/detections/web/ivanti_epm_sql_injection_remote_code_execution.yml
index d09fbdfa1d8..4e7bdfc8d41 100644
--- a/detections/web/ivanti_epm_sql_injection_remote_code_execution.yml
+++ b/detections/web/ivanti_epm_sql_injection_remote_code_execution.yml
@@ -6,37 +6,23 @@ modification_date: '2026-05-13'
 author: Michael Haag
 status: production
 type: TTP
-description: |-
-    This detection identifies potential exploitation of a critical SQL injection vulnerability in Ivanti Endpoint Manager (EPM), identified as CVE-2024-29824.
+description: 'This detection identifies potential exploitation of a critical SQL injection vulnerability in Ivanti Endpoint Manager (EPM), identified as CVE-2024-29824.
+
     The vulnerability, which has a CVSS score of 9.8, allows for remote code execution through the `RecordGoodApp` function in the `PatchBiz.dll` file.
+
     An attacker can exploit this vulnerability by manipulating the `goodApp.md5` value in an HTTP POST request to the `/WSStatusEvents/EventHandler.asmx` endpoint, leading to unauthorized command execution on the server.
+
     Monitoring for unusual SQL commands and HTTP requests to this endpoint can help identify exploitation attempts.
+
     Note that, the detection is focused on the URI path, HTTP method and status code of 200, indicating potential exploitation.
-    To properly identify if this was successful, TLS inspection and additional network traffic analysis is required as the xp_cmdshell comes in via the request body.
+
+    To properly identify if this was successful, TLS inspection and additional network traffic analysis is required as the xp_cmdshell comes in via the request body.'
 data_source:
     - Suricata
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Web WHERE
-
-    Web.url="*/WSStatusEvents/EventHandler.asmx"
-    Web.http_method=POST
-    Web.status=200
-
-    BY Web.http_user_agent Web.status Web.http_method
-       Web.url Web.url_length Web.src Web.dest
-
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `ivanti_epm_sql_injection_remote_code_execution_filter`
-how_to_implement: |-
-    The detection is based on monitoring HTTP POST requests to the `/WSStatusEvents/EventHandler.asmx` endpoint with a status code of 200. The detection is focused on the URI path, HTTP method, and status code, which can indicate potential exploitation of the CVE-2024-29824 vulnerability. To implement this detection, ensure that you have enabled the necessary data sources and are ingesting HTTP traffic data. The detection can be implemented using Splunk Enterprise Security and Splunk Cloud with the provided search query. The search query should be scheduled to run at regular intervals to detect potential exploitation attempts. Additionally, consider implementing TLS inspection or network traffic analysis (IDS/IPS) to identify successful exploitation attempts.
-known_false_positives: |-
-    False positives are not expected, as this detection is based on monitoring HTTP POST requests to a specific endpoint with a status code of 200. However, ensure that legitimate requests to the `/WSStatusEvents/EventHandler.asmx` endpoint are accounted for in the environment to avoid false positives.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/WSStatusEvents/EventHandler.asmx" Web.http_method="POST" Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ivanti_epm_sql_injection_remote_code_execution_filter`
+how_to_implement: The detection is based on monitoring HTTP POST requests to the `/WSStatusEvents/EventHandler.asmx` endpoint with a status code of 200. The detection is focused on the URI path, HTTP method, and status code, which can indicate potential exploitation of the CVE-2024-29824 vulnerability. To implement this detection, ensure that you have enabled the necessary data sources and are ingesting HTTP traffic data. The detection can be implemented using Splunk Enterprise Security and Splunk Cloud with the provided search query. The search query should be scheduled to run at regular intervals to detect potential exploitation attempts. Additionally, consider implementing TLS inspection or network traffic analysis (IDS/IPS) to identify successful exploitation attempts.
+known_false_positives: False positives are not expected, as this detection is based on monitoring HTTP POST requests to a specific endpoint with a status code of 200. However, ensure that legitimate requests to the `/WSStatusEvents/EventHandler.asmx` endpoint are accounted for in the environment to avoid false positives.
 references:
     - https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-29824-deep-dive-ivanti-epm-sql-injection-remote-code-execution-vulnerability/
     - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29824
@@ -49,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential exploitation of a critical SQL injection vulnerability in Ivanti Endpoint Manager (EPM), identified as CVE-2024-29824 against $dest$.
     entity:
@@ -75,6 +61,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_epm.log
-          sourcetype: suricata
           source: not_applicable
+          sourcetype: suricata
       test_type: unit
diff --git a/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml b/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml
index 261db19fd7c..31f86cee6e6 100644
--- a/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml
+++ b/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml
@@ -6,37 +6,25 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects attempts to exploit CVE-2023-35078, a vulnerability in Ivanti Endpoint Manager Mobile (EPMM) versions up to 11.4.
+description: 'The following analytic detects attempts to exploit CVE-2023-35078, a vulnerability in Ivanti Endpoint Manager Mobile (EPMM) versions up to 11.4.
+
     It identifies HTTP requests to the endpoint "/mifs/aad/api/v2/authorized/users?*" with a status code of 200 in web logs.
+
     This activity is significant as it indicates unauthorized remote access to restricted functionalities or resources.
-    If confirmed malicious, this could lead to data theft, unauthorized modifications, or further system compromise, necessitating immediate action to mitigate potential severe impacts.
+
+    If confirmed malicious, this could lead to data theft, unauthorized modifications, or further system compromise, necessitating immediate action to mitigate potential severe impacts.'
 data_source:
     - Suricata
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Web WHERE
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/mifs/aad/api/v2/authorized/users**" Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078_filter`
+how_to_implement: To implement this analytic, a network product similar to Suricata or Palo Alto needs to be mapped to the Web datamodel. Modify accordingly to work with your products.
+known_false_positives: 'The Proof of Concept exploit script indicates that status=200 is required for successful exploitation of the vulnerability.
 
-    Web.url="*/mifs/aad/api/v2/authorized/users?*"
-    Web.status=200
-
-    BY Web.http_user_agent Web.status Web.http_method
-       Web.url Web.url_length Web.src Web.dest
-
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078_filter`
-how_to_implement: |-
-    To implement this analytic, a network product similar to Suricata or Palo Alto needs to be mapped to the Web datamodel. Modify accordingly to work with your products.
-known_false_positives: |-
-    The Proof of Concept exploit script indicates that status=200 is required for successful exploitation of the vulnerability.
     False positives may be present if status=200 is removed from the search.
+
     If it is removed,then the search also alert on status=301 and status=404 which indicates unsuccessful exploitation attempts.
-    Analysts may find it useful to hunt for these status codes as well, but it is likely to produce a significant number of alerts as this is a widespread vulnerability.
+
+    Analysts may find it useful to hunt for these status codes as well, but it is likely to produce a significant number of alerts as this is a widespread vulnerability.'
 references:
     - https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US
     - https://github.com/vchan-in/CVE-2023-35078-Exploit-POC/blob/main/cve_2023_35078_poc.py
@@ -48,7 +36,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential CVE-2023-35078 against an Ivanti EPMM appliance on $dest$.
     entity:
diff --git a/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml b/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml
index 9090e3390d9..12cc7b024e3 100644
--- a/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml
+++ b/detections/web/ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml
@@ -6,37 +6,25 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects potential unauthorized access attempts exploiting CVE-2023-35082 within Ivanti's software products.
+description: 'The following analytic detects potential unauthorized access attempts exploiting CVE-2023-35082 within Ivanti''s software products.
+
     It identifies access to the specific URI path /mifs/asfV3/api/v2/ with an HTTP 200 response code in web access logs, indicating successful unauthorized access.
+
     This activity is significant for a SOC as it highlights potential security breaches that could lead to unauthorized data access or system modifications.
-    If confirmed malicious, an attacker could gain unbridled access to sensitive organizational data or modify systems maliciously, posing severe security risks.
+
+    If confirmed malicious, an attacker could gain unbridled access to sensitive organizational data or modify systems maliciously, posing severe security risks.'
 data_source:
     - Suricata
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Web WHERE
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/mifs/asfV3/api/v2/*" Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082_filter`
+how_to_implement: To implement this analytic, a network product similar to Suricata or Palo Alto needs to be mapped to the Web datamodel. Modify accordingly to work with your products.
+known_false_positives: 'Similar to CVE-2023-35078, the path for exploitation indicates that status=200 is required for successful exploitation of the vulnerability.
 
-    Web.url="*/mifs/asfV3/api/v2/*"
-    Web.status=200
-
-    BY Web.http_user_agent Web.status Web.http_method
-       Web.url Web.url_length Web.src Web.dest
-
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082_filter`
-how_to_implement: |-
-    To implement this analytic, a network product similar to Suricata or Palo Alto needs to be mapped to the Web datamodel. Modify accordingly to work with your products.
-known_false_positives: |-
-    Similar to CVE-2023-35078, the path for exploitation indicates that status=200 is required for successful exploitation of the vulnerability.
     False positives may be present if status=200 is removed from the search.
+
     If it is removed,then the search also alert on status=301 and status=404 which indicates unsuccessful exploitation attempts.
-    Analysts may find it useful to hunt for these status codes as well, but it is likely to produce a significant number of alerts as this is a widespread vulnerability.
+
+    Analysts may find it useful to hunt for these status codes as well, but it is likely to produce a significant number of alerts as this is a widespread vulnerability.'
 references:
     - https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US
     - https://github.com/vchan-in/CVE-2023-35078-Exploit-POC/blob/main/cve_2023_35078_poc.py
@@ -49,7 +37,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential CVE-2023-35082 against an Ivanti EPMM appliance on $dest$.
     entity:
diff --git a/detections/web/java_class_file_download_by_java_user_agent.yml b/detections/web/java_class_file_download_by_java_user_agent.yml
index e29d6bde096..5a4322aaaad 100644
--- a/detections/web/java_class_file_download_by_java_user_agent.yml
+++ b/detections/web/java_class_file_download_by_java_user_agent.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies a Java user agent performing a GET request for a .class file from a remote site. It leverages web or proxy logs within the Web Datamodel to detect this activity. This behavior is significant as it may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell). If confirmed malicious, an attacker could exploit vulnerabilities in the Java application, potentially leading to remote code execution and further compromise of the affected system.
 data_source:
     - Splunk Stream HTTP
-search: |-
+search: |
     | tstats  `security_content_summariesonly` count FROM datamodel=Web
       WHERE Web.http_user_agent="*Java*" Web.http_method="GET" Web.url="*.class*"
       BY Web.http_user_agent Web.http_method, Web.url,Web.url_length
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A Java user agent $http_user_agent$ was performing a $http_method$ to retrieve a remote class file.
     entity:
diff --git a/detections/web/jenkins_arbitrary_file_read_cve_2024_23897.yml b/detections/web/jenkins_arbitrary_file_read_cve_2024_23897.yml
index 48b76e89d91..d14aa3e0d2e 100644
--- a/detections/web/jenkins_arbitrary_file_read_cve_2024_23897.yml
+++ b/detections/web/jenkins_arbitrary_file_read_cve_2024_23897.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic identifies attempts to exploit Jenkins Arbitrary File Read CVE-2024-23897. It detects HTTP POST requests to Jenkins URLs containing "*/cli?remoting=false*" with a 200 status code. This activity is significant as it indicates potential unauthorized access to sensitive files on the Jenkins server, such as credentials and private keys. If confirmed malicious, this could lead to severe data breaches, unauthorized access, and further exploitation within the environment.
