This PR update and fixes multiple discovered and reported issues. Below is a summary of the changes.

New Data Sources

• Windows Event Log Security 4756 - Added this new DS to link to a related detection.

Updated Data Sources

• Palo Alto Network Threat - Updated this DS to use the Palo Alto Networks Add-on
• Palo Alto Network Traffic - Updated this DS to use the Palo Alto Networks Add-on

Updated Analytics

-Email Attachments With Lots Of Spaces - Added missing MITRE IDs.

• Suspicious Java Classes - Fix broken regex (from last YAML script application) and added missing MITRE IDs.
• Cloud Compute Instance Created With Previously Unseen Instance Type - Added missing MITRE IDs.
• Certutil exe certificate extraction - Added missing MITRE IDs.
• Malicious PowerShell Process - Encoded Command - Updated the broken regex with a more robus one that aims to detect most variation of the EncodedCommand flag (Fix [BUG] Malicious PowerShell Process - Encoded Command - regex doesn't make sense #3939)
• Outbound Network Connection from Java Using Default Ports - Remove duplicate entry for javaw.exe and other updates to the SPL structure so that its more readable.
• Suspicious Rundll32 no Command Line Arguments - Remove the unnecessary usage of regex and moved the filter logic earlier for better performance
• Suspicious SearchProtocolHost no Command Line Arguments - Remove the unnecessary usage of regex and moved the filter logic earlier for better performance
• Windows New Deny Permission Set On Service SD Via Sc.EXE - Updated metadata info, including the FP section based on Athena telemetry.
• Windows New Service Security Descriptor Set Via Sc.EXE - Updated metadata info, including the FP section based on Athena telemetry.
• Windows Privilege Escalation Suspicious Process Elevation / Windows Privilege Escalation User Process Spawn System Process / Windows UAC Bypass Suspicious Escalation Behavior - Beautified the SPL of these 3 analytics for better reading (considerations are being made to deprecated these due to their poor performance).
• Detect Large ICMP Traffic / Detect Outbound LDAP Traffic - Update the logic to these by adding a more broad filter for local IPs.
• Beautified the SPL of multiple analytics that were leveraging the Palo Alto TA.
• Detect Computer Changed with Anonymous Account - Updated the logic to be more accurate. (See explanation in [BUG] Logic Problem in Detect Computer Changed with Anonymous Account #3961)
• Windows Privileged Group Modification - Update logic to include EventID 4756 (Fix Add Event ID 4756 to windows_privileged_group_modification detection #3969)
• Windows Scheduled Task Service Spawned Shell - Update and beautify the SPL as well as other metadata and RBA related config.
• Possible Lateral Movement PowerShell Spawn - Fixed FP by adding exclusion for svchost with the schedule service