diff --git a/splunk/rules_to_add_to_github.md b/splunk/rules_to_add_to_github.md
index de73c0d..562f05b 100644
--- a/splunk/rules_to_add_to_github.md
+++ b/splunk/rules_to_add_to_github.md
@@ -10,7 +10,7 @@ mitre_technique_id="T0000",
 mitre_subtechnique="",
 mitre_subtechnique_id="",
 apt="Volt Typhoon",
-mitre_link="https://attack.mitre.org/techniques/T1071/",
+mitre_link="",
 creator="Cpl Iverson",
 last_tested="2025-04-15",
 upload_date="2025-04-15",
@@ -20,7 +20,7 @@ priority="high"
 | `process_create_whitelist`
 | eval indextime = _indextime
 | convert ctime(indextime)
-| table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id hunting_trigger mitre_subtechnique mitre_subtechnique_id apt mitre_link creator last_tested upload_date last_modify_date mitre_version priority
+| table _time indextime id.orig_p id.orig_h id.resp_p id.resp_h mitre_category mitre_technique mitre_technique_id hunting_trigger mitre_subtechnique mitre_subtechnique_id apt mitre_link creator last_tested upload_date last_modify_date mitre_version priority
 | collect `jarvis_index`
 ```
 
@@ -48,7 +48,8 @@ level: medium
 ICMPDoor
 
 ```
-`indextime` sourcetype=zeek* (id.orig_p IN (6000,7000) AND id.resp_p=*) OR (id.resp_p IN (6000,7000) AND id.orig_p=*)
+`indextime` sourcetype=zeek*
+| where icmp_type=0 OR icmp_type=8
 | eval hash_sha256= lower(hash_sha256),
 hunting_trigger="Detects FRPC communication using designated ports.",
 mitre_category="Command and Control",
@@ -59,7 +60,7 @@ mitre_subtechnique_id="",
 apt="Volt Typhoon",
 mitre_link="https://attack.mitre.org/techniques/T1071/",
 creator="Cpl Iverson",
-last_tested="2025-04-15",
+last_tested="",
 upload_date="2025-04-15",
 last_modify_date="2025-04-15",
 mitre_version="v16.1",
@@ -67,7 +68,7 @@ priority="high"
 | `process_create_whitelist`
 | eval indextime = _indextime
 | convert ctime(indextime)
-| table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id hunting_trigger mitre_subtechnique mitre_subtechnique_id apt mitre_link creator last_tested upload_date last_modify_date mitre_version priority
+| table _time indextime event_description src_ip dest_ip icmp_type icmp_code mitre_category mitre_technique mitre_technique_id hunting_trigger mitre_subtechnique mitre_subtechnique_id apt mitre_link creator last_tested upload_date last_modify_date mitre_version priority
 | collect `jarvis_index`
 ```