 data_source:
     - Nginx Access
-search: |-
-    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE Web.url="*/cli?remoting=false*" Web.status=200 Web.http_method=POST
-      BY Web.src, Web.dest, Web.http_user_agent,
-         Web.url Web.status, Web.http_method
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `jenkins_arbitrary_file_read_cve_2024_23897_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/cli*remoting=false*" Web.status="200" Web.http_method="POST" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `jenkins_arbitrary_file_read_cve_2024_23897_filter`
 how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto. If unable to utilize the Web datamodel, modify query to your data source.
 known_false_positives: False positives should be limited as this detection is based on a specific URL path and HTTP status code. Adjust the search as necessary to fit the environment.
 references:
@@ -36,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Jenkins Arbitrary File Read CVE-2024-23897 against $dest$ by $src$.
     entity:
diff --git a/detections/web/jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml b/detections/web/jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml
index 602ef0e4f95..2322ff91f3b 100644
--- a/detections/web/jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml
+++ b/detections/web/jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml
@@ -9,21 +9,8 @@ type: TTP
 description: The following analytic identifies attempts to exploit the JetBrains TeamCity Authentication Bypass vulnerability (CVE-2024-27198). It detects suspicious POST requests to the `/app/rest/users` and `/app/rest/users/id:1/tokens` endpoints, which are indicative of attempts to create new administrator users or generate admin access tokens without authentication. This detection leverages the Web datamodel and CIM-compliant log sources, such as Nginx or TeamCity logs. This activity is significant as it can lead to full control over the TeamCity server, including all projects, builds, agents, and artifacts. If confirmed malicious, attackers could gain unauthorized administrative access, leading to severe security breaches.
 data_source:
     - Suricata
-search: |-
-    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE (
-            (Web.url="*?jsp=*"
-            AND
-            Web.url="*;.jsp*") Web.status=200 Web.http_method=POST
-        )
-        OR (Web.url IN ("*jsp=/app/rest/users;.jsp","*?jsp=/app/rest/users;.jsp","*?jsp=.*/app/rest/users/id:*/tokens;*") Web.status=200 Web.http_method=POST )
-      BY Web.src, Web.dest, Web.http_user_agent,
-         Web.url, Web.status, Web.http_method,
-         sourcetype, source
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `jetbrains_teamcity_authentication_bypass_cve_2024_27198_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where (Web.url="**jsp=*" Web.url="*;.jsp*" Web.status="200" Web.http_method="POST") OR (Web.url IN ("jsp=/app/rest/users;.jsp", "*jsp=/app/rest/users;.jsp", "*jsp=.*/app/rest/users/id:*/tokens;") Web.status="200" Web.http_method="POST") by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `jetbrains_teamcity_authentication_bypass_cve_2024_27198_filter`
 how_to_implement: The detection relies on the Web datamodel and a CIM compliant log source, that may include Nginx, TeamCity logs, or other web server logs.
 known_false_positives: False positives are not expected, as this detection is based on the presence of specific URI paths and HTTP methods that are indicative of the CVE-2024-27198 vulnerability exploitation. Monitor, filter and tune as needed based on organization log sources.
 references:
@@ -40,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible JetBrains TeamCity Authentication Bypass CVE-2024-27198 Attempt against $dest$ from $src$.
     entity:
@@ -67,6 +54,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/jetbrains/teamcity_cve_2024_27198.log
-          sourcetype: suricata
           source: not_applicable
+          sourcetype: suricata
       test_type: unit
diff --git a/detections/web/jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198.yml b/detections/web/jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198.yml
index 3de18c330ff..bce92563a43 100644
--- a/detections/web/jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198.yml
+++ b/detections/web/jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198.yml
@@ -9,14 +9,8 @@ type: TTP
 description: The following analytic detects attempts to exploit the CVE-2024-27198 vulnerability in JetBrains TeamCity on-premises servers, which allows attackers to bypass authentication mechanisms. It leverages Suricata HTTP traffic logs to identify suspicious POST requests to the `/app/rest/users` and `/app/rest/users/id:1/tokens` endpoints. This activity is significant because it can lead to unauthorized administrative access, enabling attackers to gain full control over the TeamCity server, including projects, builds, agents, and artifacts. If confirmed malicious, this could result in severe security breaches and compromise the integrity of the development environment.
 data_source:
     - Suricata
-search: |-
-    `suricata` ((http.url="*?jsp=*" AND http.url="*;.jsp*") http.status=200 http_method=POST) OR (http.url IN ("*jsp=/app/rest/users;.jsp","*?jsp=/app/rest/users;.jsp","*?jsp=.*/app/rest/users/id:*/tokens;*") http.status=200 http_method=POST )
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY src, dest, http.http_user_agent,
-           http.url, http.status,http_method
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where (Web.url="**jsp=*" Web.url="*;.jsp*" Web.status="200" Web.http_method="POST") OR (Web.url IN ("jsp=/app/rest/users;.jsp", "*jsp=/app/rest/users;.jsp", "*jsp=.*/app/rest/users/id:*/tokens;") Web.status="200" Web.http_method="POST") by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198_filter`
 how_to_implement: The following detection relies on the Suricata TA and ensuring it is properly configured to monitor HTTP traffic. Modify the query for your environment and log sources as needed.
 known_false_positives: False positives are not expected, as this detection is based on the presence of specific URI paths and HTTP methods that are indicative of the CVE-2024-27198 vulnerability exploitation. Monitor, filter and tune as needed based on organization log sources.
 references:
@@ -32,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible JetBrains TeamCity Authentication Bypass Attempt against $dest$ from $src$.
     entity:
@@ -60,6 +54,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/jetbrains/teamcity_cve_2024_27198.log
-          sourcetype: suricata
           source: not_applicable
+          sourcetype: suricata
       test_type: unit
diff --git a/detections/web/jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199.yml b/detections/web/jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199.yml
index 20ddadebcf7..75a3cf12d26 100644
--- a/detections/web/jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199.yml
+++ b/detections/web/jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199.yml
@@ -9,14 +9,8 @@ type: TTP
 description: The following analytic identifies attempts to exploit CVE-2024-27199, a critical vulnerability in JetBrains TeamCity web server, allowing unauthenticated access to specific endpoints. It detects unusual access patterns to vulnerable paths such as /res/, /update/, and /.well-known/acme-challenge/ by monitoring HTTP traffic logs via Suricata. This activity is significant as it could indicate an attacker bypassing authentication to access or modify system settings. If confirmed malicious, this could lead to unauthorized changes, disclosure of sensitive information, or uploading of malicious certificates, severely compromising the server's security.
 data_source:
     - Suricata
-search: |-
-    `suricata` http.url IN ("*../admin/diagnostic.jsp*", "*../app/https/settings/*", "*../app/pipeline*", "*../app/oauth/space/createBuild.html*", "*../res/*", "*../update/*", "*../.well-known/acme-challenge/*", "*../app/availableRunners*", "*../app/https/settings/setPort*", "*../app/https/settings/certificateInfo*", "*../app/https/settings/defaultHttpsPort*", "*../app/https/settings/fetchFromAcme*", "*../app/https/settings/removeCertificate*", "*../app/https/settings/uploadCertificate*", "*../app/https/settings/termsOfService*", "*../app/https/settings/triggerAcmeChallenge*", "*../app/https/settings/cancelAcmeChallenge*", "*../app/https/settings/getAcmeOrder*", "*../app/https/settings/setRedirectStrategy*") http.status=200 http_method=GET
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY src, dest, http_user_agent,
-           http.url, http.status, http_method
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url IN ("*../admin/diagnostic.jsp*", "*../app/https/settings/*", "*../app/pipeline*", "*../app/oauth/space/createBuild.html*", "*../res/*", "*../update/*", "*../.well-known/acme-challenge/*", "*../app/availableRunners*", "*../app/https/settings/setPort*", "*../app/https/settings/certificateInfo*", "*../app/https/settings/defaultHttpsPort*", "*../app/https/settings/fetchFromAcme*", "*../app/https/settings/removeCertificate*", "*../app/https/settings/uploadCertificate*", "*../app/https/settings/termsOfService*", "*../app/https/settings/triggerAcmeChallenge*", "*../app/https/settings/cancelAcmeChallenge*", "*../app/https/settings/getAcmeOrder*", "*../app/https/settings/setRedirectStrategy*") Web.status="200" Web.http_method="GET" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199_filter`
 how_to_implement: The following detection relies on the Suricata TA and ensuring it is properly configured to monitor HTTP traffic. Modify the query for your environment and log sources as needed.
 known_false_positives: False positives are not expected, however, monitor, filter, and tune as needed based on organization log sources. The analytic is restricted to 200 and GET requests to specific URI paths, which should limit false positives.
 references:
@@ -32,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Possible JetBrains TeamCity Limited Authentication Bypass Attempt against $dest$ from $src$.
     entity:
@@ -59,6 +53,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/jetbrains/teamcity_cve_2024_27199.log
-          sourcetype: suricata
           source: not_applicable
+          sourcetype: suricata
       test_type: unit
diff --git a/detections/web/jetbrains_teamcity_rce_attempt.yml b/detections/web/jetbrains_teamcity_rce_attempt.yml
index d09bdf26748..0f5a4513ae5 100644
--- a/detections/web/jetbrains_teamcity_rce_attempt.yml
+++ b/detections/web/jetbrains_teamcity_rce_attempt.yml
@@ -6,35 +6,19 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects attempts to exploit the CVE-2023-42793 vulnerability in JetBrains TeamCity On-Premises.
+description: 'The following analytic detects attempts to exploit the CVE-2023-42793 vulnerability in JetBrains TeamCity On-Premises.
+
     It identifies suspicious POST requests to /app/rest/users/id:1/tokens/RPC2, leveraging the Web datamodel to monitor specific URL patterns and HTTP methods.
+
     This activity is significant as it may indicate an unauthenticated attacker attempting to gain administrative access via Remote Code Execution (RCE).
-    If confirmed malicious, this could allow the attacker to execute arbitrary code, potentially compromising the entire TeamCity environment and leading to further unauthorized access and data breaches.
+
+    If confirmed malicious, this could allow the attacker to execute arbitrary code, potentially compromising the entire TeamCity environment and leading to further unauthorized access and data breaches.'
 data_source:
     - Suricata
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Web WHERE
-
-    Web.url="*/app/rest/users/id:1/tokens/RPC2*"
-    Web.status=200
-    Web.http_method="POST"
-
-    BY Web.http_user_agent Web.status Web.http_method
-       Web.url Web.url_length Web.src Web.dest
-
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `jetbrains_teamcity_rce_attempt_filter`
-how_to_implement: |-
-    The following analytic requires the Web datamodel. Ensure data source is mapped correctly or modify and tune for your data source.
-known_false_positives: |-
-    Requests to this specific endpoint via this method should not be common. Investigate further to determine if the request is legitimate, and apply appropriate filters to reduce false positives.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/app/rest/users/id:1/tokens/RPC2*" Web.status="200" Web.http_method="POST" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `jetbrains_teamcity_rce_attempt_filter`
+how_to_implement: The following analytic requires the Web datamodel. Ensure data source is mapped correctly or modify and tune for your data source.
+known_false_positives: Requests to this specific endpoint via this method should not be common. Investigate further to determine if the request is legitimate, and apply appropriate filters to reduce false positives.
 references:
     - https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/
     - https://www.sonarsource.com/blog/teamcity-vulnerability/
@@ -48,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential JetBrains TeamCity RCE Attempt detected against URL $url$ on $dest$.
     entity:
diff --git a/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml b/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml
index aa36bdbc3dc..0b41073fbe8 100644
--- a/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml
+++ b/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects attempts to exploit a remote code execution vulnerability in Juniper Networks devices. It identifies requests to /webauth_operation.php?PHPRC=*, which are indicative of uploading and executing malicious PHP files. This detection leverages the Web data model, focusing on specific URL patterns and HTTP status codes. This activity is significant because it signals an attempt to gain unauthorized access and execute arbitrary code on the device. If confirmed malicious, the attacker could gain control over the device, leading to data theft, network compromise, or other severe consequences.
 data_source:
     - Suricata
-search: |-
-    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE Web.url IN ("*/webauth_operation.php?PHPRC=*") Web.status=200
-      BY Web.http_user_agent, Web.status Web.http_method,
-         Web.url, Web.url_length, Web.src,
-         Web.dest, sourcetype
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `juniper_networks_remote_code_execution_exploit_detection_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/webauth_operation.php*PHPRC=*" Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `juniper_networks_remote_code_execution_exploit_detection_filter`
 how_to_implement: To implement this search, ensure that the Web data model is populated. The search is activated when the Web data model is accelerated. Network products, such as Suricata or Palo Alto, need to be mapped to the Web data model. Adjust the mapping as necessary to suit your specific products.
 known_false_positives: Be aware of potential false positives - legitimate uses of the /webauth_operation.php endpoint may cause benign activities to be flagged.The URL in the analytic is specific to a successful attempt to exploit the vulnerability. Review contents of the HTTP body to determine if the request is malicious. If the request is benign, add the URL to the whitelist or continue to monitor.
 references:
@@ -36,7 +28,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: This analytic has identified a potential exploitation of a remote code execution vulnerability in Juniper Networks devices on $dest$ on the URL $url$ used for the exploit.
     entity:
diff --git a/detections/web/log4shell_jndi_payload_injection_attempt.yml b/detections/web/log4shell_jndi_payload_injection_attempt.yml
index e6c6582a0f7..1a7398abcd8 100644
--- a/detections/web/log4shell_jndi_payload_injection_attempt.yml
+++ b/detections/web/log4shell_jndi_payload_injection_attempt.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic identifies attempts to inject Log4Shell JNDI payloads via web calls. It leverages the Web datamodel and uses regex to detect patterns like `${jndi:ldap://` in raw web event data, including HTTP headers. This activity is significant because it targets vulnerabilities in Java web applications using Log4j, such as Apache Struts and Solr. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to full system compromise. Immediate investigation is required to determine if the attempt was successful and to mitigate any potential exploitation.
 data_source:
     - Nginx Access
-search: |-
+search: |
     | from datamodel Web.Web
     | regex _raw="[jJnNdDiI]{4}(\:|\%3A|\/|\%2F)\w+(\:\/\/|\%3A\%2F\%2F)(\$\{.*?\}(\.)?)?"
     | fillnull
@@ -27,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml
index 7f045881426..02403fedee6 100644
--- a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml
+++ b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: The following analytic detects Log4Shell JNDI payload injections via outbound connections. It identifies suspicious LDAP lookup functions in web logs, such as `${jndi:ldap://PAYLOAD_INJECTED}`, and correlates them with network traffic to known malicious IP addresses. This detection leverages the Web and Network_Traffic data models in Splunk. Monitoring this activity is crucial as it targets vulnerabilities in Java web applications using log4j, potentially leading to remote code execution. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and compromise sensitive data within the affected environment.
 data_source:
     - Splunk Stream IP
-search: |-
+search: |
     | from datamodel Web.Web
     | rex field=_raw max_match=0 "[jJnNdDiI]{4}(\:|\%3A|\/|\%2F)(?<proto>\w+)(\:\/\/|\%3A\%2F\%2F)(\$\{.*?\}(\.)?)?(?<affected_host>[a-zA-Z0-9\.\-\_\$]+)" | join affected_host type=inner [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic by All_Traffic.dest | `drop_dm_object_name(All_Traffic)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename dest AS affected_host]
     | fillnull
@@ -27,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$user$" and "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: user
diff --git a/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml b/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml
index 49a222f5706..cc01f706c67 100644
--- a/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml
+++ b/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml
@@ -6,34 +6,17 @@ modification_date: '2026-05-13'
 author: Michael Haag, Gowthamaraj Rajendran, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects potential exploitation attempts against Microsoft SharePoint Server vulnerability CVE-2023-29357.
+description: 'The following analytic detects potential exploitation attempts against Microsoft SharePoint Server vulnerability CVE-2023-29357.
+
     It leverages the Web datamodel to monitor for specific API calls and HTTP methods indicative of privilege escalation attempts.
+
     This activity is significant as it may indicate an attacker is trying to gain unauthorized privileged access to the SharePoint environment.
-    If confirmed malicious, the impact could include unauthorized access to sensitive data, potential data theft, and further compromise of the SharePoint server, leading to a broader security breach.
+
+    If confirmed malicious, the impact could include unauthorized access to sensitive data, potential data theft, and further compromise of the SharePoint server, leading to a broader security breach.'
 data_source:
     - Suricata
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Web WHERE
-
-    Web.url IN (
-        "*/_api/web/siteusers*",
-        "*/_api/web/currentuser*"
-    )
-    Web.status=200
-    Web.http_method="GET"
-
-    BY Web.http_user_agent Web.status Web.http_method
-       Web.url Web.url_length Web.src Web.dest
-
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `microsoft_sharepoint_server_elevation_of_privilege_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url IN ("*/_api/web/siteusers*", "*/_api/web/currentuser*") Web.status="200" Web.http_method="GET" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `microsoft_sharepoint_server_elevation_of_privilege_filter`
 how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Microsoft SharePoint.
 known_false_positives: False positives may occur if there are legitimate activities that mimic the exploitation pattern. It's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.
 references:
@@ -47,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/web/multiple_archive_files_http_post_traffic.yml b/detections/web/multiple_archive_files_http_post_traffic.yml
index dbdee3abfb5..698ed6cd3ed 100644
--- a/detections/web/multiple_archive_files_http_post_traffic.yml
+++ b/detections/web/multiple_archive_files_http_post_traffic.yml
@@ -9,19 +9,8 @@ type: TTP
 description: The following analytic detects the high-frequency exfiltration of archive files via HTTP POST requests. It leverages HTTP stream logs to identify specific archive file headers within the request body. This activity is significant as it often indicates data exfiltration by APTs or trojan spyware after data collection. If confirmed malicious, this behavior could lead to the unauthorized transfer of sensitive data to an attacker’s command and control server, potentially resulting in severe data breaches and loss of confidential information.
 data_source:
     - Splunk Stream HTTP
-search: |-
-    `stream_http` http_method=POST
-      | eval archive_hdr1=substr(form_data,1,2)
-      | eval archive_hdr2 = substr(form_data,1,4)
-      | stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count
-        BY src_ip dest_ip http_method
-           http_user_agent uri_path url
-           bytes_in bytes_out archive_hdr1
-           archive_hdr2
-      | where count >20 AND (archive_hdr1 = "7z" OR archive_hdr1 = "PK" OR archive_hdr2="Rar!")
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `multiple_archive_files_http_post_traffic_filter`
+search: |
+    `stream_http` http_method="POST" | eval uri_path=uri_path, dest=dest, src=src | stats count min(_time) as firstTime max(_time) as lastTime by http_method src_ip url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `multiple_archive_files_http_post_traffic_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the stream HTTP logs or network logs that catch network traffic. Make sure that the http-request-body, payload, or request field is enabled in stream http configuration.
 known_false_positives: Normal archive transfer via HTTP protocol may trip this detection.
 references:
@@ -36,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A http post $http_method$ sending packet with possible archive bytes header in uri path $uri_path$
     entity:
diff --git a/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml b/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml
index bae64a63da9..1525a11084a 100644
--- a/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml
+++ b/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows attackers to bypass authentication via alternate paths or channels. It leverages Nginx access logs to identify web requests to the SetupWizard.aspx page, indicating potential exploitation. This activity is significant as it can lead to unauthorized administrative access and remote code execution. If confirmed malicious, attackers could create administrative users and gain full control over the affected ScreenConnect instance, posing severe security risks. Immediate remediation by updating to version 23.9.8 or above is recommended.
 data_source:
     - Nginx Access
-search: |-
-    `nginx_access_logs` uri_path IN ("*/SetupWizard.aspx/*","*/SetupWizard/") status=200 http_method=POST
-      | stats count min(_time) as firstTime max(_time) as lastTime
-        BY src, dest, http_user_agent,
-           url, uri_path, status,
-           http_method, sourcetype, source
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `nginx_connectwise_screenconnect_authentication_bypass_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url IN ("*/SetupWizard.aspx/*", "*/SetupWizard/*") Web.status="200" Web.http_method="POST" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nginx_connectwise_screenconnect_authentication_bypass_filter`
 how_to_implement: To implement this analytic, ensure proper logging is occurring with Nginx, access.log and error.log, and that these logs are being ingested into Splunk. STRT utilizes this nginx.conf https://gist.github.com/MHaggis/26f59108b04da8f1d870c9cc3a3c8eec to properly log as much data with Nginx.
 known_false_positives: False positives are not expected, as the detection is based on the presence of web requests to the SetupWizard.aspx page, which is not a common page to be accessed by legitimate users. Note that the analytic is limited to HTTP POST and a status of 200 to reduce false positives. Modify the query as needed to reduce false positives or hunt for additional indicators of compromise.
 references:
@@ -34,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An authentication bypass attempt against ScreenConnect has been detected on $dest$.
     entity:
@@ -67,6 +60,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/screenconnect/nginx_screenconnect.log
-          sourcetype: nginx:plus:kv
           source: nginx:plus:kv
+          sourcetype: nginx:plus:kv
       test_type: unit
diff --git a/detections/web/papercut_ng_remote_web_access_attempt.yml b/detections/web/papercut_ng_remote_web_access_attempt.yml
index a913a91ad07..aa7cf93bf23 100644
--- a/detections/web/papercut_ng_remote_web_access_attempt.yml
+++ b/detections/web/papercut_ng_remote_web_access_attempt.yml
@@ -6,12 +6,15 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects potential exploitation attempts on publicly accessible PaperCut NG servers.
+description: 'The following analytic detects potential exploitation attempts on publicly accessible PaperCut NG servers.
+
     It identifies connections from public IP addresses to the server, specifically monitoring URI paths commonly used in proof-of-concept scripts for exploiting PaperCut NG vulnerabilities.
+
     This detection leverages web traffic data from the `Web` datamodel, focusing on specific URI paths and excluding internal IP ranges.
+
     This activity is significant as it may indicate an attempt to exploit known vulnerabilities in PaperCut NG, potentially leading to unauthorized access or control of the server.
-    If confirmed malicious, attackers could gain administrative access, leading to data breaches or further network compromise.
+
+    If confirmed malicious, attackers could gain administrative access, leading to data breaches or further network compromise.'
 data_source:
     - Suricata
 search: |
@@ -61,10 +64,8 @@ search: |
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `papercut_ng_remote_web_access_attempt_filter`
-how_to_implement: |-
-    To successfully implement this search you need to be ingesting information on Web traffic that include fields relevant for traffic into the `Web` datamodel.
-known_false_positives: |-
-    False positives may be present if you allow access to the PaperCut NG server from public IP addresses. Filter as needed.
+how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relevant for traffic into the `Web` datamodel.
+known_false_positives: False positives may be present if you allow access to the PaperCut NG server from public IP addresses. Filter as needed.
 references:
     - https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-and-fbi-release-joint-advisory-response-active-exploitation-papercut-vulnerability
     - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
@@ -79,7 +80,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: URIs specific to PaperCut NG have been access by a public IP $src$ against $dest$.
     entity:
diff --git a/detections/web/plain_http_post_exfiltrated_data.yml b/detections/web/plain_http_post_exfiltrated_data.yml
index 4a01f107873..a33e5ccff1d 100644
--- a/detections/web/plain_http_post_exfiltrated_data.yml
+++ b/detections/web/plain_http_post_exfiltrated_data.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic detects potential data exfiltration using plain HTTP POST requests. It leverages network traffic logs, specifically monitoring the `stream_http` data source for POST methods containing suspicious form data such as "wermgr.exe" or "svchost.exe". This activity is significant because it is commonly associated with malware like Trickbot, trojans, keyloggers, or APT adversaries, which use plain text HTTP POST requests to communicate with remote C2 servers. If confirmed malicious, this activity could lead to unauthorized data exfiltration, compromising sensitive information and potentially leading to further network infiltration.
 data_source:
     - Splunk Stream HTTP
-search: |-
-    `stream_http` http_method=POST form_data IN ("*wermgr.exe*","*svchost.exe*", "*name=\"proclist\"*","*ipconfig*", "*name=\"sysinfo\"*", "*net view*")
-      | stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count
-        BY src_ip dest_ip http_method
-           http_user_agent uri_path url
-           bytes_in bytes_out
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `plain_http_post_exfiltrated_data_filter`
+search: |
+    `stream_http` http_method="POST" form_data IN ("*wermgr.exe*", "*svchost.exe*", "*name=\"proclist\"*", "*ipconfig*", "*name=\"sysinfo\"*", "*net view*") | eval uri_path=uri_path, dest=dest, src=src | stats count min(_time) as firstTime max(_time) as lastTime by http_method form_data src_ip dest_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `plain_http_post_exfiltrated_data_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the stream HTTP logs or network logs that catch network traffic. Make sure that the http-request-body, payload, or request field is enabled.
 known_false_positives: No false positives have been identified at this time.
 references:
@@ -30,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src_ip$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A http post $http_method$ sending packet with plain text of information in uri path $uri_path$
     entity:
diff --git a/detections/web/proxyshell_proxynotshell_behavior_detected.yml b/detections/web/proxyshell_proxynotshell_behavior_detected.yml
index 4328241cec4..e50d650c605 100644
--- a/detections/web/proxyshell_proxynotshell_behavior_detected.yml
+++ b/detections/web/proxyshell_proxynotshell_behavior_detected.yml
@@ -8,7 +8,7 @@ status: production
 type: Correlation
 description: The following analytic identifies potential exploitation of Windows Exchange servers via ProxyShell or ProxyNotShell vulnerabilities, followed by post-exploitation activities such as running nltest, Cobalt Strike, Mimikatz, and adding new users. It leverages data from multiple analytic stories, requiring at least five distinct sources to trigger, thus reducing noise. This activity is significant as it indicates a high likelihood of an active compromise, potentially leading to unauthorized access, privilege escalation, and persistent threats within the environment. If confirmed malicious, attackers could gain control over the Exchange server, exfiltrate data, and maintain long-term access.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.analyticstories) as analyticstories values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count dc(All_Risk.analyticstories) as dc_analyticstories FROM datamodel=Risk.All_Risk
       WHERE All_Risk.analyticstories IN ("ProxyNotShell","ProxyShell")
         OR
@@ -35,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$risk_object$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: ProxyShell/ProxyNotShell Behavior Detected - $risk_object$
     entity:
diff --git a/detections/web/sap_netweaver_visual_composer_exploitation_attempt.yml b/detections/web/sap_netweaver_visual_composer_exploitation_attempt.yml
index dd17bb90c06..3c7339f0ab2 100644
--- a/detections/web/sap_netweaver_visual_composer_exploitation_attempt.yml
+++ b/detections/web/sap_netweaver_visual_composer_exploitation_attempt.yml
@@ -6,52 +6,25 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: Hunting
-description: |-
-    Detects potential exploitation attempts targeting CVE-2025-31324, a critical unauthenticated file upload vulnerability in SAP NetWeaver Visual Composer.
+description: 'Detects potential exploitation attempts targeting CVE-2025-31324, a critical unauthenticated file upload vulnerability in SAP NetWeaver Visual Composer.
+
     This flaw allows remote attackers to send specially crafted POST requests to the /developmentserver/metadatauploader endpoint, enabling arbitrary file uploads—commonly webshells—resulting in full system compromise.
+
     The detection looks for HTTP HEAD or POST requests with a 200 OK status to sensitive Visual Composer endpoints, which may indicate reconnaissance or active exploitation.
+
     Successful exploitation can lead to attackers gaining privileged access, deploying malware, and impacting business-critical SAP resources.
-    Immediate patching and investigation of suspicious activity are strongly recommended, as this vulnerability is being actively exploited in the wild.
+
+    Immediate patching and investigation of suspicious activity are strongly recommended, as this vulnerability is being actively exploited in the wild.'
 data_source:
     - Suricata
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Web.Web WHERE
-
-    Web.url IN (
-        "*/ctc/CTCWebService/CTCWebServiceBean",
-        "*/CTCWebService/CTCWebServiceBean",
-        "*/VisualComposer/services/DesignTimeService"
-    )
-    Web.http_method IN ("HEAD", "POST")
-    Web.status=200
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url IN ("*/ctc/CTCWebService/CTCWebServiceBean", "*/CTCWebService/CTCWebServiceBean", "*/VisualComposer/services/DesignTimeService") Web.http_method IN ("HEAD", "POST") Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sap_netweaver_visual_composer_exploitation_attempt_filter`
+how_to_implement: 'Ensure that the Web data model is accelerated and populated with web server or web proxy logs capturing HTTP request and response data.
 
-    BY Web.src Web.dest Web.http_method
-       Web.url Web.http_user_agent Web.url_length
+    This search relies on HTTP method, status code, and URL path fields to identify suspicious access patterns against SAP NetWeaver endpoints.'
+known_false_positives: 'Some legitimate administrative activity may access SAP NetWeaver services. However, HEAD or POST requests directly resulting in a 200 OK
 
-    | `drop_dm_object_name("Web")`
-
-    | eval action=case(
-        http_method="HEAD", "Recon/Probe",
-        http_method="POST", "Possible Exploitation"
-    )
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-
-    | table firstTime lastTime src dest http_method
-            action url user_agent url_length
-
-    | `sap_netweaver_visual_composer_exploitation_attempt_filter`
-how_to_implement: |-
-    Ensure that the Web data model is accelerated and populated with web server or web proxy logs capturing HTTP request and response data.
-    This search relies on HTTP method, status code, and URL path fields to identify suspicious access patterns against SAP NetWeaver endpoints.
-known_false_positives: |-
-    Some legitimate administrative activity may access SAP NetWeaver services. However, HEAD or POST requests directly resulting in a 200 OK
-    to Visual Composer endpoints are uncommon and should be investigated carefully.
+    to Visual Composer endpoints are uncommon and should be investigated carefully.'
 references:
     - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
     - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
@@ -73,6 +46,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/sap/suricata_sapnetweaver.log
-          sourcetype: suricata
           source: not_applicable
+          sourcetype: suricata
       test_type: unit
diff --git a/detections/web/spring4shell_payload_url_request.yml b/detections/web/spring4shell_payload_url_request.yml
index 42a8e005df1..0467591dae6 100644
--- a/detections/web/spring4shell_payload_url_request.yml
+++ b/detections/web/spring4shell_payload_url_request.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic detects attempts to exploit the Spring4Shell vulnerability (CVE-2022-22963) by identifying specific URL patterns associated with web shell payloads. It leverages web traffic data, focusing on HTTP GET requests with URLs containing indicators like "tomcatwar.jsp," "poc.jsp," and "shell.jsp." This activity is significant as it suggests an attacker is trying to deploy a web shell, which can lead to remote code execution. If confirmed malicious, this could allow the attacker to gain persistent access, execute arbitrary commands, and potentially escalate privileges within the compromised environment.
 data_source:
     - Nginx Access
-search: |-
-    | tstats count FROM datamodel=Web
-      WHERE Web.http_method IN ("GET") Web.url IN ("*tomcatwar.jsp*","*poc.jsp*","*shell.jsp*")
-      BY Web.http_user_agent Web.http_method, Web.url,Web.url_length
-         Web.src, Web.dest sourcetype
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `spring4shell_payload_url_request_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.http_method="GET" Web.url IN ("*tomcatwar.jsp*", "*poc.jsp*", "*shell.jsp*") by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spring4shell_payload_url_request_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
 known_false_positives: The jsp file names are static names used in current proof of concept code. =
 references:
@@ -32,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A URL was requested related to Spring4Shell POC code on $dest$ by $src$.
     entity:
diff --git a/detections/web/sql_injection_with_long_urls.yml b/detections/web/sql_injection_with_long_urls.yml
index dcc36977e0d..d51a2af6b1d 100644
--- a/detections/web/sql_injection_with_long_urls.yml
+++ b/detections/web/sql_injection_with_long_urls.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic detects long URLs containing multiple SQL commands, indicating a potential SQL injection attack. This detection leverages web traffic data, specifically targeting web server destinations with URLs longer than 1024 characters or HTTP user agents longer than 200 characters. SQL injection is significant as it allows attackers to manipulate a web application's database, potentially leading to unauthorized data access or modification. If confirmed malicious, this activity could result in data breaches, unauthorized access, and complete system compromise. Immediate investigation and validation of alerts are crucial to mitigate these risks.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` count FROM datamodel=Web
       WHERE Web.dest_category=web_server
         AND
diff --git a/detections/web/supernova_webshell.yml b/detections/web/supernova_webshell.yml
index 258aa454466..5d624df460d 100644
--- a/detections/web/supernova_webshell.yml
+++ b/detections/web/supernova_webshell.yml
@@ -8,7 +8,7 @@ status: experimental
 type: TTP
 description: The following analytic detects the presence of the Supernova webshell, used in the SUNBURST attack, by identifying specific patterns in web URLs. The detection leverages Splunk to search for URLs containing "*logoimagehandler.ashx*codes*", "*logoimagehandler.ashx*clazz*", "*logoimagehandler.ashx*method*", and "*logoimagehandler.ashx*args*". This activity is significant as it indicates potential unauthorized access and arbitrary code execution on a compromised system. If confirmed malicious, this could lead to data theft, ransomware deployment, or other severe outcomes. Immediate steps include reviewing the web URLs, inspecting on-disk artifacts, and analyzing concurrent processes and network connections.
 data_source: []
-search: |-
+search: |
     | tstats `security_content_summariesonly` count FROM datamodel=Web.Web
       WHERE web.url=*logoimagehandler.ashx*codes*
         OR
diff --git a/detections/web/tomcat_session_deserialization_attempt.yml b/detections/web/tomcat_session_deserialization_attempt.yml
index 9eca9ceacbc..d555a0b304f 100644
--- a/detections/web/tomcat_session_deserialization_attempt.yml
+++ b/detections/web/tomcat_session_deserialization_attempt.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This detection identifies potential exploitation of CVE-2025-24813 in Apache Tomcat through the second stage of the attack. This phase occurs when an attacker attempts to trigger deserialization of a previously uploaded malicious session file by sending a GET request with a specially crafted JSESSIONID cookie. These requests typically have specific characteristics, including a JSESSIONID cookie with a leading dot that matches a previously uploaded filename, and typically result in a HTTP 500 error when the exploitation succeeds.
 data_source:
     - Nginx Access
-search: |-
+search: |
     | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
       WHERE Web.http_method=GET
         AND
@@ -41,7 +41,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: View suspicious JSESSIONID cookies
       search: '| from datamodel Web.Web | search http_method=GET AND cookie="*JSESSIONID=.*" src=$src$ | table src dest http_method uri_path http_user_agent status'
       earliest_offset: $info_min_time$
@@ -73,6 +73,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/tomcat/tomcat_nginx_access.log
-          sourcetype: nginx:plus:kv
           source: nginx
+          sourcetype: nginx:plus:kv
       test_type: unit
diff --git a/detections/web/tomcat_session_file_upload_attempt.yml b/detections/web/tomcat_session_file_upload_attempt.yml
index 3903c1e1a32..9f332c53d58 100644
--- a/detections/web/tomcat_session_file_upload_attempt.yml
+++ b/detections/web/tomcat_session_file_upload_attempt.yml
@@ -9,7 +9,7 @@ type: Anomaly
 description: This detection identifies potential exploitation of CVE-2025-24813 in Apache Tomcat through the initial stage of the attack. This first phase occurs when an attacker attempts to upload a malicious serialized Java object with a .session file extension via an HTTP PUT request. When successful, these uploads typically result in HTTP status codes 201 (Created) or 409 (Conflict) and create the foundation for subsequent deserialization attacks by placing malicious content in a location where Tomcat's session management can access it.
 data_source:
     - Nginx Access
-search: |-
+search: |
     | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
       WHERE Web.http_method=PUT
         AND
@@ -42,7 +42,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
     - name: View all PUT requests to .session files
       search: '| from datamodel Web.Web | search http_method = PUT uri_path="*.session" src=$src$ | table src dest http_method uri_path http_user_agent status'
       earliest_offset: $info_min_time$
@@ -74,6 +74,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/tomcat/tomcat_nginx_access.log
-          sourcetype: nginx:plus:kv
           source: nginx
+          sourcetype: nginx:plus:kv
       test_type: unit
diff --git a/detections/web/unusual_http_request_method.yml b/detections/web/unusual_http_request_method.yml
index de653940668..f208584c72f 100644
--- a/detections/web/unusual_http_request_method.yml
+++ b/detections/web/unusual_http_request_method.yml
@@ -6,60 +6,21 @@ modification_date: '2026-10-12'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
-description: |-
-    The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods.
+description: 'The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods.
+
     Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic.
-    Review the method, source, destination, and URI to assess the activity.
+
+    Review the method, source, destination, and URI to assess the activity.'
 data_source:
     - Zeek HTTP
-search: |-
-    `zeek_http`
-    method=*
-    NOT method IN (
-          "ACL",
-          "CCM_POST",
-          "CONNECT",
-          "COPY",
-          "DELETE",
-          "GET",
-          "HEAD",
-          "LOCK",
-          "MKCOL",
-          "MOVE",
-          "OPTIONS",
-          "PATCH",
-          "POST",
-          "PRI",
-          "PROPFIND",
-          "PROPPATCH",
-          "PUT",
-          "REPORT",
-          "SEARCH",
-          "TRACE",
-          "unknown",
-          "UNLOCK"
-        )
-
-    | eval dest_port=coalesce(dest_port, 'id.resp_p'),
-           dest=coalesce(dest, dest_ip, 'id.resp_h'),
-           src=coalesce(src, src_ip, 'id.orig_h')
+search: |
+    `zeek_http` method="*" NOT (method IN ("ACL", "CCM_POST", "CONNECT", "COPY", "DELETE", "GET", "HEAD", "LOCK", "MKCOL", "MOVE", "OPTIONS", "PATCH", "POST", "PRI", "PROPFIND", "PROPPATCH", "PUT", "REPORT", "SEARCH", "TRACE", "unknown", "UNLOCK")) | stats count min(_time) as firstTime max(_time) as lastTime by orig_h resp_h resp_p uri method status_code src dest dest_port | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `unusual_http_request_method_filter`
+how_to_implement: 'Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466).
 
-    | stats count min(_time) as firstTime max(_time) as lastTime
-                  values(method) as method
-                  values(uri) as uri
-                  values(status_code) as status_code
+    Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on.'
+known_false_positives: 'Some legitimate applications and frameworks may use non-standard HTTP methods.
 
-      by src dest dest_port
-
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `unusual_http_request_method_filter`
-how_to_implement: |-
-    Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466).
-    Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on.
-known_false_positives: |-
-    Some legitimate applications and frameworks may use non-standard HTTP methods.
-    Review the method and destination to determine whether the traffic is expected, then add confirmed legitimate methods to the allowlist.
+    Review the method and destination to determine whether the traffic is expected, then add confirmed legitimate methods to the allowlist.'
 references:
     - https://attack.mitre.org/techniques/T1071/001/
     - https://attack.mitre.org/techniques/T1190/
@@ -72,16 +33,14 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$id.orig_h$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
           type: system
           score: 20
           message: An unusual HTTP method [$method$] ws observed from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$].
-threat_objects:
-    - field: uri
-      type: uri
+threat_objects: []
 analytic_story:
     - Command And Control
     - HTTP Request Smuggling
@@ -99,6 +58,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071/zeek_http_unusual_method/http.log
-          sourcetype: zeek:http
           source: http.log
+          sourcetype: zeek:http
       test_type: unit
diff --git a/detections/web/unusually_long_content_type_length.yml b/detections/web/unusually_long_content_type_length.yml
index d7975e1a33b..2e4a2a10ee0 100644
--- a/detections/web/unusually_long_content_type_length.yml
+++ b/detections/web/unusually_long_content_type_length.yml
@@ -8,14 +8,8 @@ status: experimental
 type: Anomaly
 description: The following analytic identifies unusually long strings in the Content-Type HTTP header sent by the client to the server. It uses data from the Stream:HTTP source, specifically evaluating the length of the `cs_content_type` field. This activity is significant because excessively long Content-Type headers can indicate attempts to exploit vulnerabilities or evade detection mechanisms. If confirmed malicious, this behavior could allow attackers to execute code, manipulate data, or bypass security controls, potentially leading to unauthorized access or data breaches.
 data_source: []
-search: >-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Web by Web.src Web.dest Web.url Web.http_user_agent Web.http_content_type
-    | `drop_dm_object_name("Web")`  | eval http_content_type_length = len(http_content_type)  |
-    where http_content_type_length > 100
-    | table firstTime lastTime src dest http_content_type_length http_content_type url
-    http_user_agent
-    | `security_content_ctime(firstTime)`  | `security_content_ctime(lastTime)`  | `unusually_long_content_type_length_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Web by Web.src Web.dest Web.url Web.http_user_agent Web.http_content_type | `drop_dm_object_name("Web")`  | eval http_content_type_length = len(http_content_type)  | where http_content_type_length > 100 | table firstTime lastTime src dest http_content_type_length http_content_type url http_user_agent | `security_content_ctime(firstTime)`  | `security_content_ctime(lastTime)`  | `unusually_long_content_type_length_filter`
 how_to_implement: This particular search leverages data extracted from Stream:HTTP. You must configure the http stream using the Splunk Stream App on your Splunk Stream deployment server to extract the cs_content_type field.
 known_false_positives: Very few legitimate Content-Type fields will have a length greater than 100 characters.
 references: []
diff --git a/detections/web/vmware_aria_operations_exploit_attempt.yml b/detections/web/vmware_aria_operations_exploit_attempt.yml
index 71a74121a78..a713580c64a 100644
--- a/detections/web/vmware_aria_operations_exploit_attempt.yml
+++ b/detections/web/vmware_aria_operations_exploit_attempt.yml
@@ -6,37 +6,19 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |
-    The following analytic detects potential exploitation attempts against VMWare vRealize Network Insight, specifically targeting the CVE-2023-20887 vulnerability.
+description: 'The following analytic detects potential exploitation attempts against VMWare vRealize Network Insight, specifically targeting the CVE-2023-20887 vulnerability.
+
     It monitors web traffic for HTTP POST requests directed at the vulnerable endpoint "/saas./resttosaasservlet." This detection leverages web traffic data, focusing on specific URL patterns and HTTP methods.
+
     Identifying this behavior is crucial for a SOC as it indicates an active exploit attempt.
-    If confirmed malicious, the attacker could execute arbitrary code, leading to unauthorized access, data theft, or further network compromise.
+
+    If confirmed malicious, the attacker could execute arbitrary code, leading to unauthorized access, data theft, or further network compromise.'
 data_source:
     - Palo Alto Network Threat
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Web WHERE
-
-    Web.url="*/saas./resttosaasservlet*"
-    Web.http_method=POST
-    Web.status IN (
-        "unknown",
-        "200"
-    )
-    BY Web.http_user_agent Web.status
-       Web.http_method Web.url Web.url_length
-       Web.src Web.dest
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `vmware_aria_operations_exploit_attempt_filter`
-how_to_implement: |
-    To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. Restrict to specific dest assets to reduce false positives.
-known_false_positives: |
-    False positives will be present based on gateways in use, modify the status field as needed.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/saas./resttosaasservlet*" Web.http_method="POST" by Web.http_user_agent Web.http_method Web.url Web.url_length Web.src Web.dest | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `vmware_aria_operations_exploit_attempt_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. Restrict to specific dest assets to reduce false positives.
+known_false_positives: False positives will be present based on gateways in use, modify the status field as needed.
 references:
     - https://nvd.nist.gov/vuln/detail/CVE-2023-20887
     - https://viz.greynoise.io/tag/vmware-aria-operations-for-networks-rce-attempt?days=30
@@ -50,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An exploitation attempt has occurred against $dest$ from $src$ related to CVE-2023-20887
     entity:
diff --git a/detections/web/vmware_server_side_template_injection_hunt.yml b/detections/web/vmware_server_side_template_injection_hunt.yml
index 46c25d58637..5bda1b787b8 100644
--- a/detections/web/vmware_server_side_template_injection_hunt.yml
+++ b/detections/web/vmware_server_side_template_injection_hunt.yml
@@ -6,37 +6,19 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: Hunting
-description: |
-    The following analytic identifies potential server-side template injection attempts related to CVE-2022-22954.
+description: 'The following analytic identifies potential server-side template injection attempts related to CVE-2022-22954.
+
     It detects suspicious URL patterns containing "deviceudid" and keywords like "java.lang.ProcessBuilder" or "freemarker.template.utility.ObjectConstructor" using web or proxy logs within the Web Datamodel.
+
     This activity is significant as it may indicate an attempt to exploit a known vulnerability in VMware, potentially leading to remote code execution.
-    If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and compromise the affected system, posing a severe security risk.
+
+    If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and compromise the affected system, posing a severe security risk.'
 data_source:
     - Palo Alto Network Threat
-search: |-
-    | tstats `security_content_summariesonly`
-             count min(_time) as firstTime
-                   max(_time) as lastTime
-
-    FROM datamodel=Web WHERE
-
-    Web.http_method="GET"
-    Web.url="*deviceudid=*"
-    Web.url IN (
-        "*freemarker.template.utility.ObjectConstructor*",
-        "*java.lang.ProcessBuilder*"
-    )
-    BY Web.http_user_agent Web.status
-       Web.http_method Web.url Web.url_length
-       Web.src Web.dest
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `vmware_server_side_template_injection_hunt_filter`
-how_to_implement: |
-    To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
-known_false_positives: |
-    False positives may be present if the activity is blocked or was not successful. Filter known vulnerability scanners. Filter as needed.
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.http_method="GET" Web.url="*deviceudid=*" Web.url IN ("*freemarker.template.utility.ObjectConstructor*", "*java.lang.ProcessBuilder*") by Web.http_user_agent Web.http_method Web.url Web.url_length Web.src Web.dest | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `vmware_server_side_template_injection_hunt_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
+known_false_positives: False positives may be present if the activity is blocked or was not successful. Filter known vulnerability scanners. Filter as needed.
 references:
     - https://www.cisa.gov/uscert/ncas/alerts/aa22-138b
     - https://github.com/wvu/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb
diff --git a/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml
index 16669c9d29c..7e4a0bc9782 100644
--- a/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml
+++ b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml
@@ -6,34 +6,21 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
-description: |
-    The following analytic detects server-side template injection attempts related to CVE-2022-22954 in VMware Workspace ONE.
+description: 'The following analytic detects server-side template injection attempts related to CVE-2022-22954 in VMware Workspace ONE.
+
     It leverages web or proxy logs to identify HTTP GET requests to the endpoint catalog-portal/ui/oauth/verify with the freemarker.template.utility.Execute command.
+
     This activity is significant as it indicates potential exploitation attempts that could lead to remote code execution.
-    If confirmed malicious, an attacker could execute arbitrary commands on the server, leading to full system compromise, data exfiltration, or further lateral movement within the network.
+
+    If confirmed malicious, an attacker could execute arbitrary commands on the server, leading to full system compromise, data exfiltration, or further lateral movement within the network.'
 data_source:
     - Palo Alto Network Threat
-search: |-
-    | tstats `security_content_summariesonly`
-             count min(_time) as firstTime
-                   max(_time) as lastTime
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.http_method="GET" Web.url="*/catalog-portal/ui/oauth/verify*error=&deviceudid=*" Web.url="*freemarker.template.utility.Execute*" by Web.http_user_agent Web.http_method Web.url Web.url_length Web.src Web.dest | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `vmware_workspace_one_freemarker_server_side_template_injection_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
+known_false_positives: 'False positives may be present if the activity is blocked or was not successful.
 
-    FROM datamodel=Web WHERE
-    Web.http_method="GET"
-    Web.url="*/catalog-portal/ui/oauth/verify?error=&deviceudid=*"
-    Web.url="*freemarker.template.utility.Execute*"
-    BY Web.http_user_agent Web.http_method
-       Web.url Web.url_length
-       Web.src Web.dest sourcetype
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `vmware_workspace_one_freemarker_server_side_template_injection_filter`
-how_to_implement: |
-    To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
-known_false_positives: |
-    False positives may be present if the activity is blocked or was not successful.
-    Filter known vulnerability scanners. Filter as needed.
+    Filter known vulnerability scanners. Filter as needed.'
 references:
     - https://www.cisa.gov/uscert/ncas/alerts/aa22-138b
     - https://github.com/wvu/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb
@@ -48,7 +35,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: dest
diff --git a/detections/web/web_jsp_request_via_url.yml b/detections/web/web_jsp_request_via_url.yml
index 92344ec7067..ce27a46aa9a 100644
--- a/detections/web/web_jsp_request_via_url.yml
+++ b/detections/web/web_jsp_request_via_url.yml
@@ -9,15 +9,8 @@ type: TTP
 description: The following analytic identifies URL requests associated with CVE-2022-22965 (Spring4Shell) exploitation attempts, specifically targeting webshell access on a remote webserver. It detects HTTP GET requests with URLs containing ".jsp?cmd=" or "j&cmd=" patterns. This activity is significant as it indicates potential webshell deployment, which can lead to unauthorized remote command execution. If confirmed malicious, attackers could gain control over the webserver, execute arbitrary commands, and potentially escalate privileges, leading to severe data breaches and system compromise.
 data_source:
     - Nginx Access
-search: |-
-    | tstats count FROM datamodel=Web
-      WHERE Web.http_method IN ("GET") Web.url IN ("*.jsp?cmd=*","*j&cmd=*")
-      BY Web.http_user_agent Web.http_method, Web.url,Web.url_length
-         Web.src, Web.dest sourcetype
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `web_jsp_request_via_url_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.http_method="GET" Web.url IN ("*.jsp*cmd=*", "*j&cmd=*") by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `web_jsp_request_via_url_filter`
 how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
 known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to servers.
 references:
@@ -32,7 +25,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A suspicious URL has been requested against $dest$ by $src$, related to web shell activity.
     entity:
diff --git a/detections/web/web_remote_shellservlet_access.yml b/detections/web/web_remote_shellservlet_access.yml
index 13bae0b0770..7aeedf5a2c7 100644
--- a/detections/web/web_remote_shellservlet_access.yml
+++ b/detections/web/web_remote_shellservlet_access.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic identifies attempts to access the Remote ShellServlet on a web server, specifically targeting Confluence servers vulnerable to CVE-2023-22518 and CVE-2023-22515. It leverages web data to detect URLs containing "*plugins/servlet/com.jsos.shell/*" with a status code of 200. This activity is significant as it is commonly associated with web shells and other malicious behaviors, potentially leading to unauthorized command execution. If confirmed malicious, attackers could gain remote code execution capabilities, compromising the server and potentially the entire network.
 data_source:
     - Nginx Access
-search: |-
-    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE Web.url IN ("*plugins/servlet/com.jsos.shell/*") Web.status=200
-      BY Web.http_user_agent, Web.status Web.http_method,
-         Web.url, Web.url_length, Web.src,
-         Web.dest, sourcetype
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `web_remote_shellservlet_access_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*plugins/servlet/com.jsos.shell/*" Web.status="200" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `web_remote_shellservlet_access_filter`
 how_to_implement: This analytic necessitates the collection of web data, which can be achieved through Splunk Stream or by utilizing the Splunk Add-on for Apache Web Server. No additional configuration is required for this analytic.
 known_false_positives: False positives may occur depending on the web server's configuration. If the web server is intentionally configured to utilize the Remote ShellServlet, then the detections by this analytic would not be considered true positives.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: An attempt to access the Remote ShellServlet on a web server was detected. The source IP is $src$ and the destination hostname is $dest$.
     entity:
diff --git a/detections/web/web_spring4shell_http_request_class_module.yml b/detections/web/web_spring4shell_http_request_class_module.yml
index 629446ac3a1..f4c1dba3902 100644
--- a/detections/web/web_spring4shell_http_request_class_module.yml
+++ b/detections/web/web_spring4shell_http_request_class_module.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects HTTP requests containing payloads related to the Spring4Shell vulnerability (CVE-2022-22965). It leverages Splunk Stream HTTP data to inspect the HTTP request body and form data for specific fields such as "class.module.classLoader.resources.context.parent.pipeline.first". This activity is significant as it indicates an attempt to exploit a critical vulnerability in Spring Framework, potentially leading to remote code execution. If confirmed malicious, this could allow attackers to gain unauthorized access, execute arbitrary code, and compromise the affected system.
 data_source:
     - Splunk Stream HTTP
-search: |-
-    `stream_http` http_method IN ("POST")
-      | stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count
-        BY src dest http_method
-           http_user_agent uri_path url
-           bytes_in bytes_out
-      | search http_request_body IN ("*class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=_*", "*class.module.classLoader.resources.context.parent.pipeline.first.pattern*","*suffix=.jsp*")
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `web_spring4shell_http_request_class_module_filter`
+search: |
+    `stream_http` http_method="POST" | eval uri_path=uri_path, dest=dest, src=src | stats count min(_time) as firstTime max(_time) as lastTime by http_method | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `web_spring4shell_http_request_class_module_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting logs with the stream HTTP logs or network logs that catch network traffic. Make sure that the http-request-body, payload, or request field is enabled.
 known_false_positives: False positives may occur and filtering may be required. Restrict analytic to asset type.
 references:
@@ -31,7 +23,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A http body request related to Spring4Shell has been sent to $dest$ by $src$.
     entity:
diff --git a/detections/web/web_spring_cloud_function_functionrouter.yml b/detections/web/web_spring_cloud_function_functionrouter.yml
index bc8c1babecb..cb143920c3a 100644
--- a/detections/web/web_spring_cloud_function_functionrouter.yml
+++ b/detections/web/web_spring_cloud_function_functionrouter.yml
@@ -9,7 +9,7 @@ type: TTP
 description: The following analytic identifies HTTP POST requests to the Spring Cloud Function endpoint containing "functionRouter" in the URL. It leverages the Web data model to detect these requests based on specific fields such as http_method, url, and http_user_agent. This activity is significant because it targets CVE-2022-22963, a known vulnerability in Spring Cloud Function, which has multiple proof-of-concept exploits available. If confirmed malicious, this activity could allow attackers to execute arbitrary code, potentially leading to unauthorized access, data exfiltration, or further compromise of the affected system.
 data_source:
     - Splunk Stream HTTP
-search: |-
+search: |
     | tstats count FROM datamodel=Web
       WHERE Web.http_method IN ("POST") Web.url="*/functionRouter*"
       BY Web.http_user_agent Web.http_method, Web.url,Web.url_length
@@ -32,7 +32,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: A suspicious URL has been requested against $dest$ by $src$, related to a vulnerability in Spring Cloud.
     entity:
diff --git a/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml
index 71c60bbf48e..64dd4f14132 100644
--- a/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml
+++ b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml
@@ -9,7 +9,7 @@ type: TTP
 description: This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server. The detection focuses on identifying the SSRF attack patterns used in these exploit chains. The analytic monitors for suspicious POST requests to /autodiscover/autodiscover.json endpoints that may indicate attempts to enumerate LegacyDN attributes as part of initial reconnaissance. It also detects requests containing X-Rps-CAT parameters that could indicate attempts to impersonate Exchange users and access the PowerShell backend. Additionally, it looks for MAPI requests that may be used to obtain user SIDs, along with suspicious user agents (particularly Python-based) commonly used in automated exploit attempts. If successful, these attacks can lead to remote code execution as SYSTEM, allowing attackers to deploy webshells, access mailboxes, or gain persistent access to the Exchange server and potentially the broader network environment.
 data_source:
     - Windows IIS
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
       WHERE (
             Web.status=200
@@ -50,7 +50,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Activity related to ProxyShell or ProxyNotShell has been identified on $dest$. Review events and take action accordingly.
     entity:
diff --git a/detections/web/windows_iis_server_pswa_console_access.yml b/detections/web/windows_iis_server_pswa_console_access.yml
index 99b362e9fc1..f9f8a370efc 100644
--- a/detections/web/windows_iis_server_pswa_console_access.yml
+++ b/detections/web/windows_iis_server_pswa_console_access.yml
@@ -9,7 +9,7 @@ type: Hunting
 description: This analytic detects access attempts to the PowerShell Web Access (PSWA) console on Windows IIS servers. It monitors web traffic for requests to PSWA-related URIs, which could indicate legitimate administrative activity or potential unauthorized access attempts. By tracking source IP, HTTP status, URI path, and HTTP method, it helps identify suspicious patterns or brute-force attacks targeting PSWA. This detection is crucial for maintaining the security of remote PowerShell management interfaces and preventing potential exploitation of this powerful administrative tool.
 data_source:
     - Windows IIS
-search: |-
+search: |
     | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
       WHERE Web.dest IN ("/pswa/*")
       BY Web.src Web.status Web.uri_path
@@ -37,6 +37,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/pswa/iis_pswaaccess.log
-          sourcetype: ms:iis:splunk
           source: ms:iis:splunk
+          sourcetype: ms:iis:splunk
       test_type: unit
diff --git a/detections/web/windows_sharepoint_spinstall0_get_request.yml b/detections/web/windows_sharepoint_spinstall0_get_request.yml
index 7f4f5c5ac77..4d3b6024c65 100644
--- a/detections/web/windows_sharepoint_spinstall0_get_request.yml
+++ b/detections/web/windows_sharepoint_spinstall0_get_request.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic detects potential post-exploitation activity related to the Microsoft SharePoint CVE-2025-53770 vulnerability. After successful exploitation via the ToolPane.aspx endpoint, attackers typically deploy a webshell named "spinstall0.aspx" in the SharePoint layouts directory. This detection identifies GET requests to this webshell, which indicates active use of the backdoor for command execution, data exfiltration, or credential/key extraction. Attackers commonly use these webshells to extract encryption keys, authentication tokens, and other sensitive information from the compromised SharePoint server.
 data_source:
     - Suricata
-search: |-
-    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE Web.url="*/_layouts/15/spinstall0.aspx*" Web.http_method="GET"
-      BY Web.url Web.src Web.dest
-         Web.status Web.http_user_agent Web.url_length
-         sourcetype
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_sharepoint_spinstall0_get_request_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/_layouts/15/spinstall0.aspx*" Web.http_method="GET" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sharepoint_spinstall0_get_request_filter`
 how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Microsoft SharePoint or web proxy logs that capture SharePoint traffic. The detection focuses on GET requests to the spinstall0.aspx file, which is a known webshell deployed after successful exploitation of the CVE-2025-53770 vulnerability. Configure comprehensive logging for your SharePoint web servers and ensure that all HTTP requests are being captured and forwarded to your SIEM. Ensure proper IIS logging is enabled. Tune, modify the analytic as needed based on HTTP methods.
 known_false_positives: Limited false positives are expected as spinstall0.aspx is not a legitimate SharePoint component. However, security teams investigating the incident might also access this file for analysis purposes. Verify the source IP addresses against known security team IPs and the timing of the requests in relation to the initial exploitation attempt.
 references:
@@ -34,7 +26,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential access to SharePoint webshell (spinstall0.aspx) detected from $src$ targeting $dest$
     entity:
@@ -63,6 +55,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/sharepoint/spinstall0.log
-          sourcetype: suricata
           source: not_applicable
+          sourcetype: suricata
       test_type: unit
diff --git a/detections/web/windows_sharepoint_toolpane_endpoint_exploitation_attempt.yml b/detections/web/windows_sharepoint_toolpane_endpoint_exploitation_attempt.yml
index f1b443f6aaf..5c4da7805b2 100644
--- a/detections/web/windows_sharepoint_toolpane_endpoint_exploitation_attempt.yml
+++ b/detections/web/windows_sharepoint_toolpane_endpoint_exploitation_attempt.yml
@@ -9,18 +9,8 @@ type: TTP
 description: The following analytic detects potential exploitation attempts against Microsoft SharePoint Server vulnerability CVE-2025-53770, also known as "ToolShell". This detection monitors for POST requests to the ToolPane.aspx endpoint with specific DisplayMode parameter, which is a key indicator of the exploit. This vulnerability allows unauthenticated remote code execution on affected SharePoint servers, enabling attackers to fully access SharePoint content, file systems, internal configurations, and execute code over the network.
 data_source:
     - Suricata
-search: |-
-    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE Web.url="*/_layouts/15/ToolPane.aspx*"
-        AND
-        Web.url="*DisplayMode=Edit*" Web.http_method=POST
-      BY Web.http_user_agent, Web.status, Web.http_method,
-         Web.url, Web.url_length, Web.src,
-         Web.dest, sourcetype
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `windows_sharepoint_toolpane_endpoint_exploitation_attempt_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/_layouts/15/ToolPane.aspx*" Web.url="*DisplayMode=Edit*" Web.http_method="POST" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sharepoint_toolpane_endpoint_exploitation_attempt_filter`
 how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Microsoft SharePoint or web proxy logs that capture SharePoint traffic. Configure AMSI integration in SharePoint and deploy Microsoft Defender AV on all SharePoint servers as recommended by Microsoft to provide additional protection.
 known_false_positives: Limited false positives are expected as legitimate use of the ToolPane.aspx endpoint with DisplayMode=Edit parameter in POST requests is uncommon. However, some SharePoint administration activities might trigger this detection. Verify against known administrator IPs and activity patterns.
 references:
@@ -37,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential SharePoint ToolPane exploitation (CVE-2025-53770) detected from $src$ targeting $dest$
     entity:
@@ -65,6 +55,6 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/sharepoint/toolpane.log
-          sourcetype: suricata
           source: not_applicable
+          sourcetype: suricata
       test_type: unit
diff --git a/detections/web/wordpress_bricks_builder_plugin_rce.yml b/detections/web/wordpress_bricks_builder_plugin_rce.yml
index 626e0909ecc..c0be1a5f0c1 100644
--- a/detections/web/wordpress_bricks_builder_plugin_rce.yml
+++ b/detections/web/wordpress_bricks_builder_plugin_rce.yml
@@ -9,16 +9,8 @@ type: TTP
 description: The following analytic identifies potential exploitation of the WordPress Bricks Builder plugin RCE vulnerability. It detects HTTP POST requests to the URL path "/wp-json/bricks/v1/render_element" with a status code of 200, leveraging the Web datamodel. This activity is significant as it indicates an attempt to exploit CVE-2024-25600, a known vulnerability that allows remote code execution. If confirmed malicious, an attacker could execute arbitrary commands on the target server, leading to potential full system compromise and unauthorized access to sensitive data.
 data_source:
     - Nginx Access
-search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
-      WHERE Web.url IN ("*/wp-json/bricks/v1/render_element") Web.status=200 Web.http_method=POST
-      BY Web.src, Web.dest, Web.http_user_agent,
-         Web.url, Web.uri_path, Web.status,
-         Web.http_method, sourcetype, source
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `wordpress_bricks_builder_plugin_rce_filter`
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/wp-json/bricks/v1/render_element" Web.status="200" Web.http_method="POST" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wordpress_bricks_builder_plugin_rce_filter`
 how_to_implement: The search is based on data in the Web datamodel and was modeled from NGINX logs. Ensure that the Web datamodel is accelerated and that the data source for the Web datamodel is properly configured. If using other web sources, modify they query, or review the data, as needed.
 known_false_positives: False positives may be possible, however we restricted it to HTTP Status 200 and POST requests, based on the POC. Upon investigation review the POST body for the actual payload - or command - being executed.
 references:
@@ -35,7 +27,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential exploitation of the WordPress Bricks Builder plugin RCE vulnerability on $dest$ by $src$.
     entity:
diff --git a/detections/web/ws_ftp_remote_code_execution.yml b/detections/web/ws_ftp_remote_code_execution.yml
index 4eb9e63f40f..8ac0d1b2748 100644
--- a/detections/web/ws_ftp_remote_code_execution.yml
+++ b/detections/web/ws_ftp_remote_code_execution.yml
@@ -6,36 +6,21 @@ modification_date: '2026-05-13'
 author: Michael Haag, Splunk
 status: production
 type: TTP
-description: |-
-    The following analytic detects potential Remote Code Execution (RCE) attempts exploiting CVE-2023-40044 in WS_FTP software.
+description: 'The following analytic detects potential Remote Code Execution (RCE) attempts exploiting CVE-2023-40044 in WS_FTP software.
+
     It identifies HTTP POST requests to the "/AHT/AhtApiService.asmx/AuthUser" URL with a status code of 200.
+
     This detection leverages the Web datamodel to monitor specific URL patterns and HTTP status codes. This activity is significant as it may indicate an exploitation attempt, potentially allowing an attacker to execute arbitrary code on the server.
-    If confirmed malicious, this could lead to unauthorized access, data exfiltration, or further compromise of the affected system.
+
+    If confirmed malicious, this could lead to unauthorized access, data exfiltration, or further compromise of the affected system.'
 data_source:
     - Suricata
-search: |-
-    | tstats `security_content_summariesonly`
-      count min(_time) as firstTime
-            max(_time) as lastTime
-
-    FROM datamodel=Web WHERE
-
-    Web.url="*/AHT/AhtApiService.asmx/AuthUser"
-    Web.status=200
-    Web.http_method="POST"
-
-    BY Web.http_user_agent Web.status Web.http_method
-       Web.url Web.url_length Web.src Web.dest
+search: |
+    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web where Web.url="*/AHT/AhtApiService.asmx/AuthUser" Web.status="200" Web.http_method="POST" by Web.dest Web.http_method Web.http_user_agent Web.status Web.url Web.url_length Web.src | `drop_dm_object_name(Web)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ws_ftp_remote_code_execution_filter`
+how_to_implement: The following analytic requires the Web datamodel. Ensure data source is mapped correctly or modify and tune for your data source.
+known_false_positives: 'If WS_FTP Server is not in use, this analytic will not return results. Monitor and tune for your environment.
 
-    | `drop_dm_object_name("Web")`
-    | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`
-    | `ws_ftp_remote_code_execution_filter`
-how_to_implement: |-
-    The following analytic requires the Web datamodel. Ensure data source is mapped correctly or modify and tune for your data source.
-known_false_positives: |-
-    If WS_FTP Server is not in use, this analytic will not return results. Monitor and tune for your environment.
-    Note the MetaSploit module is focused on only hitting /AHT/ and not the full /AHT/AhtApiService.asmx/AuthUser URL.
+    Note the MetaSploit module is focused on only hitting /AHT/ and not the full /AHT/AhtApiService.asmx/AuthUser URL.'
 references:
     - https://github.com/projectdiscovery/nuclei-templates/pull/8296/files
     - https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044
@@ -48,7 +33,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$dest$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential WS FTP Remote Code Execution detected against URL $url$ on $dest$ from $src$
     entity:
diff --git a/detections/web/zscaler_adware_activities_threat_blocked.yml b/detections/web/zscaler_adware_activities_threat_blocked.yml
index 32eb5904ae0..7b5a037e47f 100644
--- a/detections/web/zscaler_adware_activities_threat_blocked.yml
+++ b/detections/web/zscaler_adware_activities_threat_blocked.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic identifies potential adware activity blocked by Zscaler. It leverages web proxy logs to detect blocked actions associated with adware threats. Key data points such as device owner, user, URL category, destination URL, and IP are analyzed. This activity is significant as adware can degrade system performance, lead to unwanted advertisements, and potentially expose users to further malicious content. If confirmed malicious, it could indicate an attempt to compromise user systems, necessitating further investigation and remediation to prevent potential data breaches or system exploitation.
 data_source: []
-search: |-
+search: |
     `zscaler_proxy` action=blocked threatname=*adware*
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY action deviceowner user
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/web/zscaler_behavior_analysis_threat_blocked.yml b/detections/web/zscaler_behavior_analysis_threat_blocked.yml
index d64ef309088..c975973d69c 100644
--- a/detections/web/zscaler_behavior_analysis_threat_blocked.yml
+++ b/detections/web/zscaler_behavior_analysis_threat_blocked.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic identifies threats blocked by the Zscaler proxy based on behavior analysis. It leverages web proxy logs to detect entries where actions are blocked and threat names and classes are specified. This detection is significant as it highlights potential malicious activities that were intercepted by Zscaler's behavior analysis, providing early indicators of threats. If confirmed malicious, these blocked threats could indicate attempted breaches or malware infections, helping security teams to understand and mitigate potential risks in their environment.
 data_source: []
-search: |-
+search: |
     `zscaler_proxy` action=blocked threatname!="None" threatclass="Behavior Analysis"
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY action deviceowner user
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/web/zscaler_cryptominer_downloaded_threat_blocked.yml b/detections/web/zscaler_cryptominer_downloaded_threat_blocked.yml
index 76612c818a7..3960b2c04d4 100644
--- a/detections/web/zscaler_cryptominer_downloaded_threat_blocked.yml
+++ b/detections/web/zscaler_cryptominer_downloaded_threat_blocked.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic identifies attempts to download cryptomining software that are blocked by Zscaler. It leverages web proxy logs to detect blocked actions associated with cryptominer threats, analyzing key data points such as device owner, user, URL category, destination URL, and IP. This activity is significant for a SOC as it helps in early identification and mitigation of cryptomining activities, which can compromise network integrity and resource availability. If confirmed malicious, this activity could lead to unauthorized use of network resources for cryptomining, potentially degrading system performance and increasing operational costs.
 data_source: []
-search: |-
+search: |
     `zscaler_proxy` action=blocked threatname=*miner*
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY action deviceowner user
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/web/zscaler_employment_search_web_activity.yml b/detections/web/zscaler_employment_search_web_activity.yml
index 6f428d74259..7489f787e7e 100644
--- a/detections/web/zscaler_employment_search_web_activity.yml
+++ b/detections/web/zscaler_employment_search_web_activity.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic identifies web activity related to employment searches within a network. It leverages Zscaler web proxy logs, focusing on entries categorized as 'Job/Employment Search'. Key data points such as device owner, user, URL category, destination URL, and IP are analyzed. This detection is significant for SOCs as it helps monitor potential insider threats by identifying users who may be seeking new employment. If confirmed malicious, this activity could indicate a risk of data exfiltration or other insider threats, potentially leading to sensitive information leakage or other security breaches.
 data_source: []
-search: |-
+search: |
     `zscaler_proxy` urlsupercategory="Job/Employment Search"
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY action deviceowner user
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/web/zscaler_exploit_threat_blocked.yml b/detections/web/zscaler_exploit_threat_blocked.yml
index 3cf2d18a5ce..4207a3bdbea 100644
--- a/detections/web/zscaler_exploit_threat_blocked.yml
+++ b/detections/web/zscaler_exploit_threat_blocked.yml
@@ -8,7 +8,7 @@ status: production
 type: TTP
 description: The following analytic identifies potential exploit attempts involving command and script interpreters blocked by Zscaler. It leverages web proxy logs to detect incidents where actions are blocked due to exploit references. The detection compiles statistics by user, threat name, URL, hostname, file class, and filename. This activity is significant as it helps identify and mitigate exploit attempts, which are critical for maintaining security. If confirmed malicious, such activity could lead to unauthorized code execution, privilege escalation, or persistent access within the environment, posing a severe threat to organizational security.
 data_source: []
-search: |-
+search: |
     `zscaler_proxy` action=blocked threatname=*exploit*
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY user threatname src
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 finding:
     title: Potential Exploit Threat from dest -[$dest$] on $src$ for user-[$user$].
     entity:
diff --git a/detections/web/zscaler_legal_liability_threat_blocked.yml b/detections/web/zscaler_legal_liability_threat_blocked.yml
index fd4b66a3114..263cd19460b 100644
--- a/detections/web/zscaler_legal_liability_threat_blocked.yml
+++ b/detections/web/zscaler_legal_liability_threat_blocked.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic identifies significant legal liability threats blocked by the Zscaler web proxy. It uses web proxy logs to track destinations, device owners, users, URL categories, and actions associated with legal liability. By leveraging statistics on unique fields, it ensures a precise focus on these threats. This activity is significant for SOC as it helps enforce legal compliance and risk management. If confirmed malicious, it could indicate attempts to access legally sensitive or restricted content, potentially leading to legal repercussions and compliance violations.
 data_source: []
-search: |-
+search: |
     `zscaler_proxy` urlclass="Legal Liability"
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY action deviceowner user
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/web/zscaler_malware_activity_threat_blocked.yml b/detections/web/zscaler_malware_activity_threat_blocked.yml
index 1ec3101d820..6877c3cf372 100644
--- a/detections/web/zscaler_malware_activity_threat_blocked.yml
+++ b/detections/web/zscaler_malware_activity_threat_blocked.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic identifies potential malware activities within a network that are blocked by Zscaler. It leverages web proxy logs to filter for blocked actions associated with malware, aggregating occurrences by user, URL, and threat category. This detection is significant for SOC as it highlights attempts to access malicious content, indicating potential compromise or targeted attacks. If confirmed malicious, this activity could signify an ongoing attempt to infiltrate the network, necessitating immediate investigation to prevent further threats and ensure network integrity.
 data_source: []
-search: |-
+search: |
     `zscaler_proxy` action=blocked threatname=*malware* threatcategory!=None
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY action deviceowner user
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/web/zscaler_phishing_activity_threat_blocked.yml b/detections/web/zscaler_phishing_activity_threat_blocked.yml
index ec317cd2a32..f384a588087 100644
--- a/detections/web/zscaler_phishing_activity_threat_blocked.yml
+++ b/detections/web/zscaler_phishing_activity_threat_blocked.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic identifies potential phishing attempts blocked by Zscaler within a network. It leverages web proxy logs to detect actions tagged as HTML.Phish. The detection method involves analyzing critical data points such as user, threat name, URL, and hostname. This activity is significant for a SOC as it serves as an early warning system for phishing threats, enabling prompt investigation and mitigation. If confirmed malicious, this activity could indicate an attempt to deceive users into divulging sensitive information, potentially leading to data breaches or credential theft.
 data_source: []
-search: |-
+search: |
     `zscaler_proxy` action=blocked threatname="HTML.Phish*"
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY action deviceowner user
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/web/zscaler_potentially_abused_file_download.yml b/detections/web/zscaler_potentially_abused_file_download.yml
index 8ed48b9a8ed..e9eaa182425 100644
--- a/detections/web/zscaler_potentially_abused_file_download.yml
+++ b/detections/web/zscaler_potentially_abused_file_download.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic identifies the download of potentially malicious file types, such as .scr, .dll, .bat, and .lnk, within a network. It leverages web proxy logs from Zscaler, focusing on blocked actions and analyzing fields like deviceowner, user, urlcategory, url, dest, and filename. This activity is significant as these file types are often used to spread malware, posing a threat to network security. If confirmed malicious, this activity could lead to malware execution, data compromise, or further network infiltration.
 data_source: []
-search: |-
+search: |
     `zscaler_proxy` url IN ("*.scr", "*.dll", "*.bat", "*.lnk")
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY deviceowner user urlcategory
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml b/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml
index 1b529e669df..71aa1c5599b 100644
--- a/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml
+++ b/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic identifies blocked destinations within a network that are deemed privacy risks by Zscaler. It leverages web proxy logs, focusing on entries marked as "Privacy Risk." Key data points such as device owner, user, URL category, destination URL, and IP are analyzed. This activity is significant for a SOC as it helps monitor and manage privacy risks, ensuring a secure network environment. If confirmed malicious, this activity could indicate attempts to access or exfiltrate sensitive information, posing a significant threat to data privacy and security.
 data_source: []
-search: |-
+search: |
     `zscaler_proxy` action=blocked urlclass="Privacy Risk"
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY action deviceowner user
@@ -30,7 +30,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/web/zscaler_scam_destinations_threat_blocked.yml b/detections/web/zscaler_scam_destinations_threat_blocked.yml
index 35b4e69c05d..469e6cf0de2 100644
--- a/detections/web/zscaler_scam_destinations_threat_blocked.yml
+++ b/detections/web/zscaler_scam_destinations_threat_blocked.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic identifies blocked scam-related activities detected by Zscaler within a network. It leverages web proxy logs to examine actions flagged as scam threats, focusing on data points such as device owner, user, URL category, destination URL, and IP. This detection is significant for SOC as it helps in the early identification and mitigation of scam activities, ensuring network safety. If confirmed malicious, this activity could indicate attempts to deceive users, potentially leading to data theft or financial loss.
 data_source: []
-search: |-
+search: |
     `zscaler_proxy` action=blocked threatname=*scam*
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY action deviceowner user
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src
diff --git a/detections/web/zscaler_virus_download_threat_blocked.yml b/detections/web/zscaler_virus_download_threat_blocked.yml
index 43c4c052fc4..3690436bf2a 100644
--- a/detections/web/zscaler_virus_download_threat_blocked.yml
+++ b/detections/web/zscaler_virus_download_threat_blocked.yml
@@ -8,7 +8,7 @@ status: production
 type: Anomaly
 description: The following analytic identifies attempts to download viruses that were blocked by Zscaler within a network. It leverages web proxy logs to detect blocked actions indicative of virus download attempts. Key data points such as device owner, user, URL category, destination URL, and IP are analyzed. This activity is significant as it helps in early detection and remediation of potential virus threats, enhancing network security. If confirmed malicious, this activity could indicate an attempt to compromise the network, potentially leading to data breaches or further malware infections.
 data_source: []
-search: |-
+search: |
     `zscaler_proxy` action=blocked threatname!="None" threatclass=Virus
       | stats count min(_time) as firstTime max(_time) as lastTime
         BY action deviceowner user
@@ -29,7 +29,7 @@ drilldown_searches:
     - name: View risk events for the last 7 days for - "$src$" and "$user$"
       search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
       earliest_offset: 7d
-      latest_offset: "0"
+      latest_offset: '0'
 intermediate_findings:
     entities:
         - field: src